Following up from my previous post. After doing some (a lot of) reading about Heimdal Kerberos, reports on the #MacAdmin Slack and a lot of trial and error here is what I have discovered. The problem is definitely being caused by the credentials cache, more specifically the Heimdal
kcm (credential cache server) and seems limited to machines bound to a directory (possibly only Active Directory) before Security Update 2021-004 got installed. It may also affect machines bound after the Security Update but I have not tested that. I have not yet figured out exactly what is happening but the end result is that updated machines are no longer able to access the credential cache; which consequently prevents any ticket action from taking place. I could only find two lines of interest form the logs and you can see that they relate directly to cache config:
View attachment 1782147
The fix (well, really just a stop-gap measure until I can discover the actual cause) is to basically tell the OS to ignore cached Kerberos credentials for authorization (as well as screensaver). A shout out to
@jojo on #MacAdmins for confirming my suspicions. To do this you will need to edit two system files (yours should look similar to these):
Code:
/etc/pam.d/authorization
# authorization: auth account
auth optional pam_krb5.so use_first_pass use_kcminit
auth optional pam_ntlm.so use_first_pass
auth required pam_opendirectory.so use_first_pass nullok
account required pam_opendirectory.so
/etc/pam.d/screensaver
# screensaver: auth account
auth optional pam_krb5.so use_first_pass use_kcminit
auth required pam_opendirectory.so use_first_pass nullok
account required pam_opendirectory.so
account sufficient pam_self.so
account required pam_group.so no_warn group=admin,wheel fail_safe
account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe
Using your favorite text editor (sudo) remove
use_kcminit from each file.
For good measure I also killed related processes:
Code:
sudo pkill coreauthd
sudo pkill kcm
sudo pkill kdc
In my testing this does not prevent remote users (those without connectivity to the domain controller) from logging into/unlocking their machines but I urge you to do your own testing before rolling it out.
I've also written a no-frills script to make it easy to deploy to users:
Bash:
#!/bin/bash
sed -i '' "s/use_kcminit//" "/etc/pam.d/authorization"
sed -i '' "s/use_kcminit//" "/etc/pam.d/screensaver"
pkill coreauthd
pkill kcm
pkill kdc
