Can't Login to New OD Master - Even when bound to OD

Question

This is a completely new server installation on a multi-core MacPro of Leopard Server 10.5. I have followed best practice standards by configuring DNS first and double checking with changeip command. I than went from Standalone to OD Master and all the setting checked out. I configured DHCP for our small network. That worked fine. I than configured a home directory share with automount, created one new account and created home directory. I verified login to the server and creation of the home directory. Server updates are also done now.
Now the confusing part. I took a Mac OS X Leopard client machine, fully updated and used Directory Utility to bind client to server. Directory Utility reports bind is operational and working. I can use the Directory app to see myself as a user. HOWEVER - I can NOT login to the OD Master as the user I setup. The login screen just shakes me off as if the password is wrong. It is not.
I looked at the OD logs and I am being successfully autheticated by server. The client just refuses to login. I have tried 10.4 and 10.5 clients.
What have a messed up? <grin>

Answer 1

Hi
I'm guessing when you supply the user name and password there is a slight delay before you get the shake? is that correct? Or do you provide the user's credentials and you get the shake immediately with a message telling you the AFP or SMB Server can't be found?
To start with verify if the created user is a principal of the Kerberos Realm. On the server issue:
sudo kadmin.local -q list_principals
amongst other things you should see an entry for that user. Something like [email protected]
What you can do is to unbind. Remove the DirectoryServices folder and the edu.mit.Kerberos file from /Library/Preferences, restart the client and then place the Server's IP address in the client's DNS Server's field as well as the Domain name in the Search Domains field. Use Terminal and the host command to resolve the server's fqdn and then its IP address from the client. This will qualify the server's DNS service on the forward and reverse pointers. Use Directory Utility to bind to the Server using its IP address alone and don't bother with authenticated binding. Double-check the edu.mit.Kerberos file has been created in /Library/Preferences (this is evidence that you have received a TGT - you can refer to the server logs as well that should show this happening), log out of the local admin account and select Other. Go for the log in again and hopefully you should be now logged in with a network user's account and home folder.
Hope this helps, Tony