Skip to main content
Question

Kerberos SSO Not Syncing Password after Change

thatsadingo
Forum|alt.badge.img+3

Hello everyone. We recently setup Kerberos SSO and are having some issues with it syncing passwords after a password change. Upon initial setup it works as intended. User logs in with their AD credentials, it asks for their AD password and their Mac password, it then syncs the password to match the AD password. However, when a user changes their password, they are able to log into SSO with their new password, but it never prompts to sync the mismatched passwords, so their computer still uses their old password. 

Has anyone run into this issue? 

Password sync is enabled and the system currently running into this issue is running 10.15.2

    9 replies

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3532 replies
    • January 9, 2025

    @thatsadingo I'm reading your question as when a user's AD password is changed external to the Mac it's not detecting that the Mac's password needs to be synchronized with their new AD password. If that's correct does having the user change their AD password on the Mac using the Kerberos SSO tool work?

    thatsadingo
    Forum|alt.badge.img+3
    • thatsadingo
    • Author
    • New Contributor
    • 6 replies
    • January 9, 2025

    You are reading it correctly. Unfortunately, the only way for our users to change their account is through our website. So, I wouldn't be able to test through the SSO tool.

    AJPinto
    Forum|alt.badge.img+26
    • AJPinto
    • Legendary Contributor
    • 2710 replies
    • January 9, 2025

    Is local password sync Enabled? Also just to ask, the user(s) does not have a mobile account, right?

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3532 replies
    • January 9, 2025
    thatsadingo wrote:

    You are reading it correctly. Unfortunately, the only way for our users to change their account is through our website. So, I wouldn't be able to test through the SSO tool.


    @thatsadingo Is the web site for password change the same for your Windows users, or just for your Mac users? You might want to revisit that once you have Kerberos SSO working.

    And can you post an image of your Kerberos SSO configuration (obscure your Realm and Hosts settings please)

    @AJPinto The Jamf GUI for configuring Kerberos SSO clearly states local password sync doesn't work for mobile accounts so that shouldn't surprise anyone.

    AJPinto
    Forum|alt.badge.img+26
    • AJPinto
    • Legendary Contributor
    • 2710 replies
    • January 10, 2025
    sdagley wrote:

    @thatsadingo Is the web site for password change the same for your Windows users, or just for your Mac users? You might want to revisit that once you have Kerberos SSO working.

    And can you post an image of your Kerberos SSO configuration (obscure your Realm and Hosts settings please)

    @AJPinto The Jamf GUI for configuring Kerberos SSO clearly states local password sync doesn't work for mobile accounts so that shouldn't surprise anyone.


    @AJPinto The Jamf GUI for configuring Kerberos SSO clearly states local password sync doesn't work for mobile accounts so that shouldn't surprise anyone.

    Fair, but I have learned to not assume people actually read. Reddit has killed my faith in humanity :).

    thatsadingo
    Forum|alt.badge.img+3
    • thatsadingo
    • Author
    • New Contributor
    • 6 replies
    • January 10, 2025
    sdagley wrote:

    @thatsadingo Is the web site for password change the same for your Windows users, or just for your Mac users? You might want to revisit that once you have Kerberos SSO working.

    And can you post an image of your Kerberos SSO configuration (obscure your Realm and Hosts settings please)

    @AJPinto The Jamf GUI for configuring Kerberos SSO clearly states local password sync doesn't work for mobile accounts so that shouldn't surprise anyone.


    Here are our settings. The website is the same for everyone. 

    thatsadingo
    Forum|alt.badge.img+3
    • thatsadingo
    • Author
    • New Contributor
    • 6 replies
    • January 10, 2025
    AJPinto wrote:

    Is local password sync Enabled? Also just to ask, the user(s) does not have a mobile account, right?


    Local password sync is enabled, and they are local accounts not mobile. 

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3532 replies
    • January 11, 2025
    thatsadingo wrote:

    Here are our settings. The website is the same for everyone. 


    Try setting the following:

    "Request credential on the next matching Kerberos challenge or network state change" - Enforced

    "Automatically use LDAP and DNS to determine the Kerberos extension's AD site name." - Enforce

    "Passwords to meet Active Directory's definition of complexity" - Required (Since you have the Password change option set to Allowed)

    thatsadingo
    Forum|alt.badge.img+3
    • thatsadingo
    • Author
    • New Contributor
    • 6 replies
    • January 16, 2025
    sdagley wrote:

    Try setting the following:

    "Request credential on the next matching Kerberos challenge or network state change" - Enforced

    "Automatically use LDAP and DNS to determine the Kerberos extension's AD site name." - Enforce

    "Passwords to meet Active Directory's definition of complexity" - Required (Since you have the Password change option set to Allowed)


    Thanks for the suggestions. I've enabled those settings and will see what happens. I initially had Passwords to meet AD complexity to enabled, but since clicking change password just takes the user to our site, I turned it off to see if it would potentially do anything. 

    Reply


    Most helpful members this week

    Terms & ConditionsCookie settingsAccessibility statement

    Cookie policy

    We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

     
    Cookie settings