jordaneunson

Awesome question! I think he does considering he can check out the TGT. If the time is out by more than 5 mins the KDC won't allow the client to check out a TGT.

Hi Dan, It sounds like you have something really misconfigured. When you try to auth to the OD server does your AD log the authentication attempt?

Pics or GTFO

I'm going to assume a few things here. First that you're trying to authenticate to the mac server so that you can mount a file share. My primary question would be, have you given restricted access rights to AFP or SMB services? Next, in terms of the SSO go to the command line and type kinit see if you can check out a tgt. If you cannot check out a tgt then there's something wrong with your AD server and I can't help you. To check out a tgt you do not need the mac to be kerberized. If you can successfully check the tgt out then see if you can login into the mac server as an ad account. Do this from the login screen and not remotely, upon successful login check the klist com and again to see if you got a tgt assigned. Next, repeat this on a mac client that is bound to both AD and OD. Login as an AD user and see if you get a tgt. if you do, the try to authenticate to the AFP server and check afterwards. You should see some extra tickets.

Thanks, I try. What do you mean you can't browse any other machine? What are you trying to browse? Do you mean that they are not showing up in the sidebar as available servers, or do you mean that you cannot browse their file shares? If so what are file shares? I need a few more details than this. You can verify what Kerberos tickets you have by typing 'klist' on the command line. It will show you which tickets you currently have. To kerberize your OD server all you need to do is type 'sudo dsconfigad -enablesso' on the Mac server. Then create file shares on the Mac server and assign AD users and groups access rights via Server Admin. Let me know what happens. If you want take this to the comments section for this blog post here: jordaneunson.com » Blog Archive » Apple Magic Triangle Setup with Windows File Server backed Portable Home Directories.