Authentication problem in Directory Utility (Standard Mode)

Question

I misposted this in the 10.4-and-earlier section...I have Leopard.
Okay, I suppose I am in over my head as I am not a NA but just had so many macs I thought it would be fun to see if I can make OS X Server work.
I have at the moment 3 users set up: 1 admin and 2 Standard users. When one of the remote Macs tries to use Directory Utility to authenticate, it insists that "The name and password you entered for the user account on the server do not match." Well, I have reset the passwords on the server several times and I am darn sure I have them right. I can connect to the server and use folders and whatnot; i just can't use any of the services.
I suspect this is a permissions issue, because I also get errors if I try to "Allow (one of the standard users) to administer this server" in the Server Preferences/Users pane. I get "Error '-14120' occurred while processing a command of type 'setMembership' in plug-in 'servermgr_accounts'. That's very descriptive and helpful except that I do NOT know what I am doing.
Uh, little help? Did I just do something very stupid that is making everyone chuckle?

Answer 1

I've been at this for eight days myself. Lots of problems. So don't feel bad if things don't sort of "click" into place - they haven't been for me.
First off - I noticed that you have server_name.local. I'll say something right here about that. I had no end of grief when I configured my server with a .local extension. All my machines are named after Kellogg's cereals - so I decided to name this one honeycomb. So during installation I named it honeycomb.local.
Now before I explain this - understand this is my understanding .. I could be dead wrong - but this is how I understand it. Apple uses Bonjour technology to locate network resources. In a network environment there will no doubt already be conventional methods for locating computers - such as DNS, Directory Services, etc. Bonjour is designed to happily coexist with all of those. It essentially uses multicast technology to find other devices on the network and configure it. When a device is using Bonjour - it utilizes the .local suffix. You can see where I am going with this.
So I had some issues and decided to pull the plug. Reinstalled the OS and used honeycomb.private. I STILL see honeycomb.local being referenced throughout - so I feel good now that I made the right choice. Things have been going a lot better since.
I am going to use mymachine.private as the computer, and jdoe as the username in the next bit. Replace them with your own info.
+From my own experiences, here are some things to check+
*_1) Server must respond to the Client's Requests _*
On the Server:
-Use 'ipfw flush' and clear out firewall rules while you are testing.
-Does 'ping mymachine' work?
-Does 'ping mymachine.private' work?
_*2) Client must be able to find the data in Open Directory:*_
-Is Open Directory running in Server Admin.
-In Server Admin, under Open Directory, under Overview - do you have everything running? Is there an LDAP search base and a Kerberos Realm? Are they correct?
-Connect with an LDAP client if you must, and manually verify that the user information is in there. I love Apache Directory Studio (http://directory.apache.org/studio/)
-Perhaps there are certificate or identity issues - turn off the SSL options during testing.
-In Workgroup Manager->User jdoe->Home ensure the information is correct.
*_3) Client must be able to mount the home directory:_*
-Can you manually mount /Users/ on the client, and read / write everything in the jdoe folder ?
In Server Admin, under File Sharing
-/Users/ share point - Automount should be enabled (AFP, Home Folders)
-/Users/ permissions - others should be at least read-only
This is my preference .. but...
-/Users/jdoe permissions should be:
ACL: jdoe - Allow, +Full Control+
POSIX:
jdoe - Allow, +Read & Write+
admin - Allow, +Read & Write+
Others - Allow, None
Select jdoe folder, click on the Cog and Propagate Permissions. Check all permission boxes and click OK.
_On the Client_
I usually start off, by verifying:
-Does the client have a DHCP address from my server?
-Can my client ping the shortname and fullname of my server?
-Can I manually connect to the server and mount a share?
-Did I do an *ipfw /flush* on the client too?
If all that is correct, then I will go into Directory Utility and click the + to add a directory server. I will select type "Open Directory", type in the server name (mymachine.private), and leave SSL unchecked. Click OK. When done it should say:
mymachine.private(Open Directory Server) - This server is responding normally
Once you get this far, try logging out and logging in as a user - ie. jdoe
If it won't let you log in then answer this - did it do its shAkE at you or did it give you an error message?
Kerberos shouldn't be rearing its ugly head at this stage of the game - its more for single sign on .. but if you see any authentication windows with the words "REALM" or "PRINCIPLE" - those words should set off little Kerberos alarm bells in your head. Like I said - at this stage in the game I don't think those have anything to do with it.
_*Few other notes:*_
#1) In Workgroup Manager - you could add the client computer. Enter its full name and short name (you can get them from the sharing option in the client's system preferences). Once the computer is added, you can go into the preferences for the computer, click on Login Preferences and set it to always manage. Put a message in the message box such as "Directory has been consulted" and check the "Show Network Users" box. This way - when you log out .. you will have an indication as to whether the open directory is working at all on the client, or if the problem is more focused with the user account.
#2) I have been getting
+Error of type Not a known DirStatus (-1) on line 2075 of SourceCache/ WorkgroupManager/WorkgroupManager-319/Plugins/UserAccounts/UserAdvancedPluginVi ew.mm+
when creating a user in Workgroup Manager. I just close out of the user and then it allows me back in.
Drop a post if you manage to solve the problem.