I have found out more information on the "Permission Denied" problems. It's nothing to do with AD as far as I know, but rather a set of understandable but strange interactions with the cache manager. Conclusion. No problem, just be careful.
Details: (1) If I add a new key to the (1.4.12) fileserver but don't reboot it, but get tokens with aklog, the cache manager accepts the tokens for files already in the cache. (2) Once the fileserver is restarted, then new files can be read. NB: I didn't seem to need a reboot for openafs-1.6.0 server. Nice. I was worried about the security implications of the CM accepting tokens the FS didn't but I was unable to get the 1.6.0 server to behave in this way. I couldn't read ANY files, even those in the cache if the fileserver didn't have the key, and was able to read ALL files, even those NOT in the cache if the fileserver HAD the key. There may be more going on than I know. I was using the same CM throughout. (3) If I contact a DIFFERENT fileserver that doesn't know about the new key, I get an error about tokens being discarded, and the CM rejects uses of the tokens even for files from the fileserver that accepted them. (4) Strangely after the "discard message", "tokens" claims the tokens are still there and "aklog" won't do anything since it says there are duplicate tokens. (5) "aklog -force" does the job and restores the tokens. pabst.cs.uwm.edu% ls ~cs654 afs: Tokens for user of AFS id 920 for cell cs.uwm.edu are discarded (rxkad error=19270408) /afs/cs.uwm.edu/users/classes/cs654 unreadable pabst.cs.uwm.edu% tokens Tokens held by the Cache Manager: User's (AFS ID 920) tokens for a...@cs.uwm.edu [Expires Jan 20 21:09] --End of list-- pabst.cs.uwm.edu% more theory4.txt theory4.txt: Permission denied pabst.cs.uwm.edu% aklog -d Authenticating to cell cs.uwm.edu (server solomons.cs.uwm.edu). We've deduced that we need to authenticate using referrals. Getting tickets: afs/cs.uwm.edu@ Using Kerberos V5 ticket natively Identical tokens already exist; skipping. pabst.cs.uwm.edu% more theory4.txt theory4.txt: Permission denied pabst.cs.uwm.edu% aklog -d -force Authenticating to cell cs.uwm.edu (server solomons.cs.uwm.edu). We've deduced that we need to authenticate using referrals. Getting tickets: afs/cs.uwm.edu@ Using Kerberos V5 ticket natively About to resolve name boyl...@ad.uwm.edu to id in cell cs.uwm.edu. Id 920 Set username to AFS ID 920 Setting tokens. AFS ID 920 / @ AD.UWM.EDU pabst.cs.uwm.edu% more theory4.txt ****************** # 3 ****************** ... _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info