TweetFollow Us on Twitter

Troubleshooting Directory Services

Volume Number: 23 (2007)
Issue Number: 06
Column Tag: MacEnterprise

Troubleshooting Directory Services

The basics

By Philip Rinehart, Yale University

Directory Services

One of the most common questions that are discussed on the MacEnterpise mailing list is the diagnosis and analysis of integration of OS X with Directory Services. While most commonly talked about in reference to Active Directory, many of the tools that can be used are applicable to any Directory Service, as most rely on the same core foundation. The first step of any analysis and troubleshooting is based on having a solid Domain Naming System, commonly known as DNS.

DNS problems

How does one go about troubleshooting DNS on OS X? More importantly, what should be tested and in what order? Checking forward and reverse DNS records usually makes the most sense initially. Misconfigured DNS information can often be the root of Directory Service problems. If the administrator configuring DNS has not correctly set both the forward and reverse DNS records, any attempt to bind or use a Directory Service becomes incrementally difficult.

Testing forward DNS

The first step is to test forward DNS records. As a brief reminder, forward DNS is the process of looking up a domain name and having the IP address returned. There are many tools to test this functionality, but one that can quickly test forward DNS resolution is the command line tool, host. Open a terminal, and type in host name.domain.com. If the forward DNS record is properly set up, the return should be: host name.domain.com has address 111.222.333.444. Easy, right?

Testing reverse DNS

Next, test reverse DNS records. Reverse DNS is the process of taking an IP address, and resolving it to a domain name. As before, using the host command line tool is easiest. Open a terminal, and type in host 111.222.333.444. If the reverse DNS record is properly set up, the return should be: host 444.333.222.111.in-addr.arpa domain name pointer name.domain.com. It cannot be emphasized enough how important it is to have correctly configured forward and reverse DNS records. In particular, the Active Directory plug-in can be very sensitive to incorrect DNS configuration. Generally, if DNS is functioning correctly, binding to any Directory Service should be trivial. So, if DNS is working, what should be the next step?

Network problems

At times, testing DNS using host can point to the cause of Directory Service problems. However, it is very important to note that testing this is only testing servers providing the DNS records, not necessarily the resolution by the client machine.

The first, and most obvious way to test network connectivity is with the use of ping. Ping the server providing directory services, and determine whether the client has connectivity with the provider. Silly as it sounds, check the cable or IP address being provided by a wireless server. Often the simple things are the solution!

Next, using the tool lookupd, client side DNS resolution can be tested. Testing reverse DNS, using the interactive debug mode, can verify that the results returned by using host are what the client is using as well. Invoke the debugger with lookupd -d. Following the same testing procedure, first enter:

hostWithName: hostname.domain.com

Next, enter:

hostWithInternetAddress: 111.222.333.444

Both commands will return a lot of information, including the agent that is being used by the client, as well as cache information, and how many hits have occurred by the operating system. This information can point to subtle DNS problems if it is different from the information returned by the host command.

Authentication problems

If a machine is successfully bound, the next most common problem that is reported is the inability to authenticate to a directory service exhibited by a shaking login window. Let's tackle the simplest way to test authentication first.

Dirt

Dirt? Never heard of the tool? It is a lesser-known tool that can be used to test Directory Services from the command line. It is particularly useful when used to test authentication against a bound Directory Service. The syntax can be a little tricky, but when used, it can be quite powerful. The first test is to check that the user exists in the Directory Services node. Here's how, open a terminal and type:

dirt -u username -n

The return value should be:

User username was found in:
/DSNode

This test simply does a quick verification of the username that is being used to login, and makes sure that the OS X client can see the information contained by the Directory Node. Next, test user authentication using the node name as follows:

dirt -m "/Active Directory/All Domains" ¬
-u activedirectoryusername -p activedirectorypassword

The command above specifically tests Active Directory, but any valid domain node can be tested. Some important notes:

The -u flag uses the username from the node you are testing against, in the above example it is the Active Directory username

The -p flag uses the password from the username that is being tested. In the above example, it is the Active Directory account password

The node is the Search node as referenced in Directory Access. In the above example, all Active Directory domains are searched.

Local administrative privileges are not required to use this tool.

Currently, the password must be entered with the -p option, as omitting it does not work as documented in the manual page. The return value can provide very useful troubleshooting information. As an example, this output is returned with a bad password:

Call to dsGetRecordList returned count = 1 with Status : eDSNoErr : (0)
Username: username
Password: password
Error : eDSAuthFailed : (-14090)

This return status very clearly reflects the failed password authentication. Let's dive even deeper.

Kerberos

Kerberos is increasingly being used for authentication for many Directory Services. If the password is correct, but the shaking login window is still occurring, the next area to focus on, especially for Active Directory and Open Directory, is Kerberos troubleshooting. Fortunately, testing is painless using the command tool, kinit. Type in the following:

kinit username

On failure, a very understandable error message is displayed:

Kerberos Login Failed: Clock skew too big. 
Please check your time, time zone and daylight savings settings.

From this error message, it is clear that Kerberos is failing because the clock differential, referred to as skew, is too great. While many administrators set the clock to use a network timeserver, it is not uncommon for OS X to drift by more than five minutes; this is usually greater than the allowable clock skew. Adjust the date and time to be within five minutes of the Directory Services authentication source, and this problem is solved!

These problems are the 'low-hanging' fruit, and can usually quickly solve Directory Service problems. What about problems that are more difficult?

Bringing in the Big guns

What if none of these troubleshooting steps works? There are three ways to log information, one for Directory Services, one for Managed Client (MCX), and one for Portable Home Directories.

Directory Services

If none of the quick steps provides an answer, debugging Directory Services is often needed to troubleshoot particularly complex problems. There are two different levels of logging which can be invoked on demand USR1, and USR2. Both are turned on similarly, with the command:

killall -USR1 DirectoryService

USR1 will log information to

/Library/Logs/DirectoryService/DirectoryService.debug.log.

USR2 sends all information to the system.log file. One last thing, both levels can also be set by touching a file in the following directory as follows:

touch /Library/Preferences/DirectoryService/.DSLogDebugAtStart (USR1)
touch /Library/Preferences/DirectoryService/.DSLogAPIAtStart (USR2)

Reboot the client, and debugging will begin at boot time.

Managed Client Services (MCX)

Debugging information can be collected and set using a command line only option:

defaults write /Library/Preferences/com.apple.MCXDebug debugOutput 3

Writing this preference will log all information relating to client management to the system.log file. Three is the maximum value that can be set. Using this value, a tremendous amount of information can be seen in the client log, and may point to managed client problems.

Portable Home Directories

Portable home directories can also be logged with a hidden preference:

defaults write com.apple.MirrorAgent debugOutput 4

This preference will log all portable home directory information to ~/Library/Logs/MirrorAgent.log. Again, though not fun, this information can often point to the source of trouble when attempting to diagnose a sticky Portable Home Directory problem.

Conclusion

Diagnosing and troubleshooting can be one of the most complex issues in the integration of OS X clients into heterogeneous network infrastructures. Remember to always start from the simplest explanation, as it often is the source of the problem. It is easy to errantly assume a much larger problem, when, in fact, the problem may be quite simple. However, with the above techniques and tools, bending Directory Services to your will should be far simpler.


Philip Rinehart is co-chair of the steering committee leading the Mac OS X Enterprise Project (macenterprise.org) and is the Lead Mac Analyst at Yale University. He has been using Macintosh Computers since the days of the Macintosh SE, and Mac OS X since its Developer Preview Release. Before coming to Yale, he worked as a Unix system administrator for a dot-com company. He can be reached at: philip.rinehart@yale.edu.

The MacEnterprise project is a community of IT professionals sharing information and solutions to support Macs in an enterprise. We collaborate on the deployment, management, and integration of Mac OS X client and server computers into multi-platform computing environments

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Postbox 7.0.50 - Powerful and flexible e...
Postbox is a desktop feature-stuffed email client, news application, and feed reader that helps you manage your work life and increase productivity. Now you can organize all your email accounts in... Read more
Amadeus Pro 2.8.8 - Multitrack sound rec...
Amadeus Pro lets you use your Mac for any audio-related task, such as live audio recording, digitizing tapes and records, converting between a variety of sound formats, etc. Thanks to its outstanding... Read more
Printopia 3.0.19 - Share Mac printers wi...
Run Printopia on your Mac to share its printers to any capable iPhone, iPad, or iPod Touch. Printopia will also add virtual printers, allowing you to save print-outs to your Mac and send to apps.... Read more
Vivaldi 4.3.2439.56 - An advanced browse...
Vivaldi is a browser for our friends. We live in our browsers. Choose one that has the features you need, a style that fits and values you can stand by. From the look and feel, to how you interact... Read more
BBEdit 14.0.2 - Powerful text and HTML e...
BBEdit is the leading professional HTML and text editor for the Mac. Specifically crafted in response to the needs of Web authors and software developers, this award-winning product provides a... Read more
Sparkle Pro 3.1.5 - Visual website creat...
Sparkle Pro will change your mind if you thought building websites wasn't for you. Sparkle is the intuitive site builder that lets you create sites for your online portfolio, team or band pages, or... Read more
Slack 4.21.0 - Collaborative communicati...
Slack brings team communication and collaboration into one place so you can get more work done, whether you belong to a large enterprise or a small business. Check off your to-do list and move your... Read more
Smultron 12.5 - Easy-to-use, powerful te...
Smultron 12 is the text editor for all of us. Smultron is powerful and confident without being complicated. Its elegance and simplicity helps everyone being creative and to write and edit all sorts... Read more
GoodNotes 5.7.40 - Note-Taking & PDF...
With GoodNotes you can transform your Mac into smart digital paper and a powerful document management system. Use the same features from GoodNotes' iPad version on your Mac and work with your... Read more
Carbon Copy Cloner 6.0.4 - Easy-to-use b...
Carbon Copy Cloner backups are better than ordinary backups. Suppose the unthinkable happens while you're under deadline to finish a project: your Mac is unresponsive and all you hear is an ominous,... Read more

Latest Forum Discussions

See All

This Podcast Must Stay Above 55mph – The...
In this week’s episode of The TouchArcade Show, we have to keep the podcast above 55mph or else it will explode! Like the movie Speed! Eli and I spend just about the whole episode talking about Apple’s Unleashed event from this past Monday where,... | Read more »
TouchArcade Game of the Week: ‘Pinstripe...
I know what you’re thinking: “Boy that Townscaper thing sure is neat!" Yes, it is, I love it too and we loved it in our review. BUT! As tempting as it is to gush about it some more here, I actually want to draw your attention to another excellent... | Read more »
The 10 Best Horror Games on Nintendo Swi...
2021 has been a packed year for games on all platforms across different genres. If you’ve noticed, a lot of games are getting into the spooky season with in-game events and the like, but nothing beats a horror game during this season. For this... | Read more »
SwitchArcade Round-Up: ‘Dying Light’ Rev...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for October 22nd, 2021. In today’s article, we have a rare Friday review from our pal Mikhail. He worked tirelessly through the night to bring us his thoughts on Dying Light: Platinum... | Read more »
Steam Link Spotlight - If On a Winter...
Steam Link Spotlight is a feature where we look at PC games that play exceptionally well using the Steam Link app. Our last entry looked at Ambition - A Minuet in Power. Read about how it plays using Steam Link over here. | Read more »
Adventure Puzzler ‘Rob Riches’ Gets a Ne...
Last month we wrote about a new game coming from developer Megapop called Rob Riches, a love letter to classic puzzle adventure games. In Rob Riches you’ll play as the titular man himself as you explore a temple collecting every coin you can find in... | Read more »
‘Grand Theft Auto: The Trilogy – The Def...
After Grand Theft Auto: The Trilogy – The Definitive Edition was officially announced recently following a rumour from a little while ago, a | Read more »
Apple Arcade October 22nd Update Roundup...
This week, NBA 2K22 Arcade Edition was the big new release and it actually arrived a few days ago instead of following the usual Thursday / Friday release pattern. Read more about it here. Barring that new release, Apple Arcade has had many big... | Read more »
‘PUBG: New State’ Release Date Announced...
PUBG: New State () from Krafton was revealed a while ago and we’ve had a drip-feed of information revealing gameplay additions, map details, and more through different ‘Field Trip to Troi | Read more »
Simulation RPG ‘Haunted Chocolatier’ Ann...
Over the years, Stardew Valley ($4.99) from Eric Barone (ConcernedApe) has continued to get even better. Following its debut on PC, it came to consoles and mobile platforms. The iOS and Android version have both improved a lot with since launch and... | Read more »

Price Scanner via MacPrices.net

A Look Back At ‘The gadget of the century,’ A...
FEATURE: 10.23.21 – It’s been two decades since a device that put 1,000 songs in our pockets would forever change the way we listened to music. The iPod — which Apple announced on October 23, 2001 —... Read more
Get Apple’s new AirPods Pro with MagSafe Case...
Amazon has Apple’s new 2021 AirPods Pro with MagSafe Case in stock and on sale for $219 shipped. Their price is $30 off Apple’s MSRP, and it’s the first discount we’ve seen on 2021 AirPods Pro. For... Read more
First discounts appear at Amazon with new 14″...
Amazon is offering $50 discounts on a couple of new 14″ M1 MacBook Pros and 16″ M1 MacBook Pros. Preorder today, and Amazon will ship once they receive stock. We expect Amazon’s $50 discount to... Read more
Expercom has the new 9th generation 10″ iPad...
Apple reseller Expercom has Apple’s new 2021 9th generation iPad and 8.3″ iPad mini on sale for up to $40 off MSRP. They are the first reseller to offer such discounts. Due to supply constraints,... Read more
Save $250 on the 12″ 2TB M1 iPad Pro, only $1...
Amazon has the new 12″ 2TB WiFi M1-powered iPad Pro, Space Gray, in stock and on sale today for $1949 shipped. Their price is $250 off Apple’s MSRP, and it’s the lowest price available for a 2TB iPad... Read more
These are the best AppleCare+ Plan deals toda...
Apple reseller Expercom is offering sale prices on Apple AppleCare+ plans ranging up to $94 off MSRP, depending on the product. Plans can be purchased individually and will extend your technical and... Read more
So… When Will All The NEW Products Apple Anno...
FEATURE: 10.20.21 – By now, you’ve probably heard everything there is to know about the products that were unveiled at Apple’s second Fall product announcement of the year, but when will they finally... Read more
M1 Mac minis on sale for $50-$100 off MSRP at...
Looking for a discount on one of Apple’s popular new Mac minis with Apple M1 Silicon CPUs? These Apple Authorized Resellers are offering $50-$100 discounts on standard mini configurations today. (1... Read more
MacPrices.net launches new Apple 14″ MacBook...
Apple introduced the new 14″ M1 MacBook Pros yesterday (and 16″ models) with an updated design, new 10- to 32-Core M1 Pro and M1 Max CPUs, magic keyboards, edge-to-edge displays, and more. Apple and... Read more
Base 21″ 2.3GHz iMac on sale for $990, plus t...
Expercom has the base 21″ 2.3GHz Dual-Core Intel-based iMac on sale for $990.85 shipped. Their price is $109 off Apple’s MSRP, and it’s the cheapest price for a new iMac from any Apple reseller. You... Read more

Jobs Board

Sales Floor Associate - *Apple* Blossom Mal...
Sales Floor Associate - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Read more
Seasonal Operations Associate - *Apple* Blo...
Seasonal Operations Associate - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Read more
Seasonal Cashier - *Apple* Blossom Mall - J...
Seasonal Cashier - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Read more
Geek Squad Advanced Repair *Apple* Professi...
**838870BR** **Job Title:** Geek Squad Advanced Repair Apple Professional **Job Category:** Store Associates **Store Number or Department:** 000056-Cedar Hill-Store Read more
Sales Floor Assistant - *Apple* Blossom Mal...
Sales Floor Assistant - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.