If you’re doing a quick-n-dirty deployment of a few Macs, and instead of building a real SOE, you just build one machine and image it to the others, you can easily end up in a situation where you can only bind one of these machines to Open Directory, as they all have an identical Kerberos identity. Fortunately it’s pretty easy to reinitialise the Kerberos database on a Mac - simply follow these steps: In the Utilities folder, open Keychain Access. In the System keychain, find and delete the three com.apple.kerberos.kdc entries - a certificate and a public/private key pair generated from that certificate.
- In Terminal, run ‘sudo rm -fr /var/db/krb5kdc’ - this will destroy the local KDC database.
- In Terminal, run ‘sudo /usr/libexec/configureLocalKDC’ - this will regenerate the local KDC database, including a new certificate and SHA1 hash.
- Bind the machine to OD.