I recently configured a couple Macs to access an AD-OD triangle.
Everything works fine, except that some users cannot change their
passwords from system preferences, and others get a message saying
they can't ("You cannot change your pas...") but the password is in
fact changed. They are all using 10.4.8 all patched-up.
I turned on debug logging for DirectoryService and I get (only the
relevant part is shown, I guess) the log shown in the bottom. I
turned on API logging and everytime I try to change the password,
DirectoryService crashes.
The users can change their passwords on Windows computers and via
web, and there are no restrictions on the passwords. By the way this
is a W2003 Server SP1 and the keys for signing communications are
disabled.
I tried changing the password from Kerberos.app and I got a message
saying:
"Requested effective lifetime is negative or too short."
Has this happened to any of you before?
Turning on auditing on the server doesn't show anything. Where else
can I look? Or maybe I'm enabling the wrong audit (on the Windows
Server).
Thanks a lot,
Gustavo
Here's the log:
===============
2007-01-26 11:10:57 PET - Internal Dispatch, API: dsOpenDirNode(),
Active Directory Used : DAC : Dir Ref = 16777318 : Node Name = /
Active Directory/arpl.com
2007-01-26 11:10:57 PET - ADPlugin: Calling OpenDirNode
2007-01-26 11:10:57 PET - ADPlugin: Opening Forest-Level Node
2007-01-26 11:10:57 PET - Determined plugin ptr used and returns
result 0
2007-01-26 11:10:57 PET - Internal Dispatch, API: dsOpenDirNode(),
Active Directory Used : DAR : Dir Ref = 16777318 : Node Ref =
16777319 : Result code = 0
2007-01-26 11:10:57 PET - Internal Dispatch, API: dsDoDirNodeAuth(),
Active Directory Used : DAC : Node Ref = 16777319 : User Name =
kzimmermann : Auth Method = dsAuthMethodStandard:dsAuthChangePasswd :
Auth Only Flag = 1 : Continue Data = 0
2007-01-26 11:10:57 PET - ADPlugin: Calling Authentication
2007-01-26 11:10:57 PET - ADPlugin: 16777319 - Authentication
Called with AuthType dsAuthMethodStandard:dsAuthChangePasswd
2007-01-26 11:10:57 PET - ADPlugin: Locating User with Query
(&(objectCategory=person)(|(cn=kzimmermann)
(sAMAccountName=kzimmermann)(displayName=kzimmermann)
(mail=kzimmermann)(userPrincipalName=kzimmermann)
(userPrincipalName=kzimmermann@*)))
2007-01-26 11:10:57 PET - ADPlugin: Locating Records from
Global Catalog
2007-01-26 11:10:57 PET - ADPlugin: Good credentials for
celvire101$@ARPL.COM
2007-01-26 11:10:57 PET - ADPlugin: Retrieved existing
connection from connection mgr celvire101$@ARPL.COM@AD GC Node:3268
2007-01-26 11:10:57 PET - ADPlugin: Returning connection to
pool for domain AD GC Node with dsStatus 0.
2007-01-26 11:10:57 PET - ADPlugin: Retrieving Records from
Primary Domain
2007-01-26 11:10:57 PET - ADPlugin: ADSEngine Retrieval started
2007-01-26 11:10:57 PET - ADPlugin: Good credentials for
celvire101$@ARPL.COM
2007-01-26 11:10:57 PET - ADPlugin: Retrieved existing
connection from connection mgr celvire101$@email@hidden:389
2007-01-26 11:10:57 PET - ADPlugin: Returning connection to
pool for domain arpl.com with dsStatus 0.
2007-01-26 11:10:57 PET - ADPlugin: ADSEngine Retrieval
ended returning 1 results
2007-01-26 11:10:57 PET - ADPlugin: Changing Password for User
email@hidden
2007-01-26 11:10:57 PET - ADPlugin: Change Password called for
user kzimmermann FAILED
2007-01-26 11:10:57 PET - Internal Dispatch, API: dsDoDirNodeAuth(),
Active Directory Used : DAR : Node Ref = 16777319 : Result code = -14090
2007-01-26 11:10:57 PET - Plug-in call "dsDoDirNodeAuth()" failed
with error = -14090.
2007-01-26 11:10:57 PET - Port: 0 Call: dsDoDirNodeAuth() == -14090
2007-01-26 11:10:57 PET - ADPlugin: Calling CloseDirNode
