Mac Open Directory users not able to log on any more!

[jbutlin]

For some reason, our mac network pupil users `year3, year4 etc) can no longer log on to any of the macs – it starts to log them on and then they get this error:

 

You are unable to log in to the user account “_____” at this time

Logging in to the account failed because an error occurred.

 

I wondered if it was a permissions issue on the home folders, so I’ve tried to add and change permissions, but I suspect I’m just making it worse; either way I haven’t made it better!

I've also tried (after making copies of the home folders) deleting the home folders and recreating them using the Workgroup Manager `Create Home Now' button, but then I get another error on the server `Unable to create home directory error'

 

The server is running El Capitan after a fairly recent upgrade, and server version 5.1

 

Anyone else had this trouble?

 

 

thanks a lot

[NewFormz]

Is it only network accounts that can't login? If so check that the time is synced with the server.

 

We had an issue a while back when we made some changes to our server and the macbooks were trying to connect to the time server that no longer existed. Once we synced the time with the new server everything worked fin

[aarongulley]

Hello,

 

Sorry to hear you're having trouble.

 

Are you able to open Server.app on the Mac Mini Server or Mac Pro Server and go to Logs > System Log and simulate a login with a MacBook and paste it over here for me to have a look at?

 

If that fails we will then use console on the MacBook you'll need to login via a local account i.e Administrator should be stored locally.

 

Thank you

 

Aaron.

[jbutlin]

Thanks both for replying - I've checked the time so I am fairly sure it is not that...

This is copied from the system log:

May 3 11:57:57 server kdc[7671]: DSUpdateLoginStatus: Unable to synchronize login time for year4: 77009

May 3 11:57:57 server kdc[7671]: Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, arcfour-hmac-md5, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96

May 3 11:57:57 server kdc[7671]: Requested flags: renewable, forwardable

May 3 11:57:59 server mds[86]: (DiskStore.Warning:127) Failed messaging flag writer

May 3 11:58:00 --- last message repeated 1 time ---

May 3 11:58:00 server collabd[64761]: [main.m:324 7b3b8000 +0ms] Configured to exit after about 360 seconds idle

May 3 11:58:07 server kdc[7671]: AS-REQ [email protected] from 10.83.75.213:64538 for krbtgt/[email protected]

May 3 11:58:07 server kdc[7671]: UNKNOWN -- [email protected]: no such entry found in hdb

May 3 11:58:11 server kdc[7671]: AS-REQ [email protected] from 10.83.75.213:63417 for krbtgt/[email protected]

May 3 11:58:11 server kdc[7671]: UNKNOWN -- [email protected]: no such entry found in hdb

May 3 11:58:19 server mds[86]: (DiskStore.Warning:127) Failed messaging flag writer

May 3 11:58:22 --- last message repeated 3 times ---

May 3 11:58:22 server kdc[7671]: AS-REQ [email protected] from 10.83.75.213:64149 for krbtgt/[email protected]

May 3 11:58:22 server kdc[7671]: UNKNOWN -- [email protected]: no such entry found in hdb

May 3 11:58:22 server sandboxd[165] ([7671]): kdc(7671) deny file-read-data /private/etc/krb5.conf

May 3 11:58:27 server kdc[7671]: AS-REQ [email protected] from 10.83.75.213:58458 for krbtgt/[email protected]

May 3 11:58:27 server kdc[7671]: UNKNOWN -- [email protected]: no such entry found in hub

 

 

 

I hope that helps!

[aarongulley]

Hi,

 

It helped a little bit. It looks to me your Kerberos is broken. Just want to double check something that you propagated the permissions? Rather than change the permission using File Sharing because this only changes the top level of the folder. Which could be the problem with dragging down the students home folder.

 

Let me know how you get on and we can fix this step by step rather me telling you do everything. You can learn and fix it yourself

 

Thanks

 

Aaron.

[jbutlin]

I think the permissions are propagated - I will put up some screen grabs

[aarongulley]

Is it just select group of users that cannot login or every user on the network? Can you bind the server to OD and test a user account on the server rather than MacBook.

 

Also just checking the server hasn't been upgraded and restored from Time Machine Backup?

 

Thank you

Edited May 3, 2016 by aarongulley
server upgrade question

[jbutlin]

 

some screenshots

[jbutlin]

So far it seems to be a selection of users, most can still log on and access their home drives, and the main shared folder. I've not restored anything using Time Machine either.

[aarongulley]

Hi,

 

Ok now we are getting somewhere. If some users cannot login and others can, the problem maybe be with the user account or ACL (Access Control List).

 

Workgroup manager doesn't update Server.app for some odd reason. Double check the user (can login) is ticked within Server.app

 

Image attached for reference.

 

 

Thanks

 

Aaron.

[jbutlin]

Cheers Aaron, all users have the `login' box ticked. I haven't given them access to `administer this server' though.

[aarongulley]

Cheers Aaron, all users have the `login' box ticked. I haven't given them access to `administer this server' though.

 

You don't want to give the user Administrative powers, that was just an example account. Are you able to create a new account via Workgroup Manager or Server.app and test to see if I can login.

 

I'm just trying to cover all angles.

[jbutlin]

I've created a new account called `pupil', but when I go to create a home drive under the `studenthomes' folder I get an error:

 

Unable to create home directory. The home directory could not be created because of an error.

 

When I look in the StudentHomes folder, it has actually created a home directory for the pupil user...

 

When I try to log in as `pupil', I get the same error as listed in my other Mac related thread - You are unable to log in to the user account pupil at this time

Logging in to the account failed because an error occurred.

[aarongulley]

I've created a new account called `pupil', but when I go to create a home drive under the `studenthomes' folder I get an error:

 

Unable to create home directory. The home directory could not be created because of an error.

 

When I look in the StudentHomes folder, it has actually created a home directory for the pupil user...

 

When I try to log in as `pupil', I get the same error as listed in my other Mac related thread - You are unable to log in to the user account pupil at this time

Logging in to the account failed because an error occurred.

 

Cool perfect, thanks for doing that.. Leave it with my and I will test it our on mac server here at the school and get back to you.

[jbutlin]

Aaron, that is great -thanks a bunch for all your help!

[aarongulley]

Aaron, that is great -thanks a bunch for all your help!

 

I did some testing. Can you login in to an admin account on the macbook and try and map the folder. afp://[servername]/[sharelocation]/homefolder example

 

If it can connect manually, it's a problem with the ACL's (Please make sure the group has File Sharing Access enabled and the user has file sharing enabled)

 

Thank you

 

Aaron.

[aarongulley]

I have attached an example of the ACL's enabled for a user. You can access/change these with server.app under > Users > Select the user > gear icon then edit access to services.

[jbutlin]

Well, I checked all the users that are having one problem or another - all have File Sharing ticked in services.

Interestingly enough though, when I logged onto a mac with the local admin account and tried to connect to any user's using AFP it couldn't find the server... It only seems to work using SMB. I've checked, and all shared files except one have both AFP and SMB ticked.

[aarongulley]

Well, I checked all the users that are having one problem or another - all have File Sharing ticked in services.

Interestingly enough though, when I logged onto a mac with the local admin account and tried to connect to any user's using AFP it couldn't find the server... It only seems to work using SMB. I've checked, and all shared files except one have both AFP and SMB ticked.

 

Ok. I will get back you tomorrow maybe we could setup some remote support yourself. Rather than going back and forward.

Thanks

Aaron.