Hacker News Reader

I don't know any enterprise installations of Mac OS X Server that use AFP.

As for kerberos, that is painful on any platform. At the moment at work I am trying to figure out why Mac OS X takes 10 minutes to connect to a Windows Server 2003 based file share, all I see with Wireshark is a bunch of Kerberos stuff being thrown around, whereas Windows clients connect without issues, but without ever attempting to use Kerberos.

View on HN

your Windows clients are probably using NTLM (or NTLMv2), Microsoft's old, terrible auth protocol that the Windows team eventually abandoned for Kerberos. there are policy settings you can change to force Kerberos; I'd suggest Googling to see if you can find them, and see if it breaks your Windows clients as bad as your OS X clients seem to be.

I had not thought about that, would OS X fall back to using that in case Kerberos doesn't function? Thanks for the suggestion!

You should also check the clocks on all the machines involved. Kerberos is quite finicky when the time between machines starts drifting.

quite possibly. I'm not terribly familiar with Kerberos as a protocol, but I know I've definitely seen Kerberos login misbehave in a way that caused it to take multiple minutes and then time out.

anyway, hope you figure out the problem. :)

Reply on news.ycombinator.com