Kerberos/AFS Login Additions to OS X

Since UNC is an AFS environment, it's nice to have good afs/kerberos support in OS X. AFS is provided for OS X by both the Arla and the OpenAFS groups, and OS X relies on MIT's kerberos. But linking them isn't exactly trivial.

In the way of background, AFS uses it's own variant of Kerberos 4 for authentication (the current version of Kerberos is 5). In AFS parlance, when you login into AFS you are given a token, which is good for a limited period of time. Most users are familiar with getting a token using klog.

Another way to approach this is to authenticate against Kerberos directly. Kerberos supports something called a ticket granting ticket, which basically means that once a user has authenticated against Kerberos, the Kerberos system can provide authentication for other services, such as AFS.

Why do it this way, if you can just klog to get tokens? Well, you don't get a token when you login to the main GUI login window. However, under 10.2 and later, you can set up your system to get or renew Kerberos tickets when you login, and you can set up Kerberos to also get you an AFS token when that happens. Under 10.3 you can also get tickets and tokens when you give your password to the screen saver or change system preferences. It requires downloading some software and editing some text files, but it's not that hard to do.

Here are some documents for each version. These documents just represent what worked for me:

GUI Logins (main Loginwindow, Screensaver, Preferences, etc)

Remote login via SSH


Last modified: 06 March 2010