Single Sign-on not working for me :(

Question

Hi Everyone,
I have set-up an OS X Server 10.5.4 Open Directory Master, Kerberos is running my Kerberos Realm: SERVER.MYDOMAIN.COM, DNS is running fine and everything is in-order as far as I can tell.
But the issue that is driving me crazy is that, When a user logs-in on their laptop and they go and click on the Server with AFP shares in Finder they get "Connection Failed" but they can login when they go under Go->Connect to Server->Login window pops-up they put their username and password they access the shares.
For Kerberos single sign-on do I have to do any other configurations that I have not run across in the documentation or discussions.
Here is the settings that are in the edu.mit.Kerberos file:
# WARNING This file is automatically created, if you wish to make changes
# delete the next two lines
# autogenerated from : /LDAPv3/server.mydomain.com
# generation_id : 1164378777
[libdefaults]
default_realm = SERVER.MYDOMAIN.COM
[realms]
SERVER.MYDOMAIN.COM = {
admin_server = server.mydomain.com
kdc = server.mydomain.com
[domain_realm]
.mydomain.com = SERVER.MYDOMAIN.COM
mydomain.com = SERVER.MYDOMAIN.COM
[logging]
admin_server = FILE:/var/log/krb5kdc/kadmin.log
kdc = FILE:/var/log/krb5kdc/kdc.log
If anyone has some ideas, that would be great!
Thanks,
D

Answer 1

To do SSO the client computer must first find the right KDC (Key Distribution Center) to get the ticket from, login, get the ticket and then you (the computer) should be able to use that ticket to login to any kerberized service in the same realm, without having to authenticate again as long as the ticket is valid.
The question is: when do you get that ticket and where are you connecting from?
When connecting from outside of the LAN where the KDC is, you still need to find it, if using kerberos.
I suspect you (should) get the ticket when logging in locally using an OD server account.
Wheter the machine has to be bound to he OD I don't know but it seems logical to expect that if it works similiar as to how an AD works.
I'm not 100% sure about what is cached when using a portable account but as the default time a ticket is valid is 10 hours you'll need to reauthenticate when the time is up.
When logged in, if you open this application and don't quit it: /System/Library/CoreServices/Kerberos.app
it should get you a new ticket when the old one expires.
Also, using this application you should be able to get a ticket (before) trying to mount/use kerberized services (even if not using a OD server account locally or beeing bound to the OD) and not having to authenticate again — "manual SSO"?