Configuring Kerberos for "Connected to directory system" setup (a server that uses another KDC for authentication).

This will set a Mac OS X server up to join into an existing Open Directory (LDAP) network, and use that realm's KDC for authenticating.

All commands are in "Courier" font.

Configuring kerberos on the command line
------------------------------------------------------
You can use 'kerberosautoconfig' to configure the machine's directory usage settings from the directory access plugins (Active directory, LDAPv3, etc).  This will create the edu.mit.kerberos.plist file.

To do that, you can type (replacing odserveraddress.realm.org with the main KDC server's FQDN, and REALM.ORG with the Kerberos realm name):
	
	sudo kerberosautoconfig -r REALM.ORG -m odserveraddress.realm.org

That should create the files needed (edu.mit.kerberos.plist) to let the computer know which realm to connect to (this may be in place already, but won't hurt to run again).

Configuring kerberos using sso_util
-----------------------------------------------------
You will want to use the sso_util to configure services (afp, ftp, etc.) on the server.

Use the "sso_util" program to inform the server of policies for services that you would like to use.  This creates keytab entries on the Master domain server.

	sudo sso_util configure -r REALM.ORG -a admin_of_od_server -p admin_pass all

This will output information regarding the creation of these keys on the server, but mainly, creates the keys on the KDC.

Starting the KDC on Mac OS X, from the command line
--------------------------------------------------------------
Then, you need to setup the KDC on the xserve (this will start the KDC, or key distribution center).

Type (substituting your admin name in place of administrator_of_local_server and the password for admin_password):

	sudo kdcsetup -w -a admin_of_local_server -p admin_password REALM.ORG

Once this command goes through, the KDC should show as running in your Open Directory section of Server Admin.

This will output information when the commands are run.  

This will make the machine connect to the active directory system, attempt to create the necessary keys on that server, and start the KDC on your Mac OS X Server.  At this point, you should be able to ssh into the new server from a machine that was previously authenticated (ticketed) to the Master directory server without having to authenticate a second time.

Removing the KDC
-------------------------------------------------------------------
If you ever have problems when using these commands to create config files, and start the KDC, you can tear the KDC down with the following commands:

	sudo sso_util remove -k -d
	sudo rm -rf /var/db/krb5kdc
	sudo rm -rf /etc/krb5.keytab
	sudo rm -rf /Library/Preferences/edu.mit.Kerberos

-----------------------------------------------------------------------
Kerberos_Connected_Config.rtf
http://www.kelleycomputing.net/documents/Kerberos_Connected_Config.rtf