Upgrade 10.3 to 10.4: Kerberos authentication stopped working

Question

Hello:
I upgraded a G5 XServe from 10.3.9 to 10.4. It almost worked - ie: system booted again, all disks are visible, etc. But, trying to log on with a user in the OD hosted on that machine has stopped working... this happens when I try to mount a shared AFP volume, and also when logging on from a 10.4.8 client bound in Directory Access to that server. Logging on under the admin account at the console (over ARD in this case), or via ssh, works fine. I didn't think to try other accounts via that method, I will do this tomorrow morning local time and post a followup.
Upon connecting to the server with Server Admin, a message told me that there were new services which needed kerberizing, and to go to Open Directory and click 'settings'. I did this, and also looked at the overview: netinfod was in local-only mode, while all the others were marked as "Running" (lookupd, slapd, Password Server, Kerberos). In the old 10.3.9 system (ie: where user authentication is working OK), all are marked as "Running".
I clicked the "Kerberize" button, and entered a directory admin username and password as instructed. I think the process completed (unfortunately I didn't get a screenshot). Now, the kerberize button is gone.
At various times when admin passwords were requested, I have to try several; the expected ones didn't always work. Eg: I thought the "diradmin" account was needed in one dialog, but I used the system "admin" account instead. (Sorry, didn't record proper details of those events).
Forward and reverse DNS lookups with the host command work ok - they return the expected IP address.
I looked through a bunch of logs (/var/log/*.log, /Library/Logs/.../*.log), and found a few lines with possible clues... these are shown further down.
I have now tried updating to 10.4.8 (I'm not sure if I should have done it before kerberos was going again, but getting the system up to date does seem prudent). Errors are all exactly the same.
Any hints or suggestions much appreciated! Here's some promising things I've found, which I'll be studying today. I hope to take the server down tomorrow morning again to try this stuff out...
http://lists.apple.com/archives/macos-x-server/2006/Feb/msg01152.html
http://lists.apple.com/archives/Client-management/2006/Sep/msg00013.html
Thanks,
Ralph
/var/log/system.log:
Mar 10 15:18:37 tararuas krb5kdc[84]: no sockets set up?
AppleFileServiceAccess.log:
IP 130.195.240.52 - - [10/Mar/2007:15:15:15 1200] "Logout test333" -5023 0 0
IP 130.195.240.52 - - [10/Mar/2007:15:24:30 1200] "Logout ralphwahrlich" -5023 0 0
FWIW, the AFP Reference gives error -5023 meaning thus: "UAM failed (the specified old password doesn’t match); no user is logged in yet for the specified session; authentication failed; password is incorrect."
From slapconfig.log (slightly edited for brevity):
slapconfig.log:
2007-03-10 14:51:52 +1300 - slapconfig -migrateldapserver
2007-03-10 14:51:52 +1300 - 1 Removing LDAP server from search policy
2007-03-10 14:51:52 +1300 - 2 Data export
2007-03-10 14:51:52 +1300 - command: /usr/sbin/oldslapcat -c -l /var/db/openldap/migration/backup.ldif
2007-03-10 14:51:53 +1300 - Removed file at path /var/db/openldap/openldap-data/__db.001.
2007-03-10 14:51:53 +1300 - Removed file at path /var/db/openldap/openldap-slurp/replication.log.lock.
2007-03-10 14:51:53 +1300 - command: /usr/sbin/NeST -pwsrekey
2007-03-10 14:51:55 +1300 - NeST command output:
nothing found to load
2007-03-10 14:51:55 +1300 - 3 Data import
2007-03-10 14:51:55 +1300 - command: /usr/sbin/slapadd -c -l /tmp/backup11774.ldif
2007-03-10 14:51:58 +1300 - 4 Updating LDAP configuration
2007-03-10 14:51:59 +1300 - Starting LDAP server (slapd)
2007-03-10 14:52:22 +1300 - 5 Updating data in LDAP
2007-03-10 14:52:22 +1300 - command: /usr/bin/ldapdelete -c -x -H ldapi://%2Fvar%2Frun%2Fldapi cn=ldapreplicas,cn=config,dc=geo,dc=vuw,dc=ac,dc=nz cn=passwordserver,cn=config,dc=geo,dc=vuw,dc=ac,dc=nz cn=passwordserver_4AB32E0671171DC872A9D40CC42F9E07,cn=config,dc=geo,dc=vuw,dc=a c,dc=nz
2007-03-10 14:52:22 +1300 - ldapdelete command output:
ldap_bind: Can't contact LDAP server (-1)
2007-03-10 14:52:22 +1300 - ldapdelete command failed with status 1
2007-03-10 14:52:22 +1300 - command: /usr/bin/ldapadd -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2007-03-10 15:03:55 +1300 - slapconfig -setmacosxodpolicy
2007-03-10 15:03:55 +1300 - command: /usr/bin/ldapadd -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2007-03-10 15:03:55 +1300 - ldapadd command output:
ldap_modify: No such object (32)
matched DN: cn=config,dc=geo,dc=vuw,dc=ac,dc=nz
2007-03-10 15:03:55 +1300 - ldapadd command failed with status 32
2007-03-10 15:04:13 +1300 - slapconfig -kerberize
2007-03-10 15:04:13 +1300 - Error: Incorrect username or password. You must enter a directory domain administrator username and password.
2007-03-10 15:05:25 +1300 - slapconfig -setmacosxodpolicy
2007-03-10 15:05:25 +1300 - command: /usr/bin/ldapadd -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2007-03-10 15:05:25 +1300 - ldapadd command output:
ldap_modify: No such object (32)
matched DN: cn=config,dc=geo,dc=vuw,dc=ac,dc=nz
2007-03-10 15:05:25 +1300 - ldapadd command failed with status 32
2007-03-10 15:05:38 +1300 - slapconfig -kerberize
2007-03-10 15:05:38 +1300 - Error: Incorrect username or password. You must enter a directory domain administrator username and password.
2007-03-10 15:05:44 +1300 - slapconfig -kerberize
2007-03-10 15:05:45 +1300 - Removed directory at path /var/db/krb5kdc.
2007-03-10 15:05:45 +1300 - command: /sbin/kerberosautoconfig -r GEO.VUW.AC.NZ -m tararuas.geo.vuw.ac.nz -u -v 1
2007-03-10 15:05:45 +1300 - kerberosautoconfig command failed with exception launch path not accessible
2007-03-10 15:05:45 +1300 - command: /usr/sbin/kdcsetup -f /LDAPv3/127.0.0.1 -w -a admin -p ** -v 1 GEO.VUW.AC.NZ
2007-03-10 15:05:47 +1300 - kdcsetup command output:
Contacting the Directory Server
Authenticating to the Directory Server
Creating Kerberos directory
Creating KDC Config File
Creating Admin ACL File
Creating Kerberos Master Key
Creating Kerberos Database
Creating Kerberos Admin user
WARNING: no policy specified for [email protected]; defaulting to no policy
Adding kerberos auth authority to admin user
Creating keytab for the admin tools
Adding KDC & kadmind to launchd
Adding the new KDC into the KerberosClient config record
AddKDCToConfig: KDC is already present in record
Finished
2007-03-10 15:05:47 +1300 - command: /usr/sbin/mkpassdb -kerberize
Mac Mini G4 1.25GHz   Mac OS X (10.4.8)  

Answer 1

Thanks heaps for your reply
Yes, I did indeed use CDs.
I followed the instructions at http://docs.info.apple.com/article.html?artnum=301909-en , but struck problems...
Step 16:
here's what I got after pressing CTRL-D:
ldap_add: Server is unwilling to perform (53)
additional info: no global superior knowledge
I thought I'd press ahead anyway... and struck the next problem:
Step 18:
here's what I got when attempting to add a record in /AccessControls.. a dialog box that said this:
Record type not mapped
The record with type "AccessControls" is not mapped. Your should report this error to the administrator of your directory server.
I found the following:
http://docs.info.apple.com/article.html?path=ServerAdmin/10.4/en/c7od31.html
step 8 on that page, bullet point starting with "To add a mapping for a record type ..." seems what I want, but have no idea which object class name to use.
Not sure where to go next. I'm somewhat inclined to blow away the OD database, and rebuild it from a backup. I would do this...
On the 10.3.9 system:
- export the OD from WGM
Go into 10.4.8, and:
- in Server Admin, change OD to be standalone only
- reboot
- go back to Server Admin, change OD to be a OD master
- import the records exported from the 10.3.9 system
I will post another update tommorrow.