I have "most" of this functioning. When logged in as a local user, users can kinit with LDAP username in terminal and pull a ticket.

BUT - I have two issues (and they appear to actually be the same issue).

User authenticates to LDAP at login screen. Password is accepted, opens to blank desktop. And after that - the user cannot do a thing (my assumption is that we are waiting for the homedirectory to be created.)

My observation is that no home directory is created.

When I run createhomedir, I get errors:

grant@iotrashcan02:/Users[20161214-10:09][#23]% sudo createhomedir -c -a -n /LDAPv3/ef-idm01.production.efilm.com
creating home directories for (iotrashcan02.production.efilm.com)
Entity: line 1: parser error : Document is empty
/Users/hayesl
^
Entity: line 1: parser error : Document is empty
/Users/user1
^
Entity: line 1: parser error : Document is empty
/Users/user3
^
Entity: line 1: parser error : Document is empty
/Users/user4
^
[more lines like this for all users the directory]
grant@iotrashcan02:/Users[20161214-10:10][#24]%

I tried again - run after kinit - same results.

Seems like I'm missing an LDAP mapping. Since I pull tickets, I have decent certainty the kerberos configuration is correct.

mappings follow:

grant@iotrashcan02:/Users[20161214-10:25][#29]% sudo odutil show nodenames
Nodenames:

Name State Refs Type External Locked Hidden

---

/Active Directory Online 1 X X
/Configure Online 1 X X
/Contacts Online 3
/LDAPv3 Online 2 X X
/LDAPv3/ef-idm01.production.efilm.com Online 7
/Local 2 X X
/Local/Default Online 27 X
/NIS 1 X X
/Search Online 16

grant@iotrashcan02:/Users[20161214-10:26][#30]% sudo odutil show configuration /LDAPv3/ef-idm01.production.efilm.com
{
description = "ef-idm.production.efilm.com";
mappings = {
attributes = (
objectClass
);
function = "ldap:translate_recordtype";
recordtypes = {
"dsRecTypeStandard:Groups" = {
attributetypes = {
"dsAttrTypeStandard:PrimaryGroupID" = {
native = gidNumber;
};
"dsAttrTypeStandard:RecordName" = {
native = cn;
};
};
info = {
"Group Object Classes" = OR;
"Object Classes" = (
posixgroup
);
"Search Base" = "cn=groups,cn=accounts,dc=production,dc=efilm,dc=com";
};
};
"dsRecTypeStandard:Users" = {
attributetypes = {
"dsAttrTypeStandard:AuthenticationAuthority" = {
native = uid;
};
"dsAttrTypeStandard:HomeDirectory" = {
native = "#/Users/$uid$";
};
"dsAttrTypeStandard:NFSHomeDirectory" = {
native = "#/Users/$uid$";
};
"dsAttrTypeStandard:PrimaryGroupID" = {
native = gidNumber;
};
"dsAttrTypeStandard:RealName" = {
native = cn;
};
"dsAttrTypeStandard:RecordName" = {
native = uid;
};
"dsAttrTypeStandard:UniqueID" = {
native = uidNumber;
};
"dsAttrTypeStandard:UserShell" = {
native = loginShell;
};
};
info = {
"Group Object Classes" = OR;
"Object Classes" = (
inetOrgPerson
);
"Search Base" = "dc=production,dc=efilm,dc=com";
};
};
};
template = LDAPv3;
};
"module options" = {
AppleODClient = {
"Server Mappings" = 0;
};
ldap = {
"Denied SASL Methods" = (
"DIGEST-MD5"
);
"LDAP Referrals" = 0;
"Use DNS replicas" = 0;
};
};
"node name" = "ef-idm01.production.efilm.com";
options = {
"connection idle disconnect" = 60;
"connection setup timeout" = 10;
destination = {
host = "ef-idm01.production.efilm.com";
other = ldap;
port = 389;
};
"man-in-the-middle" = 0;
"no cleartext authentication" = 0;
"packet encryption" = 1;
"packet signing" = 1;
"query timeout" = 10;
};
template = LDAPv3;
trusttype = anonymous;
uuid = "7K9D24A2-21CJ-413F-BADE-B795F7EB5912";
}
grant@iotrashcan02:/Users[20161214-10:27][#31]%

I looked for breadcrumbs in the syslog and opendirectory logs. These are quiet - nothing.
I did a dscl read comparing a /Local/Default to LDAP. There are of course more items in the LDAP read, but I appear to have mapped each relevant item (those matching the local listing).

I have many linux hosts bound to this, but os-x is giving me a hard time. What did I miss?