Classroom and Lab Computing

UDrive Access Change, 8/15/06

This page describes changes that were phased in over the past year that now require changes in how some users access the "UDrive".

Specifically, the change is to require the use of Penn State's MIT Kerberos service, or realm, known as dce.psu.edu, for authentication when accessing the UDrive.  Technical details are here.

Schedule

• 12/15/05 Defined trust with dce.psu.edu; create Kerberos name mappings for all accounts in win.psu.edu.
• 8/15/06 Removed password sync from password change page on www.work.psu.edu.
• 8/21/06 Randomize all Access Account passwords in win.psu.edu.

Affected Users

This change affects those connecting to the "UDrive" with computers that aren't members of a domain with a trust to dce.psu.edu.  That is, you are not logging into dce.psu.edu.   Student computers and most home computers are affected.  Solutions differ by platform.

Windows XP and 2000

You must:

1. Add a registry key and one value to define the dce.psu.edu realm and reboot.
2. Use dce.psu.edu\userid in place of win.psu.edu\userid for the User Name in the Connect As dialog when connecting to the UDrive.

Details are here.

Or you can download and install a new MapUDrive program that will do both of these steps.

Windows 95, 98, ME

These versions of Windows do not support Kerberos and are no longer supported by Microsoft or Penn State.

Macintosh

Revised instructions are here.

Linux

Unfortunately, we don't have a solution enabling Linux to use Kerberos for connecting to our server using Kerberos (but there are many versions of Linux and many efforts in connecting Linux to Windows servers, e.g. Samba 4.).   The previously supported SFTP service for the UDrive doesn't work with a Kerberos "cross realm trust".  Currently Linux users are advised to switch to the PASS Space, which still uses NTLM (for now).  You can go to a CLC Windows computer to move your files.

Unaffected Users

Users of CLC lab and classroom computers have been logging into dce.psu.edu for a couple months and do not need to change anything.  Users of departmental and college computers may now, or soon, be in domain with a trust to the dce.psu.edu Kerberos realm.  People logged on with a dce.psu.edu "ticket" can connect to the UDrive without being prompted for a userid or password.

File Permissions

No changes in file permissions or the procedures for setting file permissions are needed.  When sharing folders and files, the Access Account userid is still given as the user name, and it will be the "shadow" account in win.psu.edu, displayed as userid@win.psu.edu.

VPN

Users on computers outside Penn State's networks will still have to make a VPN connection prior to accessing the UDrive.