ICal and Kerberos

Question

I'm having some trouble adding an iCal account using Kerberos as the authentication method. It has been working up until today. Kerberos seems to be working correctly (it's granting tickets successfully, anyway), but when I try to add an iCal account, I get the message: "Your password was rejected by the server server.foobar.com for the login x", where x is my username. Open Directory is on and functional.
iCal service log reads:
[phone]:45:55-0500 [-] [caldav-8009] [AMP,client] "Directory service <SudoDirectoryService '/Search': FilePath('/etc/caldavd/sudoers.plist')> has no GUID; generating service GUID from realm name."+
[phone]:45:55-0500 [-] [caldav-8009] [AMP,client] PROPFIND /calendars/_uids_/D2819CDB-C0DA-455B-8A8F-924D1C6AEA4D/ HTTP/1.1+
[phone]:46:50-0500 [-] [caldav-8009] [AMP,client] Unauthenticated users not enabled with the 'calendar' SACL

Answer 1

I have found a reliable and somewhat fast approach to restoring Open Directory master is to export your User profiles, Group profiles and computer profiles from WGM.
Stop Calendar services. Take OD to standalone and then repromote it to master. Import the user, groups and computer profiles with WGM. Check your server's ethernet mac address in computer/inspector to make sure your directory is using the right address.
Reenter the user passwords and re-enable your groups for wiki/blog services on your server. This will return all users and groups with their previous UIDs and GUIDs so that data files will be associated with the right person/group.
Restart your iCalServer. Restart web service.
Other services such as afp, and mail will remain online and offer those services to the users once their passwords are restored.
HTH,
Harry