Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been playing with Apple's Xgrid a bit lately and was hoping to find a means of using multiple agents, running tasks as an authenticated user, without having to run OS X Server on the controller.

The only way to do this is via the single-sign-on authentication option for both Xgrid controllers and agents, implemented via Kerberos in conjunction with the following packages:


(some opensource available via )

I'm a bit rusty on Kerberos. Before I go down that route, or build a VM running Linux + OpenLDAP + KDC, has anyone successfully gotten SSO to work without OS X Server?

share|improve this question

I'm sure you could hack it somehow, but it's probably not worth the effort. OpenDirectory is dead simple to configure and will work with everything Mac out of the box. You can buy a Mac Mini with Snow Leopard Server for $999 and be up and running within an hour.

If you're really strapped for cash, then you should go the Kerberos + LDAP route with a Linux server. It should work just as well, but you will lose some OpenDirectory features such as client management. A limited number of services work with PAM, but most do not use it and authenticate against a directory (read: Kerberos) directly.

Pretty much everything in the Mac ecosystem relies on Kerberos for SSO, so you should get familiar with it. I recommend Kerberos: The Definitive Guide for an overview of the concepts.

share|improve this answer
+1 for using OS X server. Getting Kerberos up & running is not trivial. – duffbeer703 Nov 28 '09 at 19:13
Thanks for the thought. An OS X Server VM would also suffice, as it is only handling authentication. However, the goal would be to implement this in a number of small labs which are already either integrated with Linux or MS AD, making OS X Server redundant and the cost difficult to justify for xgrid alone. – ives Nov 30 '09 at 11:49
If you already have AD integration, you should already have Kerberos in place, so I don't see the problem there? Also, if you have several small labs, are they all connected to a central domain, or independent? In any case, for the Linux scenario you can just run OpenLDAP and the MIT Kerberos distribution and you should be fine there as well. – Kamil Kisiel Nov 30 '09 at 16:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.