AFS and Kerberos 5 client on Mac OSX


The raccomended AFS client fo MacOS X is now the Auristor client, available for all the latest MacOSX releases
and compatible both with OpenAFS and Auristor file system.

So start by dowloading the installation dmg packet from:
https://www.auristor.com/filesystem/client-installer/

Current versions of MacOSX support natively Kerberos 5 MIT and the configuration file must have the name edu.mit.Kerberos.  The file must be placed or in the root directory /Library/Preferences/ or in the user HOME directory  ~/Library/Preferences/
A copy of the file with the settings for the correspondig ENEAGRID siste can be downloaded from the following links (ENEAGRID credential authentican is required):

Brindisi
Casaccia
Frascati
Portici
Trisaia

The downloaded file has the suffix .txt that must be removed so that the file name is just edu.mit.Kerberos.

At this point double-click on the downloaded Auristor dmg packet icon and then on the Auristor-Lite.pkg icon.
Authenticate as admin user and select as usually the  "Continue" tabs. When required provide the local cell name "enea.it" and proceed in the installation phase. When completed either reboot the Mac or open System Preferences, click Auristor pane and click "Start".

The configuration files of the Auristor client are in the directory /etc/yfs.


Getting Ticket and token for enea.it AFS cell


In a Terminal window to get a Kerberos 5 ticket and an AFS tokens for an ENEAGRID user:

  1. kinit <my_userid>@ENEA.IT  [@ENEA.IT can be omitted, as the defaut realm defined in the krb5.conf file].
  2. aklog
  3. klist; tokens  [to verify the obtained ticket & token]

It has been noticed that aklog provides the token after a long delay ( 30 s or more ) for enea.it AFS cell. This delay can be reduced substantially  if the file /etc/yfs/cellservdb.conf is edited to reduce the number of referenced ENEA dbservers, according to the site where the user is located. The most reliable solution is to keep only the Frascati dbservers expecially for client outside ENEA network. A copy of the Frascati cellservdb.conf  file can be downloaded here. A reboot is required after having modified the file.

Getting Ticket and token for fusione.it AFS cell


With the provided edu.mit.Kerberos file it is also possible to obtain a ticket and a tokens on AFS cell fusione.it,
For users defined in the FUSIONE.IT realm:

  1. kinit <my_userid_in-cell-fusione.it>@FUSIONE.IT
  2. aklog -c fusione.it -k FUSIONE.IT

Passwordless ssh connection to an ENEAGRID node


When Kerberos 5 has been properly configured it is possibile too acquire a Kerberos 5 ticket in the local system and use it to open a remote ssh session to an ENEAGRID node without having to provide the password. The local ssh client configuration file  /private/etc/ssh/ssh_config must be configured as following:  
  1. GSSAPIAuthentication yes
  2. GSSAPIDelegateCredentials yes


How to verify the type of AFS token: user based or PAG based?


In MacOSx al tokens are user based, so all the user processes share the same token.

References

http://computing.help.inf.ed.ac.uk/afs-mac-os-x