Can't mount network homes with 10.5 client

Question

I have upgraded 2 iMac G5's to 10.5, both of these are served network home directories from a dual G5 running Server 10.4.10. Both display the expected login window with user names however neither will load the network home. A message "You are unable to login to the user account "username" at this time. Logging in to the account failed because an error occurred." Looking in Console under all messages shows this entry;
authorizationhost[96] ERROR | -[HomeDirMounter mountNetworkHomeWithURL:attributes:dirPath:username:] | PremountHomeDirectoryWithAuthentication( url=afp://'msn166-182.server.edu'/Users, homedir=/Network/Servers/'server.place.net'/Volumes/'Volumename'/Users/'usernam e', name=username ) returned 2
Using Directory access everything looks fine to me and the Open Directory Server entry has a green light and is reported to be responding normally. Does anyone have any ideas what I need to do to get the accounts to login? I should point out I am not a trained sys admin, but I can find my way around enough to get into trouble.
Matt

Answer 1

Hi
Perhaps 10.5 is not renewing the tickets properly? Make sure server and client are time synchronized. You could force the clients to re-create the edu.mit.Kerberos file again. Launch Net Info Manager on the clients affected, authenticate and select Config. Delete the mcx_cache. Launch Directory Access and delete the LDAPv3 configuration there as well as resetting automatic search policies for Authentication and Contacts to Automatic. Navigate to /Library/Preferences and delete the edu.mit.Kerberos file (there may be more than one) as well as removing the same file from /Users/Home/Library/Preferences (if there is one).
Key in the Server’s IP address in the DNS Server’s field on the affected clients. Now create a new configuration in Directory Access using the LDAPv3 plug-in. Use the server’s FQDN (internal DNS services will have to be running for this to work). Don’t bother with an admin name and password just continue until the setting has taken. Make sure the /LDAPv3/FQDN of the server is listed in the Automatic search policies for Authentication and Contacts. In 10.5 it will be the 3rd one listed, the others will be grayed out. Its a good idea to have /Library/Preferences open so you can see edu.mit.Kerberos file being created when you do this.
On the Server launch WGM and force desired users to change their passwords at next log-in. Make sure they use different ones to the ones they were using before the upgrade. ShiftCommandQ will log you out and present you with the log-in window, test again.
Tony