[OpenAFS] aklog: a pioctl failed while setting tokens for cell

[Benjamin Kaduk]

95%+ of the time, "pioctl failed" means "the kernel module is not loaded".
So I would check the Console.app logs for any failures in that vein (I
don't use a mac client, so can't advise on what logs are relevant).

-Ben

On Thu, Jul 25, 2019 at 07:51:41PM +0000, Marcio Barbosa wrote:
> Hello,
>=20
> One of my VMs is running macOS 10.13.6 (including this security update) a=
nd could not reproduce this problem.
> But I am running the OpenAFS-1.8.2 client with MIT Kerberos.
>=20
> Best,
> Marcio Barbosa.
>=20
> > On Jul 25, 2019, at 6:04 AM, Jan Posp=C3=AD=C5=A1il <honik@kma.zcu.cz> =
wrote:
> >=20
> > Hello,
> >=20
> > I have macOS 10.13.6 (High Sierra) with just installed Security Update =
2019-004 and after the update I have problems getting tokens, I am using ak=
log, see the pioctl error below. I have tried to reinstall AuriStor-client-=
0.188-HighSierra.dmg, but it did not help. The sequence of commands:
> >=20
> > $ kinit=20
> > honik@ZCU.CZ's password:
> >=20
> > $ klist -f
> > Credentials cache: API:0989E00B-F996-422A-A9E9-7AAC921E5CEA
> >       Principal: honik@ZCU.CZ
> >=20
> > Issued                Expires             Flags    Principal
> > Jul 24 11:22:54 2019  Jul 24 21:22:50 2019  FIA    krbtgt/ZCU.CZ@ZCU.CZ
> >=20
> > $ aklog -d
> > Authenticating to cell zcu.cz.
> > =3D=3D=3D=3D=3D=3D=3D=3D Auristor rxgk =3D=3D=3D=3D=3D=3D=3D=3D
> > GSSAPI Error [851968:2529638919]
> > Miscellaneous failure (see text)
> > Matching credential (yfs-rxgk/_afs.zcu.cz@ZCU.CZ) not found
> > -------- failed --------
> > =3D=3D=3D=3D=3D=3D=3D=3D rxkad =3D=3D=3D=3D=3D=3D=3D=3D
> > Trying to authenticate to user's realm ZCU.CZ.
> > Using Kerberos V5 ticket natively
> > -------- succeeded --------
> > aklog: a pioctl failed while setting tokens for cell zcu.cz
> >=20
> > $ klist -f
> > Credentials cache: API:0989E00B-F996-422A-A9E9-7AAC921E5CEA
> >       Principal: honik@ZCU.CZ
> >=20
> > Issued                Expires             Flags    Principal
> > Jul 24 11:22:54 2019  Jul 24 21:22:50 2019  FIA    krbtgt/ZCU.CZ@ZCU.CZ
> > Jul 24 11:24:15 2019  Jul 24 21:22:50 2019  FA     afs/zcu.cz@ZCU.CZ
> >=20
> > $ tokens -debug
> >=20
> > Tokens held by the Cache Manager:
> >=20
> >  --End of list=E2=80=94
> >=20
> >=20
> > Surprisingly, on another computer with the same setting (same macOS and=
 client version), the aklog works as expected (the GSSAPI error is probably=
 not the problem):
> >=20
> > $ aklog -d
> > Authenticating to cell zcu.cz.
> > =3D=3D=3D=3D=3D=3D=3D=3D Auristor rxgk =3D=3D=3D=3D=3D=3D=3D=3D
> > GSSAPI Error [851968:2529638919]
> > Miscellaneous failure (see text)
> > Matching credential (yfs-rxgk/_afs.zcu.cz@ZCU.CZ) not found
> > -------- failed --------
> > =3D=3D=3D=3D=3D=3D=3D=3D rxkad =3D=3D=3D=3D=3D=3D=3D=3D
> > Trying to authenticate to user's realm ZCU.CZ.
> > Using Kerberos V5 ticket natively
> > -------- succeeded =E2=80=94=E2=80=94=E2=80=94=E2=80=94
> >=20
> > $ tokens
> >=20
> > Tokens held by the Cache Manager:
> >=20
> > User's (AFS ID 6141) rxkad tokens for zcu.cz [Expires Jul 24 21:37]
> >  --End of list--
> >=20
> >=20
> > Please could someone give me a hint how to investigate further what cou=
ld cause the problem?
> >=20
> > Thank you in advance.
> > With best regards
> > Jan
> >=20
> >=20
> > --
> > Jan Pospisil, Ph.D.			e-mail: honik@kma.zcu.cz
> > University of West Bohemia	phone:  (+420) 37763-2675
> > Department of Mathematics	fax:    (+420) 37763-2602
> > Plzen, Czech Republic		address: Univerzitni 22, 306 14
> >=20
> >=20
> > _______________________________________________
> > OpenAFS-info mailing list
> > OpenAFS-info@openafs.org
> > https://lists.openafs.org/mailman/listinfo/openafs-info
>=20
> =03=EF=BF=BDzp=05J)=DF=A2f=EF=BF=BD=EF=BF=BD)=EF=BF=BD+-:=EF=BF=BD=EF=BF=
=BD