10.7 and 10.8 Clients do not generate Kerberos tickets at login: FIX

(For information about forcing 10.6.x clients to get a Kerberos ticket at login see this Apple KB)

We have encountered a problem where Lion and Mountain Lion clients are not generating Kerberos tickets at login.  This causes problems with single-sign-on (SSO) to network shares as well as with Kerberos enabled applications like SAP.

Apparently Apple's latest version of Kerberos will not automatically request a ticket when a Kerberos enabled application launches.  Instead you must either go to Terminal and type "kinit" and enter your password or force a ticket to be generated at login using the following instructions.

Note: in order to correctly authenticate using Kerberos enabled applications like SAP your user name in AD and in the application itself must match.  This means that both your SAMAccount name and UPN in must be identical- including the case.  Many non-Microsoft instances of Kerberos are case-sensitive.

To generate a Kerberos ticket at login (10.7 and 10.8 clients):

•  Open Terminal
• Type "sudo -s" and authenticate as super user
• Navigate to /etc/pam.d
• Type "cp authorization authorization.bak" to make a backup of the authorization file
• Type "pico authorization" to edit the file (you could also use vi or your favourite editor)

Find the line:

auth       optional       pam_krb5.so use_first_pass use_kcminit

Add the key "default_principal" to the end of the line. For example:

auth       optional       pam_krb5.so use_first_pass use_kcminit default_principal

• Save the file
• Restart and log back into the computer
• Check that a Kerberos ticket has been generated by opening Terminal and typing "klist"

SAP launch error in Lion

On AD bound Lion (10.7.3) Macs were were receiving the following error on launch:

Unable to load GSS-API dyld Shared Library
named "sncgss.dyld"

We have seen similar errors with Snow Leopard (10.6.x) machines and it normally indicated that 32bit mode was not enabled; this was not the case in London.

The fix we found involves setting the SNC_LIB varriable using the following commands in Terminal:

echo Setting the SNC environment for current user.
mkdir ~/.MacOSX >/dev/null 2>&1
defaults write ~/.MacOSX/environment.plist SNC_LIB "/usr/lib/libgssapi_krb5.dylib"

Strangely, this did not fix the problem right away- we had to wait for upwards of an hour for the fix to "take"; once it did the users could launch the SAP client normally.