I am attempting to get Macs, running os 10.7.5 Lion, to authenticate using OpenLDAP running on Ubuntu 12.0.4 LTS. One of the things that I would love to be able to do is to use Apple's lovely Directory Utility client to physically edit entries on the LDAP server. I have set up my Root DN as cn=admin,dc=example,dc=com. However, I am unable to authenticate using the DU client to edit the entries stored in the LDAP. I tried using "admin" as a username, and "cn=admin,dc=example,dc=com" as well. Has anyone gotten this to work?
One of the services our IT team occasionally provides is connecting Mac desktops up to our Linux-hosted OpenLDAP server using a simple anonymous bind. Our OpenLDAP server doesn’t have any schema support built in for OS X, but historically we’ve gotten around that by using the RFC 2307 template support built into the LDAPv3 directory service plug-in. When we started deploying Lion, we hit a number of issues with using Directory Utility by itself to connect to OpenLDAP.
A lot of the problem was centered around the fact that Lion’s LDAP plug-in is now attempting to use the best SASL authentication method advertised by the LDAP server. Even if the server doesn’t require authentication, the Mac’s LDAP plug-in will still try to authenticate. What you’ll wind up with is an LDAP bind that allows lookups, but does not allow LDAP accounts to log in.
Most of the fixes I was able to find online involved going into the GUI and making some changes, then opening the relevant plist and making some more changes. Others recommended setting up the bind on one machine and then copying the relevant files from machine to machine.
As part of making OpenLDAP work with our Macs running Lion and later, I wrote a script to automate the bind process and made it available here on GitHub. It was originally written to handle 10.6.x and 10.7.x, but I've been testing it with new OS releases and I've verified that it works (in my shop) for 10.6.x through 10.9.x.
OS X Server uses OpenLDAP as it's LDAP server so the DU utility should be able to administer it. Without more information, we can't really troubleshoot this problem. Most importantly can you administer the LDAP server with Linux tools with the credentials you specified? If not see this guide on how to set the OpenLDAP http://www.howtoforge.com/linux_openldap_setup_server_client