Slow logins with Kerberos?

Question

I've noticed that logins have been quite slow: specifically, there seems to be a delay of several minutes between typing in the user name and password in the login window before the login is successful and the desktop begins to initialise. This appears to be the case even if I wait several minutes after the login dialog is displayed, allowing launchd to start up further daemons in the background. I'm using Kerberised logins on Leopard Server 10.5.8, and I should add that this delay seems a recent change in behaviour, although I can't tie it to any specific patch. What catches my eye from the logs is the following entries from secure.log:
Dec 1 18:29:15 <hostname> loginwindow[80]: Login Window Started Security Agent
Dec 1 18:29:16 <hostname> SecurityAgent[172]: Showing Login Window
Dec 1 18:29:49 <hostname> SecurityAgent[172]: User info context values set for <user>
Dec 1 18:32:49 <hostname> /System/Library/CoreServices/CCacheServer.app/Contents/MacOS/CCacheServer[299]: Starting up.
Dec 1 18:32:50 <hostname> SecurityAgent[172]: Login Window done
Dec 1 18:32:50 <hostname> com.apple.SecurityServer[36]: Succeeded authorizing right system.login.console by client /System/Library/CoreServices/loginwindow.app for authorization created by /System/Library/CoreServices/loginwindow.app.
Dec 1 18:32:50 <hostname> loginwindow[80]: Login Window - Returned from Security Agent
As best as I can read this, there's a three minute delay in login because the credential caching service isn't standing by to manage the tickets generated by the Kerberised login and isn't made available promptly. I don't know if this is itself the crux of the problem or indicative that some other operation is having problems and takes this long to look up the credential cache service's Mach port and get launchd to start it up or to acquire credentials to populate into the cache. I should add that all name services and the Kerberos instance from which credentials are acquired are local to the server, which may or may not be part of the problem.
Bottom line is that taking three minutes to process a login request makes for a very frustrating experience (let's not mention the subsequent delays in getting all the programs launched by the dock to page in and complete their start-up and how difficult it is to get anything in the desktop session to respond while the system chugs along).
Message was edited by: buffyg

Answer 1

Hi
No. It probably means you've posted in the wrong forum. Your question really relates to an OD Master environment and OSX Server. In which case the forum you really want is here:
http://discussions.apple.com/category.jspa?categoryID=236
Slow login's could be down to a number of things. If the problem is affecting all clients then I would look at the 'health' of your DNS/DHCP Services first. Can clients resolve the server correctly on both pointers? Can the Server resolve itself the same way? Is Kerberos still running on the Server? Kerberos as you know is time-dependent, in which case are the Client's clocks in sync with the Server's? Is there enough space on the drive hosting home profiles? If the drive is not the Boot OS is there enough space on the boot OS? Have you tried flushing Client Workstation's caches yet?
As you can see only more questions rather than answers I'm afraid. We could continue on this forum if you wish but I feel it would probably be best if you posted in the other forum. More chance of it being seen by guys who do this sort of thing every day.
Tony