Disable Kerberos / Single Sign-on

Question

We have a Mac mini running OS X 10.7 Server which has a number of shared folders/drives using AFP. We have a user account called fcp setup as sharing only which coworkers use to access the shared files.

Whenever a coworker clicks on the machine in finder we get prompted for a Kerberos password:

We can get around this simply by clicking cancel (and we are then presented with the classic login window), but it confuses people.

How can I disable single signon/kerberos? (or alternatively, would it just be better to configure it properly? and if so what are the benifits since we only use filesharing?)

I assume this is something that comes activated with server because I dont remember anyone ever 'turning it on'

Answer 1

To disable Kerberos, open Terminal at Mac mini and enter the following command:

sudo sso_util remove -k -a username -p password -r YOUR.KERBEROS.REALM

Replace username, password with the user name and password of the Open Directory administrator (user/password with admin rights on Mac mini). It seems that YOUR.KERBEROS.REALM is "LKDC".

The Open Directory Overview pane of Server Admin (at Mac mini) should show the Kerberos service status as stopped.