Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-3529: Single Sign On fails for some network shares on Mac systems.

Centrify Identity Service, Mac Edition ,  

12 April,16 at 11:07 AM

Applies to: All versions of Centrify DirectControl on Mac OS X

Question:

Single-sign on (SSO) is failing when users try to connect to a network share on a certain file server.

Other file servers in the environment are able to mount immediately without prompting for credentials again (which means Kerberos is working correctly), but connecting to this specific host still prompts the user for authentication.

The connection is being made using the FQDN path (to ensure Kerberos compatibility) and there are no other connectivity issues on the machine.

What else can be checked to make SSO work for this file server?


Answer:

SSO may fail to work properly if the Mac tries to authenticate via Kerberos on the wrong SPN (servicePrincipalName).
(This can happen in some environments such as those which use semi-disjointed namespaces.)

To verify this:
  • Capture a network trace of a failed automatic-authentication on the network share.
  • Open the packet capture in Wireshark and filter the output under the term:
    • kerberos.msg_type 
  • If the entries contain the following: 
    • error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7) 
    • Server Name (Service and Host): cifs/attempted-server.domain.com 
  • Then this could mean the file server's servicePrincipalName is not correct in Active Directory. 
    • (i.e. The SPN attribute does not contain the cifs entry for "attempted-server.domain.com") 


To fix this:
  1. Open ADUC and make sure View has "Advanced Features" enabled. 
     
  2. Navigate to the computer object for the file server where SSO is not working.
     
  3. Right-click > Properties > Attribute Editor tab 
     
  4. Scroll down to the "servicePrincipalName" attribute and click Edit 
     
  5. Make sure the following entries are in the list (If they're missing, go ahead and add them in): 
    • cifs/attempted-server.domain.com
    • cifs/attempted-server
  6. Once the entries have been added, test the mount again. It should now mount without prompting the user for credentials.

    (Note: The server and client may require a restart for the changes to take effect)

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.