Open Directory is an ldap-based Apple technology that is the centerpiece of its OS X Server product. It manages users, groups, computers, policies, managed settings, authentication and more.
9
votes
1answer
4k views
Why is Mac OSX Lion losing login/network credentials?
Symptoms
At work we have OSX 10.7.3 installed and every once in a while I will see the following behaviors:
If the the screen is locked, then multiple tries of the same user/pass are not accepted.
...
8
votes
3answers
303 views
Join ActiveDirectory (Win 2k8R2) to OpenDirectory(Snow Leopard)
The vast majority of questions and so on regarding the interoperability of Active and Open directories involves getting Mac clients to see an AD and auth against it.
What we'd like to do is get a ...
7
votes
3answers
4k views
How to use Google Apps as an OD/AD/LDAP Provider
I see tons of solutions for allowing Google Apps to use external AD and LDAP services for login.
However, I already have a ton of users setup in Google Apps already, and I'm trying to go the other ...
6
votes
2answers
199 views
Prompt for user group when logging into OSX domain
When a user is a member of more than one group, when logging in to a 10.6 machine, it shows a prompt asking for what group to apply settings for.
We're using the groups to mount different shares, ...
5
votes
3answers
8k views
Does joining a Lion Open Directory with Windows actually work?
According to https://help.apple.com/advancedserveradmin/mac/10.7/#apd52648A71-571A-433C-81A8-2A7792333F22 it's possible to join a Lion Open Directory using a Windows machine, making it think it's ...
4
votes
1answer
1k views
Replication from OSX OpenDirectory to OpenLDAP
I have an OpenDirectory server running on an OSX Server machine, and I'd like to increase the reliability of the service by having a slave server. The problem is, I only have 1 OSX Server but I have ...
4
votes
2answers
786 views
How do I determine if an Apple Open Directory user is disabled via LDAP?
I have an Open Directory user that has the "Access Account" box unchecked in Workgroup Manager so they cannot login. Is there a way to determine this using an LDAP query?
It would also be good to be ...
4
votes
1answer
134 views
What Is The Recommended Way To Backup OS X Open Directory?
We have recently bought a Mac Mini preloaded with Mountain Lion Server to use as an Open Directory master, and I'm not clear on how the data for Open Directory is supposed to be backed up.
We are ...
4
votes
3answers
2k views
Mac OS X Server add server user
What's the recommended way to add a user to Mac OS X Server that doesn't need all the hoopla associated with Workgroup Manager? There are many users pre-configured in Mac OS X Server (www, root, ...
3
votes
4answers
656 views
Easiest option for sharing users across linux machines?
On windows there's active directory.
On Linux there are several options, but what's the dead simplest option to set up? I'd like to manage users and groups centrally, but don't need anything fancy ...
3
votes
3answers
7k views
How can I disable a User Account from the CLI with Mac OS X Server?
Is there any possible solution to disable a User from the CLI e.g. over SSH?
There has to be a dscl command for that. Or is there a dsAttrTypeStandard attribute that I can set accordingly?
Any ...
3
votes
4answers
4k views
OS X Login Authentication Against Leopard Server
I am doing a few tests with OS X Server before I have to do a deploy in a few months. I have configured Open Directory, and created a few users. I've configured Directory Utility on a 10.5 client, ...
3
votes
1answer
157 views
What are the differences in schemas of main directory servers?
Active Directory, OpenLDAP or Apple's Open Directory have different schemas for holding user info and group membership. Having a Open Directory here I can say for example that user's Distinguished ...
3
votes
4answers
6k views
What commands will change Open Directory passwords?
I understand Open Directory to be OpenLDAP + SASL (Password Server) + Kerberos. It appears that OpenLDAP defers to SASL for authentication; I don't know about Kerberos.
I want to change user ...
3
votes
5answers
5k views
Mac OS X Server user unable to log in though log appears fine
Trying to troubleshoot a user who is unable to log into our server from a client. Client is bound to server and other users can authenticate.
ApplePasswordServer.Server.log says the following when ...
3
votes
1answer
1k views
Connecting FreeNAS 8 to Mac OS X Lion LDAP Server
I currently have Mac OS X Lion Server running from a MacMini and want to use it purely as an LDAP server for authentication for FreeNAS 8. I have FreeNAS setup and running on a VM, all features ...
3
votes
1answer
176 views
Lag in MCX (Workgroup Manager) controlled Macs
At the beginning of the day and on semi-random days, some of my Mac users are experiencing heavy lag. For example, 5-10 minutes to login, several minutes for Safari to load, visible delays while ...
3
votes
1answer
490 views
Repercussions of Raising Domain Functional Level to 2008 on Mac computers running 10.6.2 with OD
We have recently replaced all of our 2003 server domain controllers to 2008 r2 and have tried to implement PSO's but have found that the domain functional level must be raised to 2008. We have a mac ...
2
votes
2answers
2k views
How to rebuild/restart kerberos server on Mac 10.6.5 Server
I had DNS trouble which was causing delays for Open Directory users logging in from the GUI on their macs.
I've fixed the DNS problems and the delay still remains.
Is there a way to restart, or ...
2
votes
2answers
203 views
utility native to OS X for administering AD accounts (without “magic triangle”)
EDIT: So far I have explored
Centrify Suite (Spoke with a rep who didnt believe they offered a solution for this)
Thursby ADmitMac (I have seen evidence that a tool exsists, but I'm failing to find ...
2
votes
1answer
116 views
WinXP logins no longer fully functional
Summary:
Users with Roaming Profiles on my XP workstations appear to be unable to do various things, e.g. set a default printer, disable toolbars in IE8, or see icons on the left side of the Start ...
2
votes
1answer
256 views
How can I determine the last time an Open Directory network account was used on Mac OS X 10.7 Server?
How can I determine the last time an Open Directory network account was used? I am completing a user/group audit and am looking to identify users that have not used their network account recently.
2
votes
2answers
332 views
Can't log into OS X Server after restart
Just restarted our Mac OS X Server (Leopard), and we are no longer able to log into the default user account, srvadmin!
This is an open directory account. We are presented with the login screen, but ...
2
votes
1answer
743 views
Correct/Optimized Binding of Open Directory clients?
I have have three locations with an OD Master in our primary location
and OD Replicas in each off-site location. I've always bound clients
to our OD Master because the Open Directory Admin ...
2
votes
1answer
791 views
Windows Server 2008 SBS bind to OS X Server Open Directory
I'm trying to bind Windows 2008 SBS server to OS X Open Directory, but the Change domain button is grayed out with this message:
Note: The identification of the computer cannot be changed because:
- ...
2
votes
3answers
13k views
Listing group members using ldapsearch
Our corporate LDAP directory is housed on a Snow Leopard Server Open Directory setup. I'm trying to use the ldapsearch tool to export an .ldif file to import into another external LDAP server to ...
2
votes
1answer
1k views
Mail Server setup under Mac OS X Server Snow Leopard (10.6)
I'm currently setting up a number of new Xserve boxes running Mac OS X Server Snow Leopard. One of these machines will be replacing our current (ageing) Linux mail server.
The Linux box is running an ...
2
votes
2answers
1k views
Locked out of Snow Leopard Server. How do I get back in?
I have an XServe running Snow Leopard Server (10.6.2). It has some local administrator accounts on it and it is also an OpenDirectory master.
I noticed earlier today that I was not able to login with ...
2
votes
0answers
81 views
SBS 2011 Essentials and too many new Mac users
We currently have about 15 users on a Windows SBS 2011 Essentials Server. I've just been informed that we plan to bring aboard about 15 more users that will be using Macs. We'll be using a Mac ...
2
votes
0answers
255 views
Open directory, external NFS file shares and automounter
This may be a big one.
I've set up Open Directory on Mac OSX 10.8 (Mountain Lion) with users to allow everyone on the network to logon to any client with these centrally stored users.
Before this ...
2
votes
1answer
345 views
Mac OSX 10.7 server with 10.6.8 clients - old network accounts work, now ones created since May do not
I have a Mac OS 10.7 server, and a number of 10.6.8 clients in a school. For the last year and half, network accounts could log into the clients with no problem. There is a set of presets in ...
2
votes
0answers
328 views
Add memberOf attribute to all users in OpenLDAP on OS X Lion Server Open Directory
Our school's website has the ability to pull user authentication from a LDAP source. They "support" and LDAP. Unfortunately, to pull group membership you must have a memberOf attribute in each users' ...
2
votes
0answers
262 views
Why isn't Samba authenticating an Open Directory username that arrives in all caps?
I have a Mac OS X 10.6 server that acts as an Open Directory master and allows file sharing from the Open Directory users' home directories. Today, for unknown reasons, it's stopped permitting our ...
1
vote
2answers
4k views
Unable to remove users in Workgroup Manager, they just keep coming back!
When I try to remove a user in the Workgroup Manager on OS X Server 10.6.2, it looks as though the user is removed correctly at first. But when refreshing, the user pops right back into view without ...
1
vote
1answer
122 views
Making a mac network user administrator
I am attempting to setup an open directory authentication system for a small iMac laboratory.
The open directory authenticates network users properly and allows a login on the Mac system although ...
1
vote
1answer
189 views
Can I use Open Directory with a Leopard client and a Lion server?
I've looked around on the interwebs but I can't find any sort of answer.
I just picked up a Mac Mini and I'm going to throw Lion Server on it for my network.
Most of my computers are running either ...
1
vote
2answers
685 views
Manage same MCX setting on multiple Open Directory Masters
In the school division I work for, we have an Open Directory Master in each of a dozen schools. There are settings I'd like to manage in multiple directories for multiple work or computer groups.
...
1
vote
2answers
2k views
Ubuntu 10.04: Restrict LDAP Access by Group (OpenDirectory on Mac OS X Server)
In a nutshell, I want to authenticate users of a Ubuntu 10.04 Server against a Mac OS X Server's OpenDirectory LDAP but ONLY allow them access if they are a member of a group on the LDAP side.
...
1
vote
2answers
781 views
Open Directory Failover
We have a network based on OSX, including using OpenDirectory as our directory service. Our network consists of one OD master and a pair of OD replicas. We've been trying to set it up so that when the ...
1
vote
1answer
157 views
DirectoryService hogging memory
My DirectoryService memory usage goes as high as 1GB, with nothing interesting happening to cause it to get that high. It is a stock macos server configuration on the mac mini
What is the problem and ...
1
vote
1answer
8k views
How to resolve “HTTP/1.1 403 Forbidden” errors from iCal/CalDAV server after upgrade to Snow Leopard Server?
We recently upgraded our Open Directory Master & Replica to Mac OS X 10.6.4 Snow Leopard Server. We had a mismatched server FQDN & LDAP Search Base/Kerberos Realm, so we exported all users ...
1
vote
2answers
2k views
Snow Leopard Server in 'Magic Triangle' setup not allowing managed preferences in WM to be saved
I have setup a new Snow Leopard Server (10.6.4) in a Magic Triangle setup (Dual Directory Integration), but am not able to manage preferences from within Workgroup Manager and am wondering if I might ...
1
vote
2answers
551 views
How do I force an iCal server to only allow SSL connections?
I have an OS X 10.6 Server running the iCal service. When users on machines that are bound to Open Directory open their iCal client, it automatically configures their connections to the iCal server at ...
1
vote
1answer
624 views
Leopard Server (10.5.8) Screen Sharing with Open Directory Authentication
I have an OS X 10.5.8 Leopard Server that I manage here in the office. Right now it has just the standard VNC single password style of authentication for authenticating for screen sharing. Our ...
1
vote
1answer
456 views
Tiger Client Bound to Leopard Open Directory Server
I am trying to get my tiger clients to bind to an open directory server on leopard.
I am able to bind the computer to the directory and when I look in Workgroup Manager the computer shows up ...
1
vote
1answer
344 views
Why do mcxquery and system profiler sometimes give different results?
When you manage a setting on a mac client through workgroup manager/open directory, you can verify its effect on the client in two ways.
Open a Terminal and run mcxquery
Run System Profiler, and ...
1
vote
1answer
743 views
resolving DNS issues behind firewall on OS X Server
I have a problem that has recently broken single sign-on with our Mac clients (10.5 & 10.6) to an OS X Server (10.5). hosts seem to resolve on clients & server both forward & reverse. ...
1
vote
1answer
452 views
dsimport fails to set GeneratedUID for Computers
I'm populating machines into our Apple OpenDirectory (running on a 10.5 Server).
My script will output a file like this:
0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Computers 6 ...
1
vote
0answers
1k views
Kerberos broken when upgrading Snow Leopard Server to Mountain Lion
I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools ...
1
vote
0answers
166 views
Open Directory authenticated bind succeeds, but creates incomplete record
I have about a dozen Macs running 10.6.7 or 10.6.8, which are all failing to bind properly to my new 10.7.4 Server OD.
I can bind them just fine via Directory Utility or dsconfigldap, and it reports ...
