OS X authenticates as Guest to Samba, but uses Kerberos to Windows

My network: Windows 2003 file server, Windows 2003 Domain Controller, multiple WinXP clients, Ubuntu 7.1 server with Samba 3.0.28a joined to the domain, iMac w/ OS X 10.5.2 joined to the Windows Domain, user accounts are domain accounts.
My problem: My Mac happily logs on to the Windows domain and will also happily access shares on the 2 Windows servers using Kerberos authentication as the logged in user on the Mac. However, accessing the Samba server shares results in OS X authenticating as Guest and the need to use "connect as..." to re-enter the domain username/password to access the share.
My question: There are lots of posts regarding OS X always using Guest to authenticate to XP and Samba machines however none of these seem to be using a Windows domain. Can anyone explain why my Mac is quite capable of using Kerberos authentication as the logged in AD account when connecting to a Windows share but steadfastly refuses to use the same AD account to access the Samba share and instead always uses Guest? I'd be tempted to think that this was a Samba issue bar the fact that Windows clients will happily connect to the Samba share using an AD account; this seems to indicate that the issue is with Leopard.

More data: I have now switched the user profiles on AD so that My Documents is mapped to the Linux Samba server; I also switched the users home directories so that they connect to the Linux Samba server. Logging on to OS X correctly maps the home folder and, more importantly, it authenticates using the AD account.
However, in the Finder list of servers there are now two entries, one for the Samba server with a full DNS name (for the mapped home folder) and one for the same machine via Bonjour. The full DNS name entry is correctly authenticated with the AD account, but accessing the same machine via the Bonjour entry results in a connection using the Guest account. Finder correctly uses the AD account for other Bonjour entries where the target machine is running Windows, it only gets it wrong for the Samba server, despite the fact that it has already connected using the AD account for the home folder mapping.
Any insights much appreciated...

Similar Messages

10.6 Mail users cannot authenticate SMTP using Kerberos

I upgraded to 10.6 Server from 10.5 Server (using "migrate" and Target mode, from a G5 to a Mac Pro). Client Macs have a variety of OS: 10.4, 10.5, 10.6 and 10.7. All those clients can now authenticate AFP connections to the server using Kerberos. But thus far, only clients using 10.4, 10.5 and 10.7 can authenticate SMTP connections using Kerberos. I have 3 clients using 10.6 on Mac Pros, they all can get tickets using kinit no problem, but their Mail cannot send messages unless they switch to MD5. Any ideas?

After poking around I discovered I needed to enter info in the Domain section of the Kerberos utility on the 10.6 Macs, since in my case the Kerberos Realm name is not the same as the Domain name.

Anyone able to authenticate against password protected Samba/SMB shares?

With on 10.5.8, I was able to connect to my Linux server using the Samba protocol. When the Samba shares did not allow guest/anonymous logins, I was able to supply an user/password, and it worked wonderfully.
Currently, on 10.6, I'm able to mount shares with guest/anonymous access but I am not able to mount password protected shares.
In the past, there was a problem in the smb.conf setting of:
encrypt password = yes
And I've tried both "yes" and "no" values to no avail. Has something broke or changed in the way 10.6 talks Samba?
Message was edited by: rthien

Hi all,
I found the answer on my side. But it is rather strange that it worked with 10.5.8 and older. But it does not work with 10.6.
In Linux, in my smb.conf file, I had:
security = SHARE
If I change it to:
security = USER
and add the line:
user = +comma separated list of users+
To effect this new settings, I had to restart the Samba daemons. And then things started to work for me.

Hi ... After I have installed IOS 6 on my Iphone 4, the WiFi connection is trying to authenticate in the Apple site but the page is not found. Do you have any idea on how to bypass this authentication ?? Regards, Gilson

Hi ... After I have installed IOS 6 on my Iphone 4, the WiFi connection is trying to authenticate in the Apple site but the page is not found.
Do you have any idea on how to bypass this authentication ??
Regards,
Gilson

Hi...
After I have wait for 30 minutes without do anything, the wifi interface worked.
I don't know if Apple could fix the issue on their site or the reboot of the Iphone solved the problem.
I'm installing IOS 6 on the Iphone 4 of my wife. Let's see if the behaviour is the same.
I will post the informations after finish the installation.
Gilson

Airport Extreme Problem. Guest network works, but nothing else!!!

An hour or so ago, my network stopped working. My guest one works, but not my main 2.4 or 5 ghz network. I tried the Airport utility but it can't read the configuration file. HELP!!

Please power down the AirPort Extreme and your computer.
Temporarily, connect an ethernet cable from your computer to one of the LAN <-> ports on the AirPort Exptreme.
Power up the AirPort Extreme first, then your computer
Open AirPort Utility, click Manual Setup
Click the word "Status" and a window will open with information about any errors on the AirPort Extreme.
Message was edited by: Bob Timmons

I'm trying to use kerberos V5 with ActiveDirectory but get an error

I'm trying to use kerberos V5 with ActiveDirectory im using simple code from previuos posts but
when i try with correct username/password i get :
Authentication attempt failedjavax.security.auth.login.LoginException: Message stream modified (41)
when i try incorrect username/pass i get :
Pre-authentication information was invalid (24)
Debug info is :
Debug is true storeKey false useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Kerberos username [naiden]: naiden
Kerberos password for naiden:      naiden
          [Krb5LoginModule] user entered username: naiden
Acquire TGT using AS Exchange
          [Krb5LoginModule] authentication failed
Pre-authentication information was invalid (24)
Authentication attempt failedjavax.security.auth.login.LoginException: Java code is :
import javax.naming.*;
import javax.naming.directory.*;
import javax.security.auth.login.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
import java.util.Hashtable;
* Demonstrates how to create an initial context to an LDAP server
* using "GSSAPI" SASL authentication (Kerberos v5).
* Requires J2SE 1.4, or JNDI 1.2 with ldapbp.jar, JAAS, JCE, an RFC 2853
* compliant implementation of J-GSS and a Kerberos v5 implementation.
* Jaas.conf
* racfldap.GssExample {com.sun.security.auth.module.Krb5LoginModule required client=TRUE useTicketCache=true doNotPrompt=true; };
* 'qop' is a comma separated list of tokens, each of which is one of
* auth, auth-int, or auth-conf. If none is supplied, the default is 'auth'.
class KerberosExample {
public static void main(String[] args) {
java.util.Properties p = new java.util.Properties(System.getProperties());
p.setProperty("java.security.krb5.realm", "ISY");
p.setProperty("java.security.krb5.kdc", "192.168.0.101");
p.setProperty("java.security.auth.login.config", "C:\\jaas.conf");
System.setProperties(p);
// 1. Log in (to Kerberos)
LoginContext lc = null;
try {
lc = new LoginContext("ISY",
new TextCallbackHandler());
// Attempt authentication
lc.login();
} catch (LoginException le) {
System.err.println("Authentication attempt failed" + le);
System.exit(-1);
// 2. Perform JNDI work as logged in subject
Subject.doAs(lc.getSubject(), new LDAPAction(args));
// 3. Perform LDAP Action
* The application must supply a PrivilegedAction that is to be run
* inside a Subject.doAs() or Subject.doAsPrivileged().
class LDAPAction implements java.security.PrivilegedAction {
private String[] args;
private static String[] sAttrIDs;
private static String sUserAccount = new String("Administrator");
public LDAPAction(String[] origArgs) {
this.args = (String[])origArgs.clone();
public Object run() {
performLDAPOperation(args);
return null;
private static void performLDAPOperation(String[] args) {
// Set up environment for creating initial context
Hashtable env = new Hashtable(11);
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
// Must use fully qualified hostname
env.put(Context.PROVIDER_URL, "ldap://192.168.0.101:389/DC=isy,DC=local");
// Request the use of the "GSSAPI" SASL mechanism
// Authenticate by using already established Kerberos credentials
env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
env.put("javax.security.sasl.server.authentication", "true");
try {
/* Create initial context */
DirContext ctx = new InitialDirContext(env);
/* Get the attributes requested */
Attributes aAnswer =ctx.getAttributes( "CN="+ sUserAccount + ",CN=Users,DC=isy,DC=local");
NamingEnumeration enumUserInfo = aAnswer.getAll();
while(enumUserInfo.hasMoreElements()) {
System.out.println(enumUserInfo.nextElement().toString());
// Close the context when we're done
ctx.close();
} catch (NamingException e) {
e.printStackTrace();
}JAAS conf file is :
ISY {
     com.sun.security.auth.module.Krb5LoginModule required
debug=true;
};krb5.ini file is :
# Kerberos 5 Configuration File
# All available options are specified in the Kerberos System Administrator's Guide. Very
# few are used here.
# Determines which Kerberos realm a machine should be in, given its domain name. This is
# especially important when obtaining AFS tokens - in afsdcell.ini in the Windows directory
# there should be an entry for your AFS cell name, followed by a list of IP addresses, and,
# after a # symbol, the name of the server corresponding to each IP address.
[libdefaults]
     default_realm = ISY
[domain_realm]
     .isy.local = ISY
     isy.local = ISY
# Specifies all the server information for each realm.
#[realms]
     ISY=
          kdc = 192.168.0.101
          admin_server = 192.168.0.101
          default_domain = ISY
     }

Now it works
i will try to explain how i do this :
step 1 )
fallow this guide http://www.cit.cornell.edu/computer/system/win2000/kerberos/
and configure AD to use kerberos and to heve Kerberos REALM
step 2 ) try windows login to the new realm to be sure that it works ADD trusted realm if needed.
step 3 ) create jaas.conf file for example in c:\
it looks like this :
ISY {
     com.sun.security.auth.module.Krb5LoginModule required
debug=true;
};step 4)
( dont forget to make mappings which are explained in step 1 ) go to Active Directory users make sure from View to check Advanced Features Right click on the user go to mappings in secound tab kerberos mapping add USERNAME@KERBEROSreaLm for example [email protected]
step 5)
copy+paste this code and HIT RUN :)
import java.util.Hashtable;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import com.sun.security.auth.callback.TextCallbackHandler;
public class Main {
    public static void main(String[] args) {
    java.util.Properties p = new java.util.Properties(System.getProperties());
    p.setProperty("java.security.krb5.realm", "ISY.LOCAL");
    p.setProperty("java.security.krb5.kdc", "192.168.0.101");
    p.setProperty("java.security.auth.login.config", "C:\\jaas.conf");
    System.setProperties(p);
    // 1. Log in (to Kerberos)
    LoginContext lc = null;
    try {
            lc = new LoginContext("ISY", new TextCallbackHandler());
    // Attempt authentication
    lc.login();
    } catch (LoginException le) {
    System.err.println("Authentication attempt failed" + le);
    System.exit(-1);
    // 2. Perform JNDI work as logged in subject
    Subject.doAs(lc.getSubject(), new LDAPAction(args));
    // 3. Perform LDAP Action
    * The application must supply a PrivilegedAction that is to be run
    * inside a Subject.doAs() or Subject.doAsPrivileged().
    class LDAPAction implements java.security.PrivilegedAction {
    private String[] args;
    private static String[] sAttrIDs;
    private static String sUserAccount = new String("Administrator");
    public LDAPAction(String[] origArgs) {
    this.args = origArgs.clone();
    public Object run() {
    performLDAPOperation(args);
    return null;
    private static void performLDAPOperation(String[] args) {
    // Set up environment for creating initial context
    Hashtable env = new Hashtable(11);
    env.put(Context.INITIAL_CONTEXT_FACTORY,
    "com.sun.jndi.ldap.LdapCtxFactory");
    // Must use fully qualified hostname
    env.put(Context.PROVIDER_URL, "ldap://192.168.0.101:389");
    // Request the use of the "GSSAPI" SASL mechanism
    // Authenticate by using already established Kerberos credentials
    env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
//    env.put("javax.security.sasl.server.authentication", "true");
    try {
    /* Create initial context */
    DirContext ctx = new InitialDirContext(env);
    /* Get the attributes requested */
    //Create the search controls
    SearchControls searchCtls = new SearchControls();
    //Specify the attributes to return
    String returnedAtts[]={"sn","givenName","mail"};
    searchCtls.setReturningAttributes(returnedAtts);
    //Specify the search scope
    searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
    //specify the LDAP search filter
    String searchFilter = "(&(objectClass=user)(mail=*))";
    //Specify the Base for the search
    String searchBase = "DC=isy,DC=local";
    //initialize counter to total the results
    int totalResults = 0;
    // Search for objects using the filter
    NamingEnumeration answer = ctx.search(searchBase, searchFilter, searchCtls);
    //Loop through the search results
    while (answer.hasMoreElements()) {
            SearchResult sr = (SearchResult)answer.next();
        totalResults++;
        System.out.println(">>>" + sr.getName());
        // Print out some of the attributes, catch the exception if the attributes have no values
        Attributes attrs = sr.getAttributes();
        if (attrs != null) {
            try {
            System.out.println("   surname: " + attrs.get("sn").get());
            System.out.println("   firstname: " + attrs.get("givenName").get());
            System.out.println("   mail: " + attrs.get("mail").get());
            catch (NullPointerException e)    {
            System.err.println("Error listing attributes: " + e);
    System.out.println("RABOTIII");
        System.out.println("Total results: " + totalResults);
    ctx.close();
    } catch (NamingException e) {
    e.printStackTrace();
}It will ask for username and password
type for example : [email protected] for username
and password : TheSecretPassword
where ISY.LOCAL is the name of kerberos realm.
p.s. it is not good idea to use Administrator as login :)
Edited by: JOKe on Sep 14, 2007 2:23 PM

How to use Kerberos & GSS-API to authenticate in Windows OS

Hi,
I need to use Kerberos and GSS-API authentication for user loing in my JSP/Java application against Active Directory in Windows 2003 Server.
I have goen through one thread which is quite similar to my need, but it's used for Linux host, which u can see below.
http://forum.java.sun.com/thread.jspa?threadID=579829&tstart=300
Anyone can guide me that how to authenticate user using Kerberos again Active Directory for Windows Environment ?
Thanking you in Advance.
Satyam AMIN

You can use Java GSS/Kerberos for authentication using any KDC (Solaris/Linux/Windows) provided you have setup the configuration.
Here are the Java GSS tutorials to get started:
http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/tutorials/index.html
Seema

Why is there a guest account who can use safari in my login window???

why is there a guest account who can use safari in my login window when i completely disabled the guest account. I disabled the guest account so others wont be able to use the internet, specifically safari, on my mac, as a form of security/parental control and now anyone who wants to go online csn do so.
how could i completely remove that out of my login window?

Security enthusiasts highly recommend keeping the Guest User Safari account enabled so that if you happen to lose your Mac, or if it’s stolen, it could easily be tracked down.
The first thing most thieves do is turn on the device to see if it works, and/or access your information, or surf the internet. Once it connects to the internet, you now have an opportunity to start collecting data that could eventually lead to the device recovery and thief capture.
This is not a full guest user account, if you select the Guest User option at login, the Mac will restart to a secured Safari-only version of the OS with access to the internet. So what’s the point of this? It turns out this is part of setting up iCloud in Mac OS X, specifically the “Find My Mac” feature. The Safari Guest User allows someone to get online so the Mac can be located, but prevents the Safari user from accessing your files and applications.

HP officejet Pro 8100 will print from an Iphone but not from my windows laptop

HP officejet Pro 8100 will print from an Iphone but not from my windows laptop. I get an error stating "unable to communicate with printer"

Hi Melatina66,
Welcome to the HP Support forums. I understand that when trying to print from your laptop that you get a communication error message.
To better assist you, would you please provide some further information:
1)       How is the printer connected (USB cable, ethernet or wireless)?
2)      When you installed the printer on your laptop did you set it up with a USB cable? If yes, did you switch the connection type on the laptop from USB cable to ethernet/wireless?
3)      What version of Windows operating system are you running on the laptop (Windows XP, Windows Vista, Windows 7, or Windows 8, etc)?
4)      When printing from your iPhone are you using Apple's AirPrint or HP's ePrint app?
Thank you.
Regards,
Happytohelp01
Please click on the Thumbs Up on the right to say “Thanks” for helping!
Please click “Accept as Solution ” on the post that solves your issue to help others find the solution.
I work on behalf of HP

Not able to open mail from my mac, gmail repeatedly asking for password. but using same password able to open gmail on safari

not able to open mail from my mac, gmail repeatedly asking for password. but using same password able to open gmail on safari

okay well they got me to take out some .plist files to see if that would help it didn't. I'm not sure what ones that they deleted for my self maybe someone here would be abel to tell you what ones to take out but didn't work the one that came close to working was this going into keychain and deleting the account(s) then reading them again.
if you are to do this please back up first with Time Machine. You can do this with a usb drive.
Okay so go back to where you had internet accounts and make sure mail is shut. click the - on the account your having problems with then quit system preferences.
Okay so then press cmd and space bar at the same time then type 'keychain access' into the search then click on 'keychain access'
once it is open go to the top of the window and put your email address that you are having problems with.
once you have put in your full email, have a look at what comes up i deleted things in the kind colome with 'internet password' and anything with under name that had smtp.gmail.com or imap.gmail.com so it would look like this, map.gmail.com - internet password.
right click and delete them. make sure not to touch any other files that dont say them things on them.
Once you have done this quit keychain access and then restart the computer, once the computer is restarted go back to system preferences and internet accounts and re-add the account.
Hope this helps. if something is not clear just ask.

I have Video camera movies that are HD format.. I am doing editing work on them using Final Cut Pro, but using DV PAL format for the projects I am editing. When I then tried to copy my work done in FCP Project that's originally DV PAL , into a new FCP Pro

I have Video camera movies that are HD format.. I am doing editing work on them using Final Cut Pro, but using DV PAL format for the projects I am editing. When I then tried to copy my work done in FCP Project that's originally DV PAL , into a new FCP Project that is HD, and tried reconnect media with original HD movies (video), the sequence project got distorted for all the text, shapes used and all.. everything changed its orientation and scale.. Is there a way by which I can preserve my work done on DV PAL and switch it preserving its proportions, scale and orientation, but on a HD project sequence?? Appreciate your help and advice..

Yes. A couple of ways that might work.
First Way
What you need to do is load one of your hd clips in the viewer and edit into a new HD sequence. Does it display correctionly?
OK, select the clip in the hd timeline and copy (command-c). Now go to the HD sequence with the material that's distorted. Select all (command-a) and paste attributes (option-v) and choose basic motion and distort. That should maek things work. What won't work is anything that you've adjusted as far as basic motion or distort in your PAL sequence. That I'm pretty sure you'll have to redo.
Second Way.
Choose your original PAL sequence and do a Media Manage changing the sequence preset to the appropriate HD paramenters with the media offline. You then should be able to reconnect these clips with your original HD media.

Safari problem: when I switch back into safari from another application, the menu bar comes up but no tabs or windows. What's going on? Just started yesterday. I have found a workaround: when I Command Tab back to safari, I hit command T to open a new

Safari problem: when I switch back into safari from another application, the menu bar comes up but no tabs or windows. What's going on? Just started yesterday. I have found a workaround: when I Command Tab back to safari, I hit command T to open a new tab and Command W to close it, and my other tabs are visible.
I have tried shutting down, closing tabs, with no success. What's going on and how can I fix it?
Thanks,
Cindi B
PS: I'm not sure of the actual OS level, but I have not allowed it to upgrade to Maverick yet; concerned about it because of a few things I've read...

A Safari extension or third party plugin may be causing the menu bar issue.
From the Safari menu bar click Safari > Preferences then select the Extensions tab. Turn that OFF, quit and relaunch Safari to test. If that helped, turn one extension on then quit and relaunch Safari to test until you find the incompatible extension then click uninstall.
If it's not an extensions issue, try troubleshooting third party plug-ins.
Back to Safari > Preferences. This time select the Security tab. Deselect: Allow plug-ins. Quit and relaunch Safari to test.
If that made a difference, instructions for troubleshooting plugins here.
As for which OS X is installed.
Click the Apple () menu top left in your screen. From the drop down menu click About This Mac.
The version is noted there.
v10.6 Snow Leopard v10.7 Lion v10.8 Mountain Lion
It's your choice whether or not to upgrade to Mavericks. If you decide to do this, make sure your Mac meets the requirements noted here.

IPod touch 4th generation will not sync with iTunes, but shows up in Windows 7 64bit(Acer Aspire laptop)

Hello all, I am writing this message in the hope that somebody can help me to solve my issue with my iPod touch fourth generation. It has been unable to sync with iTunes, but shows up in windows as the iPod touch. I also had this problem with my older iPods as well (Ipod nano 4th Gen, iPod touch 2nd gen(Batteries done for that one)) I can sync music with iCloud, but I have a bunch of songs that are not in the store, and I sincerely want to add those, alot.
I've checked the "iPod appears in Windows but not in iTunes" with the link here: (http://support.apple.com/kb/TS1363), and followed that process, but to no avail, it does not solve the problem. I've tried to reset the entire ipod by making it enter DFU mode and then rebooting the entire iPod (shows up in iTunes in temporary mode) but once restored, does not appear in iTunes, but still in Windows detected still as a iPod, looks like the iPod and everything. I also have the most uup-to-date iTunes installed (10.5 I believe, just got it today)
This is extremely frustrating because that is why I purchased the iPod (and for the games and apps, those are great too). The iPod was also purchased three days ago, and the setup still didn't detect it. I am not mad at anybody here or the Apple company itself, but I have not found any help online with the browsing option (for support of course).
Please, I would absolutely love the help, i'd be eternally grateful for it.
-Tyler

Never mind, turns out that by uninstalling the programs "Megakey" and "Megaupload" it had resolved this issue.

All that comes up when I open Firefox are my toolbars and a place to enter a URL, but there is no window. I have to enter full screen mode to view websites.

Something happened with Firefox where all that comes up when I open Firefox are my toolbars and a place to enter a URL, but there is no window. I have to enter full screen mode to view websites. How do I get back to a regular browsing window? I have no idea how this even happened.

Hello,
The Reset Firefox feature can fix many issues by restoring Firefox to its factory default state while saving your essential information.
Note: ''This will cause you to lose any Extensions, Open websites, and some Preferences.''
To Reset Firefox do the following:
#Go to Firefox > Help > Troubleshooting Information.
#Click the "Reset Firefox" button.
#Firefox will close and reset. After Firefox is done, it will show a window with the information that is imported. Click Finish.
#Firefox will open with all factory defaults applied.
Further information can be found in the [[Reset Firefox – easily fix most problems]] article.
Did this fix your problems? Please report back to us!
Thank you.

Why yahoo/gmail retrieval and facebook app so so slow when in WIFI. But using the internet to check for emails and facebook is fast using the same WIFI connection??

Why yahoo/gmail retrieval and facebook app so so slow when in WIFI. But using the internet to check for emails and facebook is fast using the same WIFI connection??

Hi SandyS_VZW,
Yes tried resetting the wifi connection and problem still persist.
Here it is...to make it clear. Connected thru the same wifi at home...
-> emails (yahoo/gmail) and facebook WEBSITES are working fine and fast when using/accessing thru a browser (chrome/samsung browser) - no problem with this.
-> emails (yahoo/gmail) and facebook APP is soooooo sloooww (thru the App). Slow I mean comparing it to using their browser/websites... news feeds/emails refreshing so quickly but not when using the APP installed in Samsung Galaxy Note 4. Slow like - It will take around 5-10minutes just to get your emails and news feed refreshed.
THIS HAPPENS ONLY WHEN CONNECTED THRU A WIFI which has a speed of 10-20mb. It is not happening when connected to the network data/plan.
My wife has the same Samsung Galaxy Note 4 (coming from different provider at&t) - same setup (emails, fb app), same wifi connection, but she's not experiencing anything like it.
Not sure why, I dont want to believe that while connected to a WIFI, Verizon is restricting anything and ******* me off to make me switch to my data plan connection everytime - which is Unfair!
Was there a known issue similar about this case?
thanks,

OS X authenticates as Guest to Samba, but uses Kerberos to Windows

Similar Messages

Maybe you are looking for