1

Background: I would like to use Google Apps Directory Sync (GADS) to synchronize user accounts and passwords from a Mac OS X Server (10.9) running Open Directory. GADS is installed on a Ubuntu 12.04 LTS virtual machine and configured, successfully, to sync the user accounts from the Mac OS X Server to Google Apps. However, I am realizing it appears that it may not be possible to sync the users password from Open Directory.

For password synchronization GADS requires the following: Password Attribute, Password Timestamp Attribute, and Password Encryption Method. The supported Encryption Methods are: SHA1, MD5, Base64, Plaintext.

I was examining the Open Directory LDAP schema using JXplorer and noticed a reference to the authAuthority (Authentication Authority). There are two LDAP attributes labeled authAuthority - one contains a value for Kerberosv5 and the other for ApplePasswordServer.

From my understanding of the Open Directory Administrators Guide: Unlike some other LDAP directories, OS X doesn't store a password inside the LDAP record - it uses an "SASL" mechanism - it queries to the "AuthenticationAuthority" attribute to determine the location where the user password can be retrieved.

Can anyone confirm my assessment? Additionally, if this is the case, can you confirm that this would preclude me from using GADS based on its requirements? There is also a "userPassword" attribute that has a value: (non string data). What might this be?

Improve this question

2 Answers 2

Reset to default
3

I am not sure how this works with newer OS X server variants, but at least up to 10.6 this was correct. They were using a special password server that had an encrypted database of passwords in various hash formats that could be queried by all types of services (some of them specifically modified to do this, e.g. Apples Samba server) but it was impossible to get the passwords out of it, e.g. to migrate away to an "standard" OpenLDAP server.

As far as I know they just dumbed OS X server down a lot in later versions, but the essential structure remained the same.

I can't say anything about that might relate to GADS though.

Improve this answer
1
  • 1
    This is still essentially correct -- the authentication system changed significantly between 10.6 and 10.7 (the database format changed, and they moved from MIT's implementation of Kerberos to Heimdal), but the basics haven't changed. (Also, while the admin UI has been dumbed down a lot, the actual services are just as complex as ever.) However... the auth database does store passwords in recoverable format in order to support WebDAV Digest and APOP authentication, but I don't know of anyone who's figured out how to recover them.
    – Gordon Davisson
    Nov 20, 2013 at 6:06
0

Randy Saeks documented how he was able to use Open Directory logins and passwords with a Google Apps for Education deployment. His integration guide is available as a PDF from here:

http://rsaeks.wordpress.com/papers-and-presentations/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .