Unable to authenticate with diradmin in Workgroup Manager

This has happened before, and I have no idea how it got fixed - too many independent variables...
Anyway, I cannot authenticate the OD with diradmin even while using Workgroup Manager directly on the server.
The setup:
SLS 10.6.8
Split-brained DNS
     Both public and private FQDNs are the same (myserver.mydomain.com). External DNS maps machine record to my static public IP address. Using an AirPort Extreme router, port fowarding services that I want open to the server. The router provides DHCP via NAT to the local network, with a fixed private IP assigned to the server. The server is running DNS with the same zones, machine records, services and aliases that the public IP DNS has, except mapped to the fixed private IP. DNS checks out with changeip, etc.
     The server is an OD master. Yesterday I exported it, demoted it, and restored it. All services (mail, web, etc.) seem to work fine (although I admit to not using Kerberos on AFP due to another issue).
     I have a wildcard certificate that is generated by GoDaddy (*.<mydomain>.com) which seems to work fine with the hosted websites.
This is what the password service error log says when I try to log in with diradmin in Workgroup Manager:
Jan 10 2012 14:01:32    AUTH2: {0x4bbe71ca6b8b45670000000200000002, diradmin} DHX authentication succeeded.
Jan 10 2012 14:01:32    KERBEROS-LOGIN-CHECK: user {0x4bbe71ca6b8b45670000000200000002, diradmin} is in good standing.
Jan 10 2012 14:01:32    KERBEROS-LOGIN-CHECK: user {0x4bbe71ca6b8b45670000000200000002, diradmin} authentication succeeded.
Looks good to me. But I still get the "Information Not Valid for This Server" followed by stuff about invalid login ID or password.
I did notice in the LDAP log:
Jan 10 14:13:12 <myserver> slapd[52283]: SASL [conn=18] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)
And at the last bootup in the directory service error log:
2012-01-10 08:52:03 EST - T[0x00007FFF7027ACC0] - DNSServiceProcessResult returned -65563
The other thing I notice when I log into the library in Workgroup Manager FROM THE SERVER, even if I use the FQDN <myserver>.<mydomain>.com that Workgroup Manager says (in the title bar of the window) <myserver>.local.
I have googled the various errors and messages, and I get folks with all sorts of variations ("change the binding options", etc.) none of which either applied or worked.
Help?

Continuing on my quest... I found this Technical note from Apple about re-kerberizing:
http://support.apple.com/kb/HT3655
Interestingly, in step 3 where it says to remove realm information from kdc.conf, there wasn't any of my realm information. Argh!
So I completed all of the steps and executed the slapconfig command. This resulted in:
bash-3.2# slapconfig -kerberize -f --allow_local_realm diradmin <MYREALM>
diradmin's Password:
Could not resolve hostname <MYDOMAIN>
Skipping Kerberos configuration
Sounds like a dreaded DNS problem. It had been working correctly, but changeip -checkhostname confirmed a problem. Turns out that there were EXTERNAL DNS servers in the Network preferences in System Preferences as well as on the router. With my Split-brained DNS this caused problems (thank you again MrHoffman). So I changed them both to my DNS server INTERNAL IP address and added the external ones to the Forwarder IP Address in DNS. Now checkhostname -changeip returns a favorable result.
So after rebooting ran the slapconfig command again and got the same result. Argh. Cleared DNS caches. Still nothing.
So I tried nslookup.
nslookup <mydomain>
Server:                    10.0.8.2
Address:          10.0.8.2#53
** server can't find <mydomain>: SERVFAIL
Where 10.0.8.2 is the fixed INTERNAL IP address.
However, nslookup on using the fixed IP address yields:
bash-3.2# nslookup 10.0.8.2
Server:                    10.0.8.2
Address:          10.0.8.2#53
2.8.0.10.in-addr.arpa          name = <mydomain>.
Scratching head here... changeip -checkhostname works, nslookup on the IP address works, but nslookup on the host name fails.

Similar Messages

Unable to enable disk quotas in workgroup manager, X.4.8 server

I am trying to enable disk quotas in workgroup manager for our open directory users with mobile accounts.
I select "sharing" ---> all ---> drive that home directories are stored on ---> select "Enable disk quotas on this volume."
I am able to click the tab but when I attempt to save it gives me "unable to save changes." How can I save the changes? Do I have to use the CLI for this?
This is similar to this previous unsolved question on the boards: http://discussions.apple.com/thread.jspa?messageID=2495400
I'm not trying to make any other changes when I'm saving this, and am authenticated as the directory admin. Any help is a big help!

Nevermind, I found the answer in the archives after much searching. Went in via CLI and deleted the files below...voila! Disk quota goodness ensues and all is well.
full thread here:
http://discussions.apple.com/thread.jspa?messageID=2859843
"I answer my own question. I deleted the two files ".quota.ops.user" and ".quota.user" at the root level of each disks and now I can activate disk quota."

Windows Server 2008 R2: Server unable to authenticate with Domain Controller

Hello, I was wondering what could be the reason for this error if it is certain that there was no other computer on the network using the same name:
This computer could not authenticate with<Domain-controller>, a Windows domain controller for domain <Domain-name>, and therefore this computer might deny logon requests. This
inability to authenticate might be caused by another computer on the same network using the same name or the password for this computer account is not recognized.
What would cause the machine account pw to be 'not recognized'?

You can track changes in AD by enabling AD Auditing: https://technet.microsoft.com/en-us/library/cc731764%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396
As reading the logs is usually a complicated and time consuming task, it is recommended to use a third party tool for auditing. The one I usually recommend is Lepide Auditor - Active Directory: http://www.lepide.com/lepideauditor/active-directory.html
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Unable to authenticate with Ticket Toolkit

I'm having trouble with the Ticketing Toolkit.
(in a previous thread I was having trouble obtaining the MYSAPSSO2 cookie ... that is thankfully resolved)
I am now able to see the cookie but for some reason the IsAuthenticated flag isn't set when I run the app by clicking "Preview" from the associated iview. Consiquently Identity.Name isn't set + The Authentication Type is blank as well.
I've played around with the web.config as well as the virtual directory on IIS; changing the Authentication Mode from "Windows" to "None", enabling Windows authentication and disabling anonymous user authentication .... and every permutation you can think of .... nothing seems to work.
One interesting note is that the wpsso_v3.dll doesn't seem to be called ... I tried renaming it just to see if it generated an error and it didn't make any difference.
Also, I had to physically make a reference to the assembly SAP.web.security for the app to build. The artcle on the toolkit didn't indicate that I would need to do that and I would have thought the registration in the web.config would have taken care of that.
My web.config is as follows:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
<sectionGroup name="system.web">
   <section name="MySAPSSO2"
     type="SAP.Web.Security.MySapSso2SectionHandler, SAP.Web.Security, Culture=neutral, PublicKeyToken=50436dca5c7f7d23, Version=1.0.0.0"/>
   </sectionGroup>
</configSections>
<system.web>
    <httpModules>
   <add type="SAP.Web.Security.MySapSso2AuthenticationModule, SAP.Web.Security, Culture=neutral, PublicKeyToken=50436dca5c7f7d23, Version=1.0.0.0" name="MySAPSSO2"/>
</httpModules>
<MySAPSSO2 PseFilePath="C:InetpubwwwrootSSO Ticket TestpseFilesverify.pse" />
    
    <compilation
         defaultLanguage="c#"
         debug="true"
    />
    
    <customErrors
    mode="RemoteOnly"
    />
    
   <authentication mode="Windows" />
     
    <authorization>
      <allow users="*" />      
            
      
    </authorization>
    
    <trace
        enabled="false"
        requestLimit="10"
        pageOutput="false"
        traceMode="SortByTime"
          localOnly="true"
    />
    
    <sessionState
            mode="InProc"
            stateConnectionString="tcpip=127.0.0.1:42424"
            sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes"
            cookieless="false"
            timeout="20"
    />
    
    <globalization
            requestEncoding="utf-8"
            responseEncoding="utf-8"
   />
</system.web>
</configuration>
I am afraid that I am running out of ideas ... anyone have some suggestions?
-Sheldon

Turns out that this was another variation on on Mark Dohrmann's post "Problem's known with NW2004s SP11 and Ticket Toolkit"
Problems known with NW2004s SP11 and Ticket Toolkit?
just had to convert the ticket string and feed it back into the cookie before passing to the toolkit.
ie.
this.Request.Cookies["MYSAPSSO2"].Value = HttpUtility.UrlDecode(this.Request.Cookies["MYSAPSSO2"].Value);

Unable to authenticate as diradmin in WGM

Just installed the security Update 2011-002 for OS 10.6.7 Server. After the reboot I was able to login as diradmin into WGM but all settings were grayed out. I could not authenticate to /LDAPv3/127.0.0.1 any longer, using the lock in the top right corner.
/var/log/slapd.log showed a massive amount of errors like these after the update:
Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)
/Library/Logs/PasswordService/ApplePasswordServer.Error.log showed the following:
Registration is finished error: (10, -72000).
Not sure if this is related to the update, but turning off and on SSL as suggested by user "xjrguy" in this past discussion worked for me:
https://discussions.apple.com/message/10553322?messageID=10553322
Mind however, that this procedure has to be carried out after every update. Does anyone have a permanent "cure" for this issue?

Just installed the security Update 2011-002 for OS 10.6.7 Server. After the reboot I was able to login as diradmin into WGM but all settings were grayed out. I could not authenticate to /LDAPv3/127.0.0.1 any longer, using the lock in the top right corner.
/var/log/slapd.log showed a massive amount of errors like these after the update:
Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)
/Library/Logs/PasswordService/ApplePasswordServer.Error.log showed the following:
Registration is finished error: (10, -72000).
Not sure if this is related to the update, but turning off and on SSL as suggested by user "xjrguy" in this past discussion worked for me:
https://discussions.apple.com/message/10553322?messageID=10553322
Mind however, that this procedure has to be carried out after every update. Does anyone have a permanent "cure" for this issue?

Open Directory - Unable to login Workgroup Manager

I am unable to login to Workgroup Manager with my diradmin account.
I know the password is correct.
This is on Mac OS X Lion 10.7.2
Everything was working fine last night, but then it stopped functioning. I am able to see all the users, but they are greyed out. When I try to login, I get "The login information is not valid for this server"
The LDAP log shows a bunch of the same errors that it did not show before.
slapd[76]: SASL Failure: GSSAPI Error: Miscellaneous failure.
Please advise. Thank you.
Samson

Try logging in to Workgroup Manager using the local admin account not the diradmin account. If this works, then try accessing the /LDAPv3/127.0.0.1 choice using the diradmin account.

Workgroup Manager Won't Authenticate Anymore

I'm using 10.5.2 on both a client and a server and I'm seeing some weirdness with Workgroup Manager. Last week, I had no problem using workgroup manager on my machine to connect to the server. Today, WM is not allowing me (or any other admin accounts) to authenticate at all remotely. If I screen share to the desktop of the server and run workgroup manager, I can use my credentials to authenticate.
What I'm seeing in the system.log is "Client response doesn't match what we generated" I found the relevant article here: http://docs.info.apple.com/article.html?artnum=306596
Following up from that article, I did some digging in the Password Service logs. When I try to login remotely to Workgroup Manager, the logs show this:
Feb 19 2008 09:49:47 AUTH2: {0x4787f45616bdec6b0000000600000006, mbydalek} DIGEST-MD5 authentication failed, SASL error -13 (password incorrect).
This line gets repeated 4 times.
When I'm on the server locally and authenticate, it uses CRAM-MD5 and authenticates successfully.
I did find the following article talking about testing authentication, etc. http://docs.info.apple.com/article.html?artnum=302942 All the methods described in there work test successfully.
Something really strange is going on here because my user can authenticate to AFP, SSH, etc. just fine - just not Workgroup Manager remotely.
I'm going to further chalk it up to weirdness because what I'm trying to do this morning is add a new user (normally a 2 min job). Adding the user from the manager on the server is fine, but it throws an error when trying to create the home directory.
Lastly, I thought it could be my machine, but I've kinit'd, afp'd, etc. from my machine without a problem.
Anyone have any other ideas that I can try?

Thanks for the pointer to createhomedir - that did indeed do the trick. (How on earth do people find these little nuggets).
I hesitate to mark this as solved however - it's a functioning workaround, but does nothing to explain why on earth the GUI suddenly stopped functioning.
But in the (likely) event that that question never gets answered, thanks again for letting me get on with working!

Cannot login with a account created with workgroup manager on local box

Hi my name is richard and i recentgly acqquired from one of ,y friends a macbook pro with leopard 10.5.7 and I downloaded the server tools to it because workgroup manager gives me more control over user creation and the like.there are three issues that i am facing right now:
1) I create an account for a user "VERONICA MARS" short name vmars with a password of apple. when I try to login using that account the login window just sits there and shakes its head at me like no no no wrong cridentials.
2) using the same account vmars i try to reset her password using wgm and it says that it cannot reset the password.
3) when i try to create the account it tells me that the home directory cannot be created.
oh and heres a bonus one:
most of the time in wgm it takes forever to get from one tab to the next and ill have to do a force quit to restore my mkac back to normal.
if anyone can help with these issues please respond
thanks in advanced
richard johnson
mac fan for life

Please let us know the username of the account that is giving you trouble.

Problem with home directories NOT in Users and Workgroup manager

I am setting up a Leopard server (10.5.3) with the users directories in /h1. This is mounted as /Volumes/h1.
It is exported under AFP as /h1.
When I try to get Workgroup manager to create a home directory, I can enter the home directory as:
afp://quattro.innocon.com/h1
path is 'user'
Full path is:
/Network/Servers/quattro.innocon.com/Volumes/h1
However, when I try to log in as this this user, it says that the directory /Network/Servers/quattro.innocon.com/h1/username does not exist.
I cannot seem to figure out why the 'Volumes' part of the full path is being lost.
Any ideas on how to get this right?

have you checked to see if /Network/Servers/quattro.innocon.com exists?
I'm having ALOT of issues with automount not picking up on the mount-maps set by Open Directory.. If anyone has any solutions on this it would be great.

Java applet crashing with Workgroup Managed machines

Hi,
One of my clients uses a Java-based online proofing system for their publications which consistently crashes. We have narrowed the problem to machines that are or have been under Workgroup Management (the problem persists even after machines are unbound). We have eliminated other culprits such as Netinstall, Radmind, browser and Java versions and so on. The applet consistently gives the following output in console log (where the reference to the display profile is specific to that machine):
2008-11-10 13:54:03.239 Safari[672] * _NSAutoreleaseNoPool(): Object 0x55a68c0 of class NSView autoreleased with no pool in place - just leaking
2008-11-10 13:54:03.239 Safari[672] * _NSAutoreleaseNoPool(): Object 0x67d13f0 of class NSConcreteValue autoreleased with no pool in place - just leaking
2008-11-10 13:54:03.240 Safari[672] * _NSAutoreleaseNoPool(): Object 0x40c140 of class NSCFNumber autoreleased with no pool in place - just leaking
2008-11-10 13:54:03.240 Safari[672] * _NSAutoreleaseNoPool(): Object 0x4ee7e0 of class NSConcreteValue autoreleased with no pool in place - just leaking
2008-11-10 13:54:03.240 Safari[672] * _NSAutoreleaseNoPool(): Object 0x6727190 of class NSCFDictionary autoreleased with no pool in place - just leaking
2008-11-10 13:54:03.243 Safari[672] Path /Library/ColorSync/Profiles/GENDISP7.icm
And when the applet finally crashes we get this:
2008-11-10 13:44:43.004 Safari[672] * Assertion failure in -[NSViewHierarchyLock unlockTopMostReader], AppKit.subproj/NSViewHierarchyLock.m:444
The most conclusive test I performed was taking a machine that had never been bound to the server. The applet worked fine with no console log output. As soon as I bound it to the server, the above started happening. I have also found the problem in Tiger and Leopard networks. I have tried obvious stuff like re-creating the display profile.
Has anyone else seen anything like this? Or can anyone suggest where to look?
Thanks,

Java Preferences should be in Applications > Utilities.
Check the boxes to enable.
I'll refer you back to the earlier posts of that thread for restting the browser plug-ins.

Php mysql integration with workgroup manager

Hello,
I run a non-profit arts organization. We have active and inactive members that are tracked with a php mysql web app that I wrote. I was wondering how I could query the workgroup manager from php to make the inactive members not be able to login to our computers. Also, it would be great if we could just add new members into the php web app and then send that new member's info to the workgroup manager.
Is this possible?
Thanks
Alex

Yes, I have an OS X 10.4.3 server - which is also integrated in the AD. If i log on locally on the server with an account from the AD, then the workgroup manager works perfectly.
Guess my main problem is that i don't know where in the process things goes wrong.
- Is it on the client, that it is not able to sent the right requests
- Is it on the OS X Server, where something is misconfigured
- Is it security settings in the AD that prevents the server and client from getting the right information
I have the possibility on both the server and client to do ldap requests through the address book - this tells me that i do have some sort of connection. And that is also verified by actually being able to login with AD accounts.
Is there any logs i should pay special attention to? All the logs i can see through server admin doesn't contain usefull information. The logs on the client located in /var/log only tells me about some minor issues with mcxd (something about the uid being 1325883267 - which confuses me a bit - i thought uid's on unix was between 1 and 65535 :/ )
/Martin

Can't re-enable accounts with workgroup manager

Morning,
We have had cause to disable approximately 100 student accounts earlier this week, and we are now finding that we can not re-enable them. This is a major problem as it's coming to the end of term and they all need to be able to login!
The server is running 10.4.6 and the accounts were disabled using Workgroup Manager by selecting the account, unticking the 'access account' box and then saving.
I am trying to re-enable the accounts by simply reversing the process, i.e. ticking 'access account' and then clicking save, however every time I try this the following error pops up:
"Got unexpected error
Error of type eMemoryAllocError (-14901) on line 3318 of /SourceCache/ServerManagerUserGeneral/ServerManagerUserGeneral-193.2.5/UserAdva ncedPluginView.mm"
I have tried this with various of the disabled users on various different machines (including the server itself) and the same error comes up universally. I've had a poke about on Google but I can't find any reference to this happening anywhere else.
My inital thought was that the admin tools were out of date but looking we have version 10.4.4 of Workgroup Manager which is what is available on the apple site; is this the latest version?
I thought the point releases for admin tools ran in parallel with the server versions, i.e. the latest server admin tools would be of version 10.4.6?
Any help/ideas appreciated...!
Ian Atkinson

Additionally, I have come up with a fudge:
I have turned on the advanced view in Workgroup Manager so that I can see the LDAP inspector for each user. If I delete the two attributes 'AuthenticationAuthority ;DisabledUser;' and 'dsAttrTypeNative:authAuthor ;DisabledUser;' and then save, I can then go on to tick 'access account' and save with no problem (which does in fact re-enable the account).
I don't know if this sheds any light on the subject, but it's working for now at least...
Ian.

Verify permissions failed: Framework unable to communicate with the Disk Management daemon

I'm experiencing problems with the Disk Management daemon on my MBPro Retina running Mountain Lion 10.8.2. I discovered it first when I tried to enable file vault and received the "Framework unable to communicate with the Disk Management daemon" error message.
So I started up Disk Utilities (which started fine) and tried to run Verify Disk Permissions. It failed with the following errror message:
"Verify permissions failed: Framework unable to communicate with the Disk Management daemon"
So I booted in to safe mode and tried Verify Disk Permissions again with the same results.
So I booted in to the recovery partition to run Disk Utilities. It ran fine and the Verify Disk Permissions found some errors which I then fixed.
I re-booted normally but am still experiencing the same behavior.
I have turned off my anti-virus (Sophos) to no effect.
I checked the console and found the following message:
12/6/12 3:27:02.828 PM Disk Utility[157]: *** WARNING: Method userSpaceScaleFactor in class NSWindow is deprecated on 10.7 and later. It should not be used in new applications. Use convertRectToBacking: instead.
Thoughts or suggestions? Thanks!

Please read this whole message before doing anything.
This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.
The purpose of the test is to determine whether your problem is caused by third-party system modifications that load automatically at startup or login.
Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards. Boot in safe mode* and log in to the account with the problem. The instructions provided by Apple are as follows:
Shut down your computer, wait 30 seconds, and then hold down the shift key while pressing the power button.
When you see the gray Apple logo, release the shift key.
If you are prompted to log in, type your password, and then hold down the shift key again as you click Log in.
*Note: If FileVault is enabled under OS X 10.7 or later, or if a firmware password is set, or if the boot volume is a software RAID, you can’t boot in safe mode. Safe mode is much slower to boot and run than normal, and some things won’t work at all, including wireless networking on certain Macs.
The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin. Test while in safe mode. Same problem? After testing, reboot as usual (i.e., not in safe mode) and verify that you still have the problem. Post the results of the test.

Is it possible to set the default font in Pages with Workgroup Manager?

School district. We use iWorks '09 (currently) and several teachers would like the default font for all students to be a specific font (Comic Sans because of the shape of the letter 'a' and the number '4').
I know about creating the template and using the template, but that must be done for all student accounts, and must be done again for any incoming new students.
I would prefer there to be a way of setting this in WorkGroup Manager? I don't see that it is possible though. Or am I missing something?

You might also consider using color groups with Illustrator. Let me know what you think. It may help you out with projects that use the same color preferences.
Check out the tutorial here:
http://www.adobe.com/designcenter/illustrator/articles/lrvid4019_ai.html
Let me know if this helps you.
Vicente Tulliano

LDAPv3 not working with Workgroup Manager

Hello,
I recently started at a new job, and it appears the previous guy did not know how to set things up properly so I have been fixing all of his mistakes. But this one has me pulling out my hair.
Anytime I try to set the Workgroup local directory to LDAPv3 I get this message in the console
10/09/08 9:00:40 AM Workgroup Manager[219] Got unexpected error of type ePlugInNotActive (-14278) on line 3873 of /SourceCache/WorkgroupManager/WorkgroupManager-319/PMMUGMainView.mm
10/09/08 9:00:40 AM [0x0-0x23023].com.apple.WorkgroupManager[219] dsOpenDirNode failed with error of type -14278
I know there is a problem but just can't find it, and I can't find any information on resolving the ePlugInNotActive -14278 error
Can anyone help or steer me in the right direction.
Thank you,
Any other info you need just ask
Message was edited by: SoMuchSoul

No There isn't a page that would show that it was turned off other than the services list. But my point in all that was this is their device, and the guy knew that it used a dial up connection. So, knowing how your hardware works, you would assume that they would check to make sure it is running. Considering that most "Optimization" programs turn this off because no one uses a dial up connection anymore. I would think this just falls under the trouble shooting diagnosis train of thought. And I'm not saying that they guy didn't try, nor that he wasn't nice on the phone. I was just frustrated that something so simple seems to have a lot of people saying that verizon isn't thinking any more. LIKE MY INCREDIBLE THAT STILL ISN'T HERE. But don't get me started on that rant. I mean how can you finally advertise that you have a phone that is better than apple, and not know there is going to be a rush on the bank so to speak?

Unable to authenticate with diradmin in Workgroup Manager

Similar Messages

Maybe you are looking for