Kerberos/AFS Login Additions to OS X 10.3.x

Caveats: this worked for me, but your mileage may vary. Be careful. You should always have a backup.

10.3 uses a variant of MIT's kerberos, so what we're going to do is install some bits from MIT, configure kerberos for our domain, then install a plug in to get afs token, and finally set up login authorization to generate tickets from the main GUI login window, to check against kerberos for permission to alter system preferences, and to check against kerberos from the screen saver. In all of these cases, authentication is supposed to fall back to local authentication if kerberos fails, so this should be safe for laptops. It's working ok for me on mine, but I suggest you try one feature at a time.

Step 1: Install MIT's kerberos extras package

You can get MIT's Kerberos Extras from:

http://web.mit.edu/macdev/Development/MITKerberos/Common/Documentation/osx-kerberos-extras.html

Installation of this will enable kerberos support for Carbon applications, and set up a sample kerberos configuration file. It's really an optional step, but why not?

Step 2: Configure Kerberos

Once it's installed, go to /Library/Preferences and find the edu.mit.Kerberos file. As root, or using sudo, make a backup, then open this file with a text editor (eg. vi, pico, BBEdit). For default realm, use your main kerberos realm. If you're in a Kerberos4 realm, add the data in the "v4" sections. For more detailed information, see the MIT Kerberos for OS X preferences and faq pages.

If you also want to get AFS tokens when you login add a line in [libdefaults] for 'login_logout_notification = "aklog"', this will create the link to kfm_aklog plugin we'll install in Step 3. If you get an AFS token on login, you can access your AFS space without having to go to the terminal window and typing running aklog. Of course, this presupposes that you've installedan AFS client and have configured your machine to access an AFS cell.

In this first example below, I've put the information for the kerberos authentication servers for the two afs cells I use, isis.unc.edu and cs.unc.edu. These files are slightly different than the ones for 10.2.

 

[libdefaults]
    login_logout_notification = "aklog"
    default_realm = CS.UNC.EDU 
    ticket_lifetime = 600  
    noaddresses = TRUE
     dns_lookup_realm = true     
    dns_lookup_kdc = true 
   
   
[realms]
    ISIS.UNC.EDU = {
        kdc = krb0.unc.edu.:88
        kdc = krb1.unc.edu.:88
        kdc = krb2.unc.edu.:88
        admin_server = krb0.unc.edu
        default_domain = isis.unc.edu
        }
   
[domain_realm]
        .isis.unc.edu = ISIS.UNC.EDU
        isis.unc.edu = ISIS.UNC.EDU
    
[v4 realms]
    CS.UNC.EDU = {
        kdc = kerberos.cs.unc.edu
        kdc = kerberos-1.cs.unc.edu
        kdc = kerberos-2.cs.unc.edu
        admin_server = kerberos.cs.unc.edu
        default_domain = cs.unc.edu
         }
   
    ISIS.UNC.EDU = {
                kdc = krb0.unc.edu.
                kdc = krb1.unc.edu.
                kdc = krb2.unc.edu.
                admin_server = krb0.unc.edu.
                default_domain = isis.unc.edu
            }   
   
[v4 domain_realm]
    .cs.unc.edu = CS.UNC.EDU
    cs.unc.edu = CS.UNC.EDU
     isis.unc.edu = ISIS.UNC.EDU
     .isis.unc.edu = ISIS.UNC.EDU
  

Isis users should try the following in the same file, it's the same file without the settings for the CS.UNC.EDU realm. In theory, you shouldn't need the v4 data, but things seem to work better with it in place.

[libdefaults]
    login_logout_notification = "aklog"
    default_realm = ISIS.UNC.EDU 
    ticket_lifetime = 600  
    noaddresses = TRUE
     dns_lookup_realm = true     
    dns_lookup_kdc = true 
   
   
[realms]
    ISIS.UNC.EDU = {
        kdc = krb0.unc.edu.:88
        kdc = krb1.unc.edu.:88
        kdc = krb2.unc.edu.:88
        admin_server = krb0.unc.edu
        default_domain = isis.unc.edu
        }
   
[domain_realm]
        .isis.unc.edu = ISIS.UNC.EDU
        isis.unc.edu = ISIS.UNC.EDU
    
[v4 realms]
   
    ISIS.UNC.EDU = {
                kdc = krb0.unc.edu.
                kdc = krb1.unc.edu.
                kdc = krb2.unc.edu.
                admin_server = krb0.unc.edu.
                default_domain = isis.unc.edu
            }   
   
[v4 domain_realm]
     isis.unc.edu = ISIS.UNC.EDU
     .isis.unc.edu = ISIS.UNC.EDU
   
  

Save the file. You will have to logout and log back in to test it, but a reboot shouldn't be required (Note: you can also put this file in your home /Library/Preferences folder--Kerberos will check your folder first, and then look in the system folder.)

Once you're logged back in, look in /Applications/Utilites for the Kerberos application--the MIT extras install puts an alias to this where you can find it, instead in CoreServices. Open this, and go to Edit, Edit Favorite Realms, and add the cs.unc.edu realm.

Once you've done that, you should be able to use the main window to get kerberos tickets.

So far so good--now you should be able to use applications that know how to use kerberos. At UNC, that doesn't mean much, since we don't use kerberos all that much and most applications aren't kerberized. But this does lay the groundwork for the next step, which is automatically getting AFS tokens for access to your online file space.

Step 3: Getting AFS Tokens, Install Alexei's kfm_aklog plugin

This plugin will obtain an AFS token for you on login, and destroy it on logout. You can download the source from Alexei Kosut's page, but I've also made a binary available here. I think the binary will work, please let me know if it doesn't. As root or via sudo, make a directory named /Library/Kerberos Plug-Ins, and then copy the kfm_aklog.tgz file into it. Unpack the file, and then delete the compressed version:

sudo mkdir /Library/Kerberos\ Plug-Ins
cd /Library/Kerberos\ Plug-Ins
sudo curl -O http://www.ibiblio.org/macsupport/kerberos/10.3/kfm_aklog.tgz
sudo gnutar -xzf kfm_aklog.tgz
sudo rm kfm_aklog.tgz

The kfm_aklog plugin gets calls from Kerberos each time a user gets or renews a ticket, and obtains an afs token for that user. So now if we can tie kerberos authentication to the existing mac authentication processes, users can renew tokens to afs space without having to manually run klog.

Hint: This will be particularly important for setting up lab machines using AFS home directories....

Step 4: Enable Kerberos authentication at login

From a terminal window, su to root or use sudo to open /etc/authorization in a text editor (in this example, I'm using vi, but pico would work fine, too):

sudo cp /etc/authorization /etc/authorizaton.bak
sudo vi /etc/authorization
  

If you did this modification for 10.2, the first thing you should do is check to see that your previous setting is not in place. Do a search for <string>switch_to_user,krb5auth:login</string>, and if you find it, change it back to <string>switch_to_user</string>. Obviously, if you haven't done this under a prior version, you don't need to make this modification.

To enable kerberos login as part of the main login process, find the system.login.console key in /etc/authorization. Within that key, there's a mechanism key. Replace <string >authinternal</string> with <string>builtin:krb5authnoverify</string> just below the loginwindow_builtin:login string.

<key>mechanisms</key>
    <array>
        <string>loginwindow_builtin:login</string>
        <string>builtin:krb5authnoverify</string>
        <string>loginwindow_builtin:success</string>
        <string>builtin:getuserinfo</string>
        <string>builtin:sso</string>
    </array>

Logout and login again, and then open the Kerberos utility or run klist to see that you have tickets. Then try to access your afs space, or open a terminal window and type the "tokens" command to see that you have AFS tokens. Don't go on to the next steps until you verify this!

To enable kerberos authentication as part of editing system preferences, find the system.preferences key in /etc/authorization. Within that key, find the mechanism key and add <string>builtin:krb5authnoverify</string> just below the builtin:authenticate string:

<key>mechanisms</key>
    <array>
        <string>builtin:authenticate</string>
        <string>builtin:krb5authnoverify</string>
    </array>

To enable kerberos login via the screen saver, find the authenticate-session-owner-or-admin key. Look for the (you guessed it) mechanism key, and add <string>builtin:krb5authnoverify</string> below the builtin:authenticate string:

<key>mechanisms</key>
    <array>
        <string>builtin:authenticate</string>
        <string>builtin:krb5authnoverify</string>
    </array>

To test this one, use the kerberos utility to destroy your tickets and tokens, then activate the screen saver (using a hot corner). If it works correctly, when you come back in, you should have a fresh set of tickets andtokens. If it doesn't work, and you can't get back in, you may have to do a hard reboot.

If you mess up your authorization files, and need to start from scratch, here's a virgin copy of the one that was installed on my powerbook from the first public release of 10.3.

 

How does it work?

What this procedure does (assuming I'm understanding all of it correctly) is set up the GUI's login window to try to get a Kerberos ticket when you login by passing the same userid and password to the kerberos server. When this is successful, you are given kerberos tickets to the default realm. If you've added the login_logout_notification = "aklog" line to the edu.mit.kerberos file, Alexei's kfm_aklog plugin will be called when you get that Kerberos ticket, and will get you an AFS token.