OD-Clientusers need long time to login

Question

Hi there,
I hope, I can get some help here...
Running an OD-Master (10.5.8) with nor replikas, I have the problem, that sometimes the User-Login needs some minutes for successfull login.
What I can do to solve the problem for the moment is to remove and reconnect the clients to the server. But this doesn't solve the problem permanent.
The DNS is running fine and does not make trouble.
In serveradmin in the replik-tree window I recognized, that there are three IPs listet (10.0.11.6 (the correct OD-Master), 10.0.11.5 (just LOM of the server) and 10.0.11.7 (another xserve, which does only serve DHCP, DNS and Softwareupdates).
So I think, here is the reason for my trouble.
What do you think?
$ dscl /LDAPv3/127.0.0.1 read /Config/KerberosClient XMLPlist
offers following:
XMLPlist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>edu.mit.kerberos</key>
<dict>
<key>domain_realm</key>
<dict>
<key>.local</key>
<string>XSERVER.LOCAL</string>
<key>local</key>
<string>XSERVER.LOCAL</string>
</dict>
<key>libdefaults</key>
<dict>
<key>default_realm</key>
<string>XSERVER.LOCAL</string>
</dict>
<key>realms</key>
<dict>
<key>XSERVER.LOCAL</key>
<dict>
<key>KADM_List</key>
<array>
<string>xserver.local</string>
<string>10.0.11.6</string>
<string>10.0.11.7</string>
<string>10.0.11.5</string>
</array>
<key>KDC_List</key>
<array>
<string>xserver.local</string>
<string>10.0.11.6</string>
<string>10.0.11.7</string>
<string>10.0.11.5</string>
</array>
</dict>
</dict>
</dict>
<key>generationID</key>
<integer>1320874315</integer>
</dict>
</plist>
$ dscl /LDAPv3/127.0.0.1 read /Config/passwordserver PasswordServerList
offers the same three IPs in the plist.
Should I edit the plist(s)?
If yes: How can I do this?
What else could I do?
Thank you for your assistance,
Peter.

Answer 1

Peter
You're welcome!
Running the "changeip" command is not necessarily a guarantee of anything - especially when it comes to LDAP Services. When doing the initial Promotion to OD Master you should have noticed this disparity? At that point you should have stopped and double-checked everything again. The "scutil" command in conjunction with a properly configured DNS Service is particularly useful in getting things back on track quickly and efficiently.
It's possible this disparity happened because you used the Server Setup Assistant after the initial Server Install? Unfortunately - if you did - that was your first mistake. Never use the Server Setup Assistant to configure anything other than defining the Server's default administrator account details, its network address and its hostname. As for its hostname you have to decide right at the beginning before doing anything else what this is going to be and you have to try and stick to it. Changing your mind afterwards can potentially break things in a major way.
If there are no existing DNS servers on your private network you will have to configure the DNS Service on the Server itself (as well as getting the Server fully up to date) before doing anything else. If there is an existing DNS Service create the appropriate records there.
I don't think the advice in the support document will actually help? Although you could try it if you wish. You might get more mileage from using the "changeip" command? This might bring things back on track and 're-align' the Kerberos Realm to the Server's true hostname? However depending on how mature and extensive your LDAP Database is it may make things actually worse. Even if it worked it may not necessarily help with other services you may or may not be using that depend on LDAP Services. Services such as iCal etc may end up not working at all or being problematic afterwards.
Ultimately you may be looking at Demotion and Re-promotion? with everything that that means. You have to make sure you prepare the ground properly first. Demotion blows everything to do with your LDAP Database away - users, passwords etc but not home folders.
For your future reference this is not the appropriate forum to post your question. The 10.5 Server Open Directory Forum is here:
http://discussions.apple.com/forum.jspa?forumID=1239
The OSX Server Forum as a whole is here:
http://discussions.apple.com/category.jspa?categoryID=96
Tony