Kerberos local DC problem when using screen sharing

Question

Hi,
this is a brand new Mac Mini server with preinstalled ML and Server.app 2.2.1.
I started the following services: DNS (automatic), OpenDirectory, Sharing, Web and Mail. One additional user and that was it.
After this configuration session, Kerberos seems to be in a non-operable state. See the information below. I can log in locally, can access a share (similar LKDC related error message as below), mail and screen share. But screen share takes ages to start and gives some nasty error messages.
I have almost no knowledge of Kerberos and could use any help to fix-up the Kerberos configuration, preferably without reinstalling.
If there is anything else you need to see about the server configuration, please ask.
Turnin OD off and on again did not change anything. Keeping it off removes the error (obviously) but I think this will not be good for server operations.
Regards, Andreas
Problem statement: accessing the server from a ML client gives the following KDC error sequence before the authentication succeeds. This can take 20-30 seconds.
26.02.13 15:31:21,001 kdc[2321]: Got a canonicalize request for a LKDC realm from 192.168.178.32:59299
26.02.13 15:31:21,001 kdc[2321]: Asked for LKDC, but there is none
26.02.13 15:31:21,001 kdc[2321]: Got a canonicalize request for a LKDC realm from fe80::426c:8fff:fe37:6b28%en0:59300
26.02.13 15:31:21,001 kdc[2321]: Asked for LKDC, but there is none
26.02.13 15:31:21,021 kdc[2321]: Got a canonicalize request for a LKDC realm from 192.168.178.32:59301
26.02.13 15:31:21,021 kdc[2321]: Asked for LKDC, but there is none
26.02.13 15:31:21,021 kdc[2321]: Got a canonicalize request for a LKDC realm from fe80::426c:8fff:fe37:6b28%en0:59302
26.02.13 15:31:21,021 kdc[2321]: Asked for LKDC, but there is none
26.02.13 15:31:32,079 kdc[2321]: Got a canonicalize request for a LKDC realm from 192.168.178.32:59306
26.02.13 15:31:32,079 kdc[2321]: Asked for LKDC, but there is none
26.02.13 15:31:32,080 kdc[2321]: Got a canonicalize request for a LKDC realm from fe80::426c:8fff:fe37:6b28%en0:59307
26.02.13 15:31:32,080 kdc[2321]: Asked for LKDC, but there is none
26.02.13 15:31:32,214 screensharingd[83904]: Authentication: SUCCEEDED :: User Name: Administrator :: Viewer Address: 192.168.178.32 :: Type: DH
Apparently there is something seriously wrong with the Kerberos local data cache:
sudo ./checkLocalKDC
krbtgt/LKDC:SHA1.F0454A755D0C818D04161E8547E9D485D004F224@LKDC:SHA1.F0454A755D0C 818D04161E8547E9D485D004F224 doesn't exist, are you sure LKDC:SHA1.F0454A755D0C818D04161E8547E9D485D004F224 is a realm in your databaseThe kadmin check failed.
configureLocalKDC did not fix this. There are Kerberos config files but I cannot determine if they were created before or after starting any of the services.
sudo ls -l krb5kdc/
total 48
-rw-------  1 root  wheel    61 21 Feb 19:33 acl_file.MARVIN.DOMAIN.DE
-rw-r--r--@ 1 root  wheel   330 26 Feb 20:17 kdc.conf
-rw-------  1 root  wheel  4555 20 Feb 19:24 log
-rw-------  1 root  wheel   111 20 Feb 19:24 m-key
-rw-------  1 root  wheel    78 21 Feb 19:33 m_key.MARVIN.DOMAIN.DE
sudo ktutil list (limited to vnc)
1  aes256-cts-hmac-sha1-96  vnc/LKDC:SHA1.F0454A755D0C818D04161E8547E9D485D004F224@LKDC:SHA1.F0454A755D0C81 8D04161E8547E9D485D004F224       
  1  aes128-cts-hmac-sha1-96  vnc/LKDC:SHA1.F0454A755D0C818D04161E8547E9D485D004F224@LKDC:SHA1.F0454A755D0C81 8D04161E8547E9D485D004F224       
  1  des3-cbc-sha1            vnc/LKDC:SHA1.F0454A755D0C818D04161E8547E9D485D004F224@LKDC:SHA1.F0454A755D0C81 8D04161E8547E9D485D004F224       
  1  aes256-cts-hmac-sha1-96  vnc/[email protected]                                                                         
  1  aes128-cts-hmac-sha1-96  vnc/[email protected]                                                                         
  1  des3-cbc-sha1            vnc/[email protected]
The Kerberos part of the server open directory settings:
dirserv:kerberizedRealmList:availableRealms:_array_index:0:dirNodePath = "/LDAPv3/127.0.0.1"
dirserv:kerberizedRealmList:availableRealms:_array_index:0:realmName = "MARVIN.DOMAIN.DE"
dirserv:kerberizedRealmList:defaultRealm = "MARVIN.DOMAIN.DE"
So far all fits AFAIK and the domain is also correct.

Answer 1

After a night of experimentation, I found a workaround but do not know if this simply avoids Kerberos authentication or what is going on.
It can be a domain problem except for the checkLocalKDC error that needs to be fixed anyway.
Above I used the server occurrence in a Finder window, which I presume takes as a name marvin.local.
Then I used a Go to Server vnc://marvin which worked without a Kerberos error. Also marvin.fritz.box (router) works fine.
marvin.local looks up the machine via Bonjour, right? Can this be the reason for the difference in authentication?
My domain setup is likely illegal at the moment:
local DSL router does the DNS/DHCP for local devices
server marvin has its own dns for marvin.domain.de (reason below) alone and otherwise uses the router dns
domain.de is a registered domain (mine) with fixed ip and server behind
Reason: the domain.de server will be replaced by a DynDNS provider forwarding any request to my dsl router, which acts a firewall and port forwarder.
So my reasoning was that the new server marvin should be in domain.de as from the point of view of the internet, it is the machine at domain.de. Except that during setup and tests, it is not.
The client accessing marvin however has no idea about marvin.domain.de! It uses the router as the dns.
If anyone has done a similar setup (server behind router-ISP-DynDNS), I would appreciate examples how you setup the dns such that the server acts properly from the outside world of view.
And yes, there is a MX at domain.de and SMTP requests will be forwared to marvin also.