No authentication to Apple OpenDirectory Server after upgrading to 201508250051

[tmueko]

I have a FreeNAS-Server authenticating Macs using afp against an Apple OD.
After upgrade to 201508250051, things stopped working. I booted into 201506292332 and it works again.
OS-X Server is Running 10.9.5.

Any Idea what I can do?

 

[dlavigne]

Create a bug report using System -> Support (as it will include your config file and debug files). Note that you need to have an account at bugs.freenas.org first before using this tab. Post the issue number here once you create the bug report.

 

[tmueko]

Can't create a bug report: Category is empty ... see screenshot.

 

[dlavigne]

This means that you're not logged into bugs.freenas.org or haven't activated your account yet.

 

[tmueko]

I tried a second time and now it worked....
Ticket 11220
https://bugs.freenas.org/issues/11220

 

[Henning Kessler]

Same Problem here. It started with 201508250051 and persists after 201509022158. Do you got already some response from you bug report?

 

[tmueko]

I updated to the latest release yesterday.
LDAP binding worked. I could poll the tree usind "id <username" but the AFP-Users couldn't connect.
I Didn't updated the ticket yet.

 

[Henning Kessler]

After the applying the new FreeNAS-9.3-STABLE-201509160044 update LDAP binding still confirms a successful binding/update but No LDAP Uses can connect and I can't get id <username> to work.

 

[Henning Kessler]

Have a look at this:
https://bugs.freenas.org/issues/11511
They found the reason for this issue and fix will be released.

meanwhile you can use the workaround in this bug report.

 

[Ashley Drees]

I have had these kind of issues. the 11511 link did not do it for me, but by putting the following in the LDAP Auxiliary Parameters: which then sets up the sssd config to use kerberos, which works for me, but i am still in the testing phase.

ldap_version 3
bind_policy soft
pam_ldap_attribute uid
auth_provider = krb5
krb5_server = your.server.tld
krb5_realm = YOUR.SERVER.TLD
cache_credentials = true

 

[Henning Kessler]

Hello Ashely,

so you got a working Kerberos authentication with OpenDirectory? Could probably explain how to created this setup in detail?

Henning