For a long time, we have used Active Directory binding to connect our family’s Mac computers to an Active Directory server (Windows Server 2022) for authentication. The Active Directory server historically has provided a single source of truth for passwords for computer logins, file shares from a Synology NAS, and then connects to Authentik for SSO for various services (Linkding, Paperless, etc.).
The mobile accounts on macOS have worked okay, but not great, for the last fifteen years; annoyingly, users would often have to re-enter their password to re-authenticate to a file share. With Apple’s push to use local accounts, I am struggling to get a setup working to use local accounts that connect to the Synology shares with the same ease that happens on Windows (go to the P: or U: drives and your files are there, every time). In our network, the Windows clients (both native and virtual machines), can map the shares to drive letters and access files without issue.
What I want:
For a macOS user to be able to connect to a file share without a prompt for a password or the connection failing for an authentication reason (even with bound Macs and mobile accounts, it seems like we would get authentication failures if a Mac was off or away from the network for a few days).
Things I have tried:
- Using Network Share Mounter: this seemed to work okay with mobile accounts, but the Kerberos SSO would not work on a Mac that was not bound to AD
- Using Apple’s Kerberos SSO Extension: I spun up a Fleet server and configured a profile to deploy the SSO extension. The profile successfully deployed and Kerberos tickets were pulled from AD, but the users could not mount shares without again providing their username and password
- Straight Kerberos: I created an /etc/krb5.conf file and loaded my settings and then used kinit or Ticket Viewer to pull tickets; the tickets were successfully pulled, but again the users could not mount shares without providing a username and password. Interestingly, or maybe suspiciously, setting the ticket_lifetime to 24h in the configuration file was not respected, the tickets were always pulled with 10 hour lifetimes.
It is possible that there is a misalignment or misconfiguration in the Active Directory, Synology/Samba, or MacOS settings, but I am now at a loss for what to try next. As a fan of Apple and Mac in general, it is frustrating that in this one way (mounting shares automagically), Windows does seem to have an edge.
The only other complication that may be throwing things off is the Active Directory / Kerberos realm is ad.domain.com whereas the Synology server is files.domain.com. In all of the profile and krb5.conf settings, I have used the domain realm mapping to
set the realm for both ad.domain.com and domain.com.
Any thoughts/guidance/etc. would be much appreciated.
Thanks!
