Apple Mac OS X Server (Administrator’s Guide) - Manual (Page 200)

200 Chapter 3
4 On Mac OS X Server, place the edu.mit.Kerberos configuration file in /Library/Preferences/.
This file is not sensitive, so it can be placed on a guest-accessible volume.
This file must also reside in /Library/Preferences/ in the home directory of users you want to
authenticate using Kerberos.
5 Enable individual services (mail, AFP, and FTP) and clients (login window, AFP client, mail
client) to support Kerberos authentication.
6 Make sure that users you want authenticated using Kerberos are in the search path of the
server hosting the Kerberized services.
Enabling Kerberos Authentication for Mail
Use Server Settings to enable mail server support for Kerberos. See “Requiring or Allowing
Kerberos Authentication” on page 381 for details.
To enable mail client support, set up Mac OS X Mail application account preferences to use
Kerberos V5 authentication. Also make sure that edu.mit.Kerberos resides in /Library/
Preferences/ on the user’s computer.
Enabling Kerberos Authentication for AFP
Use Server Settings to enable AFP server support for Kerberos. See Chapter 5, “File Services,”
for details.
AFP client has no special requirements beyond access to /Library/Preferences/
edu.mit.Kerberos.
Enabling Kerberos Authentication for FTP
Use Server Settings to enable FTP server support for Kerberos. See Chapter 5, “File Services,”
for details.
Enabling Kerberos Authentication for Login Window
In addition to access to /Library/Preferences/edu.mit.Kerberos, login window depends on
these settings in /etc/authorization:
system.login.done
eval
switch_to_user,krb5auth:login