MacBooks bound to Active Directory cannot install software within Self Service

[cgordy]

Discovered a problem in our environment that has us stumped.
When a macbook is bound to our Active Directory, and I create a policy to install....say, Firefox - the install fails.
Error reported to the JSS is once the share mounts, the package is not found.

History - users are logging onto the macs as standard users and using their active directory credentials.
Their Home Directory maps fine - in every sense the mac talking to AD seems to be just fine.

I can use Casper Remote to install Firefox just fine, so I know the package works.

I can verify the policy works if I scope to a non-active directory macbook and run as standard user from Self Service.

It is not just Firefox, it is everything scoped to Self Service and only on AD bound macs.

here's what we have checked/done:
Permissions. Yes, all domain users have Read access to the CasperShare.
Rebuilt the DP - and rebuilt permissions.
Upgraded from 8.71 to 9.01

Our DP is the Master and the only one we currently have.
It is setup to do afp.
We tried adding https, then enabled webservices via ServerApp on the server and still no dice - actually, that broke everything, even non-domain bound macbooks...so I undid that change pretty quick.

here's the kicker - once I rebuilt the CasperShare, I was able to make Firefox install once, just once, via a standard user logged in with AD credentials using Self Service. I thought the rebuilding of the DP fixed it, but I only had success once and I have tried all morning to reproduce the success over multiple machines...even re-imaged the one it worked on and now it too refuses to cooperate and they fail.

Log file is as shown:
Executing Policy Install Firefox NEW POLICY...
[STEP 1 of 3]
Mounting 10.99.6.136 to /Volumes/CasperShare...
[STEP 2 of 3]
Error: The package (Firefox.dmg) could not be found.
[STEP 3 of 3]
Running Recon...
Retrieving inventory preferences from https://jss.dps61.org:8443/...
Locating accounts...
Searching path: /Applications
Gathering application usage information...
Locating printers...
Locating software updates...

[hkim]

I've run into this in the past, and the problem was that my DP that was bound also to AD as well as clients, which means that Kerberos kicks in, thus the Mac is going to use Kerberized credentials versus the local read only account, which is what Self Service is looking for.

[cgordy]

what was your solution? build a secondary DP that was not bound to AD?

[bentoms]

For us we moved to HTTPS DP's.

[cgordy]

I built up a secondary DP that was not on my domain - same error.
I enabled it to be HTTPS, turned on the Website service in Server and it still errors out - however the error is different for HTTPS - it says,
Could not connect to the HTTP server to download Firefox.dmg

[bentoms]

Sorry just read your initial post, do you have multiple DP's? Has this DP been fully replicated from the master?

(Ignore the HTTPS for now).

[cgordy]

we have only been running one DP for the past few years.
This secondary one I just built - yea, casperadmin says replication was complete, and it took a few minutes.
My content is less than 50gigs and I was surprised to find replication only made an XML file in that share...unless that is what's wrong.

[bentoms]

Yep sounds massively wrong.

You should see a complete replica of the CasperShare as per your Master.

What version of the JSS is this btw? What OS is the DP & Master?

[cgordy]

been running 8.71 when I discovered this little nugget problem with my AD bound devices.
I rebuilt my master DP share this morning - that did make it work once on a client, but I have not been able to reproduce it. Upgraded to 9.01 shortly thereafter.
MacOS Server 10.8.4 on both the master DP (that has the JSS installed) and the secondary DP I built today.
I'll go checkout that replication again...see if I can get it to populate with something other than the XML file.

[cgordy]

ok, the replication was my goof - it was all there, but in my haste, I pointed my JSS to the wrong folder. Doh. :-)
Fixed that - I see all my cloned contents..and now - I can install Firefox from the failover DP.

hkim is on to something, but I don't understand what he means.
My master DP is bound to my domain, the secondary DP is not.
Running Firefox from either Terminal with a trigger policy or from self service now works thanks to my secondary DP...but it still generates a error since it failed on the Master DP:

Actions from policy log: Executing Policy Install Firefox... [STEP 1 of 3] Mounting 10.99.6.136 to /Volumes/CasperShare... [STEP 2 of 3] Error: The package (Firefox.dmg) could not be found. Retrying using distribution point 10.99.4.2... Mounting 10.99.4.2 to /Volumes/CasperShare2... Installing Firefox.dmg... Filling User Home Directories from /Volumes/Firefox/Users/test... Filling User Templates from /Volumes/Firefox/Users/test... Closing package... [STEP 3 of 3] Running Recon... Retrieving inventory preferences from https://jss.dps61.org:8443/... Locating accounts... Searching path: /Applications Gathering application usage information... Locating printers... Locating software updates...

If I can get my master DP issue resolved...that'd be greaaat.

[bentoms]

Give all domain users read access to the Master DP.

[cgordy]

^^I did that already, unless I am doing it wrong.

From the Server app on my master Dp, I go to File Sharing and added my share point.
From there, I double-click my share, the Access pane appears and I add permissions to the users/groups I desire.
Domain Users have read access.

I even went as far as going to the share itself, Get Info, and modified the permissions there to include all content of the share just to be sure.

[hkim]

The GUI is lying or Domain Users isn't the group we need here. Check the ACLs, do a ls -le inside of your CasperShare and see what it really is set to.

Try to mount the DP from Go - Connect to Server, and see what the permissions really are from the computer in question that's giving you trouble.

[cgordy]

^^ahhh...I did the Connect to Server from the mis-behaving client and I got in, but no permissions to read the contents.
Interesting...now to go poking around and see why Domain Users did not do what it should have done.

[cgordy]

We did get HTTP to work on the Master DP btw.
I enabled HTTP for port 80 for my master dp in the JSS.
I turned on Websites in the Server app.
There was a terminal command that once I ran it - made it work.

sudo ln -s /Volumes/MacintoshHD/Shared Items/CasperShare/ /Library/Server/Web/Data/Sites/Default/CasperShare

from there, a test on my mis-behaving client was to do:
http://myjssIP/CasperShare/Packages/yourpackagename.dmg

fixed.
still don't understand why permissions are whacked and not working for Domain Users though.
Least I have a workaround.

[bentoms]

Glad you got it sorted.

FWIW, I moved to HTTPS too.

You now get resumable downloads for yours troubles too.

[cgordy]

well jeez - it broke already.
Clients can't connect to the HTTP server.

[cgordy]

so, discovered as I troubleshoot this that within the Server App on the mac mini, with Websites enabled, I cannot click the link to 'View Server Website'.
When I do, Safari launches and it says it cannot connect to the server.