User can't connect to iChat (ACL failure)

On a 10.6(.0) server upgraded from 10.5 I've got a user who spontaneously stopped being able to connect to iChat this morning. His account was fine yesterday. User is trying to connect from a 10.5.8 machine and a different 10.6.1 machine, same problem from both, so I'm pretty sure it's server-side.
system.log shows:
Sep 11 07:34:15 server jabberd/c2s[56751]: odauth_check_servicemembership: checking user "luser" access for service "chat"
Sep 11 07:34:15 server jabberd/c2s[56751]: odauth_check_servicemembership: mbruser_name_touuid returns No such file or directory
Googling turned up two archived threads from 10.5 where people reported the same problem and no resolution:
http://discussions.apple.com/thread.jspa?messageID=7335329
http://discussions.apple.com/thread.jspa?threadID=1373399
The user in question was able to connect to Jabber yesterday and is definitely in a group with the chat acl. "No such file or directory" is an odd error to see as well. Anyone have any idea what file or directory it might be trying to pull. Is there any more information that's meaningful or logging that might be relevant?

"Local users" can log in but not users with other short domain names. [email protected] will logg in (can be any FQDN if it has a CNAME in DNS). But [email protected] will have a authentication failure. I have no solution for this yet. Tried to make a * domain name in DNS but it did not seem to work either.

Similar Messages

Suddenly can't connect to ichat or itunes music store

suddenly i can't connect to ichat or itunes music store. when i try to connect on ichat i get this message:
Could not connect to AIM The connection to the host was unexpectedly lost
When I try to connect to the music store I get:
iTunes could not connect to the Music Store. The network connection was reset. Make sure your network connectionis active and try again.
My internet is working. I can view websites and everything. I don't know what's going on or why. It's been going on for a couple days. I'd be grateful for any help!

ah yes, i had the flets program last year i believe. then i switched to OCN.
if you want to try to connect with another chat program besides iChat, we can try that. you can send me an email with an im name to [email protected] i had some problems with flets and had to call them about it, but it didnt really get resolved so i just switched when i moved to a bigger city.
i just iChatted with a mac user in colorado today, and i just checked and i can connect to the itunes store. are you trying to connect to the japanese itunes store, or another one?

Can't connect to ichat via gmail account

Hi!
I can't connect to ichat via gmail account.I created a new account via Preferences window in ichat settings but still can't do it. A pop-up window is shown and it asks to enter a password as ichat cannot log in on my gmail account.I know that i enter a correct password. has anubody such a problem? how can i find out if it is a problem with the password, or my account name.

Hi,
1) The Google Talk option needs to be Enabled in your Google settings.
2) The name (ID) you enter in Messages or iChat needs to be exactly as you see it when you are logged in to the Google Mail web page.
(there is a difference between @gmail.com and @googlemail.com IDs)
3) If you are using the Specific App password method you need to correct password.
4) In the server Settings (App Menu > Preferences > Accounts > Google Account > Server Settings) try setting port 443 if the 5223 one is not working.
10:05 pm Wednesday; March 19, 2014
 iMac 2.5Ghz i5 2011 (Mavericks 10.9)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
 Couple of iPhones and an iPad

WinXP AD users can't connect via SMB

Server is an Intel Xserve, 10.5.8.
Windows users get authentication errors when attempting to connect via SMB on the Mac server. The server is bound to Active Directory, and the Mac users are able to connect via AFP just fine. Macs also cannot connect via SMB. I get the error message "NTSTATUS_WRONGPASSWORD" when the user attempts to log in.
Local users are able to connect via SMB, but I don't want to re-enter a dozen or so PC users on this server if I can avoid it.
In the /var/db/smb.conf file there is an entry for a password server that may not be correct, but if I change it to the password server I've been instructed to use, the file flips back to the original setting when I stop and start the SMB service. I think if I make changes to the /etc/smb.conf file outside the END section, where the comments say to make changes, they will carry over to /var/db/smb.conf, but I'm not sure of the syntax.
If you need me to post the testparm output I can do that.

You're going to have to look into potential underlying issues.
I don't know what's happened for you, but I have an identical type setup for a client done over a year ago and no such problems have occurred.
What does the UNEDITED (please !) result of (using the Terminal) the following show:
cat /Library/Preferences/edu.mit.Kerberos
What happens when a user can't connect (error message, loginwindow shake) ? Are all client machines & the server using a common (eg internal) time-server ?
Be sure to see http://docs.info.apple.com/article.html?artnum=300765
And certainly read through Bombich' excellent PDF (click on the icon of it) at
http://www.bombich.com/mactips/activedir.html - esp. the troubleshooting section
for when a user is unable to login.
Currently, I'm not able to check/verify the settings for any of the servers I've setup for clients in a "magic triangle" setting. I'm not certain about the "passwordserver" entry,
on the one hand the actual passwordserver is actually part of

Lion Server: new user can't connect

This is a local ethernet network, Mac Mini running Lion Server 10.7.4.
I created 2 new users with Server app, same specs as already existing users, but can't connect to the server with the new id's. I just don't undrestand what I'm missing. The old id's all work perfectly when I try to connect.

Check your Services' ACL with Server Admin. It may happen that the new users are included in groups which are allowed for some services, but the new users are not included automatically in this group.

After Upgrade to 7.6.100.0 User Can't Connect To Wireless

We have an internal 5508 controller that has two SSID's on it. A secure SSID which uses an ACS server to authenticate users through AD, and a guest SSID which tunnels out to a DMZ 5508 anchor controller. The guest users have no issues at all. We upgraded our controllers to 7.6.100.0 about 3 weeks ago. Since then, we've had an issue with the data path, for the anchor controller was down, and would only come up after reboot of the internal controller. That was the 1st issue. Over the past few days, I've had users from all over the country tell me that they cannot get connected to our secure network. All users have Win7 machines. All they see is the yell yield sign, on their wireless connection. In the Network and Sharing center, they see the wireless network listed as an unidentified network (public network). In the ACS, the users are authenticating with no problem (I can see it in the ACS logs), and they do receive an IP address. However, they have absolutely no connectivity. I have them try to ping the default gateway, of the subnet that they're assigned, and it comes back with request timed out. Of course they can't get to the internet, or do anything, since they have no connectivity back to their gateway. I've restarted the internal controller (thinking that there must be a hang like with the data path anchor issue) which didn't work, I've blown away the SSID, and recreated it. That didn't work. I even restarted the ACS, although that wasn't an issue. It seems like any users that were connected, prior to the issue, and have no shut down their pc, are ok. Users that have shut down, or have removed the secure wireless network profile, from their computer, can no longer connect. They just get that the network is unidentified. I'm not sure if there was any sort of Win7 update, or some other push, but I want to make sure that from the WLC perspective, there's no issue. Thanks for any help!

Hi Dan,
You pay the price going for latest (does not mean greatest).
Based on my experience, never jump into first release of a software code, unless you require those new features. Wait for a maintenance release to come & then go for it.
Here are few critcal bugs of 7.6.100.0 which does not have a fix yet
CSCum62305 : traffic stops for Mac OS, IOS devices. Other devices working fine
CSCum49200 : Mac wireless clients in RUN state sometimes unable to ping gateway
CSCuj17283 : WiFi clients dropping ARP replies on TID 3 w/ ap3700
I would suggest you to open a TAC case & work with them if you want to stay with this code (specially if you want to get 802.11ac ). Otherwise downgrade to 7.4.121.0 would be the option.
HTH
Rasika
**** Pls rate all useful responses ****

Every user can read any file while ACL mass change in progress

Hi!
We're having some strange things happening here. Maybe someone can help us what exactly is/was going on here.
1. We have to add an additional user in the NTFS ACL list for all file shares in our company (about XXXTB)
2. We're using Windows Explorer to accomplish that.
3. Every user can read in directories he/she has NO ACCESS RIGHTS to while the changes are being applied.
4. Files are also readable but at least still not writeable.
5. Affected folders and files change over time.
Has someone experienced the same issue? Does the Windows Explorer reset the ACL lists before changing them? Is there some weird caching going on?

I unfortunately can't send you a screenshot as this would be a violation of our company rules.
I can however ensure you that we never have any normal user or group besides the very guarded admin group that has read permissions in all folders. I'm also sure that the colleague was only adding the additional account for the indexing service and did that
by adding the permission via the properties tab in Windows Explorer. I restate that this is a very large data dir with about 6 Terrabytes of data the change was made to. The rest of our data was safe.
We guard our rights very closely as any unauthorized access that isn't fixed within minutes will cause a security incident that has to be documented by our department chief. As such was the case here.
As we've got no answer here yet, I can conclude that this is not a very common problem.

Vista users can't connect to 10.5.6 Server

Hello world...
I have a problem connecting users running Vista to Mac OSX Server 10.5.6; I've done a search here but I didn't find anything useful.
When Vista try to connect to the server with a valid username/password it is rejected, but if I try to connect from a XP client it connects without any problem.
Anyone can help me?
Thank you
Stefano

If you don't want extensive details around Microsoft Windows variants and offerings, please stop reading now.
Microsoft Windows XP has (had?) Home, Professional, Media Center Edition, Tablet PC Edition, Professional x64 Edition, and the Windows Vista flavors include (included?) Starter, Home Basic, Home Premium, Business, Ultimate and Enterprise Edition, and the Windows Server 2003 variant has (had?) 32-bit, 64-bit x64, and 64-bit Intel Itanium variants, and has (had?) Web, Standard, Enterprise and Datacenter editions.
Caveats: The Microsoft product offerings list has very likely changed since I researched this particular list of Windows offerings a year or two back. Some packages that I suspect are no longer offered include Windows XP 64-bit for Itanium, and probably some others. There are cases where the names of the various Windows editions have changed, as well. These Windows editions can and often do vary in capability and platform support, and in regional availability. And I haven't been looking at the MS-DOS-descended platforms; only at the NT descendants.
Not all of these Windows variants have the secpol.msc tool. AFAIK, the Windows XP Home and Windows Vista Starter and the Home variants do not. I'm not sure about Windows XP 64-bit for Itanium as I wasn't running that for very long; that was probably the Professional variant, so it would have had the secpol.msc tool.
When presented with the basic "I can't connect to CIFS/SMB/Samba share or a NAS device" problem report, I usually edit the registry key for the user. That tends to works on more of the variants than the secpol.msc tool. But both are valid approaches.
Please check with Microsoft for the current Windows product offerings, features and related details. And for the correct means for adjusting NTLM authentication. In particular, do read the Microsoft knowledge base articles including [KB954387|http://support.microsoft.com/kb/954387], and various others.
Now if y'all will excuse me, it is time to go debug some Cocoa code.

User can not connect to the AdHoc System on UWL

Our Production SAP portal uses LDAP to connect to AD. One of our users is having problems when she tries to get to the Work Overview, it says that the connection to the AdHocSystem failure - Action failed. This is causing her to not be able to create/maintain substitutes in the UWL. Any ideas?
I have connected (temporarily) one of our Sandbox Portals to the Production backend to see if the backend was the problem. The user was created as a UME user, and there was no problems to get to do the Substitutions.
Thanks

Yeah, that info is useless currently. Sorry about that. The App Store is buggy for lots of people right now, so the only option we really have is to get on the computer then to go to the store online.

Iphone user can't connect to Exchange 2013

Hi there,
i have Exchange 2013 on Windows 2012, PKI and certificate installed.
I have 4 users that can (must) connect to the server through iPhone. It works for all, except for ONE (the boss :-X)
I deactivate the mailbox, recreate it without import old mails. It still don't work.
Any idea?
Thanks.

Yes it's the first time on Exchange 2013.
Yes they have different OS.
The server just been installed so it never worked.
BUT I SOLVED MY PROBLEM with this article:
http://technet.microsoft.com/en-us/library/dd439375(v=exchg.80).aspx It concerne Exchange 2003 and 2010 but it worked for my configuration: Windows 2012 and Exchange 2013 and no error HTTP 500.
Actually my user is member of Administrators group and the inheritance is deactivate. I activate it and it's work!
Thanks to me and thanks to you for your answers!

User can't connect to an External Lync conference

When an outside company hosts a Lync conference, we have one user (at a different office) that can't connect to the conference. Other users at our main office can connect without any issues.
The message she gets is "Call was not completed or has ended". "When contacting your support team, reference error ID 19 (source ID 241)."
The other office uses a different Internet connection. This is the only thing I can think of that could be an issue.
Does anyone know what "reference error ID 19 (source ID 241" means?
This user can host a Lync conference and users from the outside company can attend the meetings that she hosts.
I have tons of logs from this user...too many. I'm not sure what I am looking for.
Any help would be appreciated.

I found this info in the logs. Not sure if it is meaningful or not.
09/15/2014|15:45:04.329 222C:1730 INFO :: CUccConfSession::ValidateNotifyMsg - Received the first full conference doc, version set to 21
09/15/2014|15:45:04.329 222C:1730 INFO :: Function: CRTCCccpDecoder::GetSubject
09/15/2014|15:45:04.329 222C:1730 TRACE :: Condition failed with 80070057: 'm_bstrSubject != 0'
09/15/2014|15:45:04.329 222C:1730 INFO :: Function: CRTCCccpDecoder::GetDisclaimerTitle
09/15/2014|15:45:04.329 222C:1730 TRACE :: Condition failed with 80070057: 'm_bstrDisclaimerTitle != 0'
09/15/2014|15:45:04.329 222C:1730 INFO :: Function: CRTCCccpDecoder::GetDisclaimer
09/15/2014|15:45:04.329 222C:1730 TRACE :: Condition failed with 80070057: 'm_bstrDisclaimer != 0'
09/15/2014|15:45:04.329 222C:1730 INFO :: Function: CRTCCccpDecoder::GetNotificationData
09/15/2014|15:45:04.329 222C:1730 TRACE :: Condition failed with 00000001: 'm_spNotificationData != 0'
09/15/2014|15:45:04.329 222C:1730 INFO :: no video presentation mode capable property
09/15/2014|15:45:04.330 222C:1730 INFO :: Fake IM presentation mode capable property
09/15/2014|15:45:04.330 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:applicationsharing:id:CR3TTHNY vs. app:conf:focus:id:CR3TTHNY)
09/15/2014|15:45:04.330 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:applicationsharing:id:CR3TTHNY vs. app:conf:audio-video:id:CR3TTHNY)
09/15/2014|15:45:04.330 222C:1730 ERROR :: SIP_URL::InternalInitialize Didn't find host while parsing SIP URL []
09/15/2014|15:45:04.330 222C:1730 ERROR :: SIP_URL::InternalInitialize Didn't find host while parsing SIP URL []
09/15/2014|15:45:04.330 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:applicationsharing:id:CR3TTHNY vs. app:conf:data-conf:id:CR3TTHNY)
09/15/2014|15:45:04.330 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:applicationsharing:id:CR3TTHNY vs. app:conf:chat:id:CR3TTHNY)
09/15/2014|15:45:04.330 222C:1730 INFO :: no video presentation mode capable property
09/15/2014|15:45:04.330 222C:1730 INFO :: Fake IM presentation mode capable property
09/15/2014|15:45:04.331 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:audio-video:id:CR3TTHNY vs. app:conf:focus:id:CR3TTHNY)
09/15/2014|15:45:04.331 222C:1730 INFO :: Function: CRTCCccpDecoder::GetEntityStateMediaFiltersRules
09/15/2014|15:45:04.331 222C:1730 TRACE :: Condition failed with 80070057: '(enMediaType == UCCCMT_AUDIO) || (enMediaType == UCCCMT_VIDEO) || (enMediaType == UCCCMT_MESSAGE)'
09/15/2014|15:45:04.331 222C:1730 INFO :: video presentation mode capable: true
09/15/2014|15:45:04.331 222C:1730 INFO :: Fake IM presentation mode capable property
09/15/2014|15:45:04.331 222C:1730 INFO :: multi-view-capable: true
09/15/2014|15:45:04.331 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:chat:id:CR3TTHNY vs. app:conf:focus:id:CR3TTHNY)
09/15/2014|15:45:04.332 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:chat:id:CR3TTHNY vs. app:conf:audio-video:id:CR3TTHNY)
09/15/2014|15:45:04.332 222C:1730 ERROR :: SIP_URL::InternalInitialize Didn't find host while parsing SIP URL []
09/15/2014|15:45:04.332 222C:1730 ERROR :: SIP_URL::InternalInitialize Didn't find host while parsing SIP URL []
09/15/2014|15:45:04.332 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:chat:id:CR3TTHNY vs. app:conf:data-conf:id:CR3TTHNY)
09/15/2014|15:45:04.332 222C:1730 INFO :: no video presentation mode capable property
09/15/2014|15:45:04.332 222C:1730 INFO :: Fake IM presentation mode capable property
09/15/2014|15:45:04.332 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:data-conf:id:CR3TTHNY vs. app:conf:focus:id:CR3TTHNY)
09/15/2014|15:45:04.332 222C:1730 TRACE :: SIP_URL::IsBaseListContainedInCompareList - m_ParamValue for SIP_URL_PARAM m_ParamName opaque do not match (app:conf:data-conf:id:CR3TTHNY vs. app:conf:audio-video:id:CR3TTHNY)
09/15/2014|15:45:04.332 222C:1730 ERROR :: SIP_URL::InternalInitialize Didn't find host while parsing SIP URL []
09/15/2014|15:45:04.332 222C:1730 ERROR :: SIP_URL::InternalInitialize Didn't find host while parsing SIP URL []

Can not connect to iChat

Hello. I have had this issue for months now. I can not connect to my iChat account or even AIM account, just a few rare times.
It says "Lost connection with iChat/AIM"
"The connection to the host was unexpectedly lost."
I have had this for a long time now. This annoys me. I have no problems to connect to the internet. So what is it?

With AT&T PPPoE DSL service and a SpeedStream modem/router like the one you have, you probably should put the SpeedStream modem/router in bridge mode and then configure the Netgear router to handle the PPPoE login and password.
You should be able to access the SpeedStream from a Web browser by typing in the IP address on the bottom of the modem and then enter the password located on the bottom as well.
The following instructions are based on another SpeedStream model, but they may be close enough for you:
1) Click the PPP locations button.
2) The modem may ask your for the Modem Access Code again. If so, type it in again and click continue.
3) Select the radio button labeled, "Bridged Mode (PPPoE is not used)"

Users can only connect to RD farm website and cannot remote into terminal server , when connected via VPN

Hello,
I have a RD farm using 3 Win 2012 servers (1 broker and 2 session host), for internal use only, have not
configured gateway for internet access.
Users are able to connect to RD farm website and remote into terminal server, within office
but can only connect to RD farm website and cannot remote into terminal server , when connected via VPN
Its takes long time at securing connection and fails.
Thanks

Hi,
Thank you for your posting in Windows Server Forum.
First of all I would suggest you to configure RD gateway role on your server and pass all the connection through it because it’s a best practice to use RD Gateway in RDS Farm.
Apart from this, if you are not using RD Gateway then you must check that you have successfully forwarded port 3389 for RDS to access via VPN. Also check that you have made configuration under IIS Manager to enable Forms Authentication. Please check
this link.
In addition, please refer beneath article for additional details.
1. How to Access Windows Remote Desktop Over the Internet
2. Remote Desktop Services in Windows 2008 R2 – Part 3 – RD Web Access & RemoteApp
(For reference)
Hope it helps!
Thanks,
Dharmesh

VPN users can't connect to a Site-To-Site branch office

I have an asa 5510 that allows people to VPN into it. they get a private IP address of 10.1.4.x when they connect.
All of my sites (subnets) that are on my MPLS network were always accessible from a vpn connection.
these include the subnets
192.168.0.x (NY)
192.168.2.x (Main Office)
192.168.3.x (Main Office)
192.168.10.x (IN)
192.168.20.x (GA)
etc..
recently we converted our NY office from MPLS to a Cable Connection and added a ASA5505 for a site to site tunnel.
all of the networks in every site are able to connect to the new NY Configuration without issue.
the only issue I have is when someone VPN's into our network from home, they can no longer access the NY site.
if I try to ping anything in the NY office from a VPN connection I get this:
5
Mar 08 2013
16:22:49
192.168.0.4
Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src fiber:10.1.4.32(LOCAL\user) dst fiber:192.168.0.4 (type 8, code 0) denied due to NAT reverse path failure
I'm not sure what I need to do to get this working, so any help would be appreciated.
Thanks,
Lee

Hello Lee,
make sure you add a line in the crypto ACL of the 2 ASAs of the L2L tunnel to allow traffic between the VPN pool and the NY subnet.
make sure you add the NY subnet in the split tunnel ACL if you are using split tunneling for the VPN clients.
and make sure you have the correct NAT rules to allow communication between the 2 subnets.
also, make sure that you have the same-security-traffic command as Jay advised.
Regards,
Othman

Exteral Users can't connect to the EDGE server

HI All for about a week and half now I've been seeing this error a lot on my event logs. All my external users are no longer able to connect to the DMZ EDGE server with 3 external IP's. They can only use LYNC if they access out VPN. Any suggestions on what
may be the issue???
Log Name:      Lync Server
Source:        LS Protocol Stack
Date:          4/24/2014 9:07:14 AM
Event ID:      14428
Task Category: (1001)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      LyncEdge.*********.net
Description:
TLS outgoing connection failures.
Over the past 16 minutes, Lync Server has experienced TLS outgoing connection failures 176 time(s). The error code of the last failure is 0x80090330(SEC_E_DECRYPT_FAILURE) while trying to connect to the server "**********.osis.is.local" at address
[10.111.111.8:5061], and the display name in the peer certificate is "Unavailable".
Cause: Most often a problem with the peer certificate or perhaps the host name (DNS) record used to reach the peer server. Target principal name is incorrect means that the peer certificate does not contain the name that the local server used to connect. Certificate
root not trusted error means that the peer certificate was issued by a remote CA that is not trusted by the local machine.
Resolution:
Check that the address and port matches the FQDN used to connect, and that the peer certificate contains this FQDN somewhere in its subject or SAN fields. If the FQDN refers to a DNS load balanced pool then check that all addresses returned by DNS refer to
a server in the same pool. For untrusted root errors, ensure that the remote CA certificate chain is installed locally. If you have already installed the remote CA certificate chain, then try rebooting the local machine.
Thanks Dave Wolf

Verify root certs exist in the Trusted Root Certification Store.
Also you can refer below links
http://www.shudnow.net/2011/02/01/lync-2010-edge-utilizing-windows-server-2008-r2-federation-tls-issues/
http://theucguru.blogspot.com/2012/03/lync-edge-ls-protocol-stack-14428.html
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical

User can't connect to iChat (ACL failure)

Similar Messages

Maybe you are looking for