Tag Info

Hot answers tagged

8

This is absolutely impossible. Yes, there are means to synchronize between local directory services and Google's directory, but that doesn't mean that you can use Google's directory like AD, OD, or even a simple LDAP service. Now, if all you want is to enable users to be able to use their Google credentials to sign into your application, look into OpenID.


6

Sort of. An Open Directory domain is actually 3 semi-integrated services: LDAPv3 for most data (provided by a fairly standard OpenLDAP server), Kerberosv5 KDC for single-signon authentication (provided by MIT's Kerberos implementation, with a few tweaks), and a SASL-based password server for other types of authentication (provided by something at least ...


5

This works in 10.5 and 10.6 on LDAP/OD accounts: pwpolicy -a diradmin -u ajohnson -setpolicy "isDisabled=1" Or for local accounts: sudo dscl . -create /Users/ajohnson UserShell /usr/bin/false Replace ajohnson with the short username of the user you wish to disable. To re-enable simply set "isDisabled=0" instead of 1. Or in the case of local accounts ...


5

It sounds more likely something may be wrong with your configuration - how did you add the Open Directory server in Directory Utility as what you want is precisely how it is supposed to work. Additionally, before too much else double check your DNS as DNS will cause all sorts of issues with Open Directory. For instructions you can check the docs: Open ...


5

Whether an account is disabled isn't stored in the LDAP database, so you can't get at it with any LDAP query; it's in the password server database, so you need to query the password server. To do this, you first need to get the account's password slot ID, which will be in one of the authAuthority attributes in LDAP, something like this: authAuthority: ...


4

As far as I know, the SMB component in 10.7 is not capable of acting as a Domain Controller in any way, neither NT4 style nor AD. All it can do is act as a SMB2 server. They have discontinued Samba in 10.7 because Samba switched to GLPv3, a license Apple is unable or unwilling to use and instead wrote their own minimal SMB server. As far as I am ...


4

With eyes open, I upgraded from Snow Leopard Server to Lion Server for a client in a mixed environment. I was aware of the lack of domain support under Lion and that Windows machines could not be a part of the Open Directory and that SSO for all windows clients would be gone (which was not a big deal, because I had to configure all windows 7 clients this way ...


4

http://www.nabber.org/projects/oneldap/ provides a backend for OpenLDAP that can at least authenticate users against various services (IMAP, POP, SSH, etc.). It would be possible to write a plugin to use the Google Client Login API directly if you wanted. This solution would at least work for an app that used LDAP for authentication, but is far from a ...


4

You would have to look at documentation from each vendor, and your own internal documentation as well. LDAP schemas can be (and often are) extensively customized to meet local needs. For AD MSDN Topic (includes a list of classes/attributes) For Open Directory/OS X There's a whole sub-chapter on Open Directory LDAP In General This page has a good list ...


3

one possibility is using openldap. here is a how-to to get you started. the how-to is a bit outdated, but it should get you started. perhaps your distro offers some of the needed packages, this would make it much easier. another option is ad. when you already have a windows network with a working ad, you can add your linux servers to the ad. you could use ...


3

I am not sure how this works with newer OS X server variants, but at least up to 10.6 this was correct. They were using a special password server that had an encrypted database of passwords in various hash formats that could be queried by all types of services (some of them specifically modified to do this, e.g. Apples Samba server) but it was impossible to ...


2

We had the exact same problem. I ended up writing a perl script to send the password warning. Essentially you need to use /usr/bin/pwpolicy -getglobalpolicy and compare the maxMinutesUntilChangePassword line against /usr/sbin/mkpassdb -dump <user slot> and the Last password change line. You can get a user's slot from the third field in the ...


2

Well according to this article, what you are doing ought to work. But it is confusing After you set up an Open Directory replica, other computers will connect to it as needed. Computers with v10.3 or v10.4 of Mac OS X or Mac OS X Server maintain a list of Open Directory replicas. If one of these computers can’t contact the Open Directory ...


2

The handiest answer I've come across is to use the passwd command in conjunction with dscl. Here is the output from an interactive session (with the passwords replaced by asterices): $ dscl -u diradmin -p ces Password: > cd /LDAPv3/127.0.0.1/ /LDAPv3/127.0.0.1 > auth diradmin ***** /LDAPv3/127.0.0.1 > passwd Users/Atwo807 ***** ...


2

Macke, I had a similar situation in MacOS X Server 10.5.x. Use a tool like Carbon Copy Cloner and make a good backup of your server. From the Terminal, run: sudo changeip -checkhostname . If that comes back without issue then try Step 2. If not, repair the underlying issues with the servername/DNS issues. In ServerAdmin, in OpenDirectory, run a backup ...


2

I'm suprised that nobody's mentioned NIS yet. It pairs well with NFS. It's easy to set up and you can use the existing passwd file. I wouldn't use it in a hostile environment though.


2

If you are ready to invest a little more effort into it Kerberos is the standard solution and designed to do Authentication/Authorization. Both windows and unix implementations exists and clients are built into most OS. I would consider the effort of setting up Kerberos similar to LDAP/OpenLDAP. If you don't wish to invest that much of an effort and the ...


2

You can add accounts with the dscl command line utility. Depending on where you want to add users (just on that server, or on all machines via OpenDirectory), you can pass an argument to it. For a standard OD, adding a user looks like: dscl -u USERNAME -P Password /LDAPv3/127.0.0.1 -create /Users/USERNAME UniqueID <put unique ID here> For a local ...


2

I work with LDAP, but not that specific brand of server. First thing I'd try is a search on users pulling all of their attributes instead of restricting it the way your example does. ldapsearch -xLLL -H ldap://server.domain.net \ -b "cn=users,dc=server,dc=domain,dc=net" uid=username1 \* + Often there's a "memberOf" attribute on the user that lists ...


2

Take a look at /etc/security/access.conf. Changes to this file will affect anything that uses pam and the pam_access module, and permits you to restrict login by group membership. You can check group membership with 'getent group <group name>'


2

As for me the problem occured when using iCal with Google Calendar when I choosed my @gmail.com address instead of the @googlemail.com address. After removing the calendar from iCal and adding it again with ...@googlemail.com everything works fine.


2

Well, I'll start answering my own question. To get a listing of which nodes have managed preferences on a remote Open Directory Master, you can do something like this: dscl -u DIRADMINUSER -p -url HOST \ list /LDAPv3/127.0.0.1/TYPE MCXSettings \ | cut -d " " -f 1 Substitute in correct values for words in all caps. HOST is an IP or DNS name or ...


2

Here's my best guess. My gut says that the permissions on the registry hives inside the users' roaming user profiles may be munged up. Assuming your users don't have "Administrator" rights, that's where I'd start looking first. Logon as one of your problem users, open regedit, navigate to HKEY_CURRENT_USER, and look at the permissions (Edit / Permissions in ...


2

You need to check status of your OD using changeip command. $ sudo changeip -checkhostname If it reports any problem, backup your OD using Server Admin and follow the result from the command above


2

To stop/start Open Directory: sudo launchctl unload /System/Library/LaunchDaemons/org.openldap.slapd.plist sudo launchctl load /System/Library/LaunchDaemons/org.openldap.slapd.plist To stop/start Kerberos: sudo launchctl unload /System/Library/LaunchDaemons/edu.mit.Kerberos.kadmind.plist sudo launchctl unload ...


2

Am I correct in this assumption or am I doing something wrong while installing Lion? Has anybody ever had success in joining Windows to a Lion Open Directory? Not likely, Lion having only been out for a couple of days as of this posting. I've already had to dissuade some of my users from upgrading due to critical incompatibilities. As for Open ...


2

I've not tested Lion server directly, but I've done variations of this with just about every other version of Mac OSX client and server and its been fine. I've had Lion clients connecting to an Open Directory domain with a mix of Snow Leopard and Leopard Servers just fine. Open directory is based on a fairly mature set of principles and standards and - ...


2

What you want to do may be possible. It depends on a few things though. What is the central identity store? Is it OpenDirectory? And what would be the impact in having the sync work in reverse? (i.e. is it feasible to manage users in AD and have that sync back to OD?) Where are your shares to be stored? Does it matter? This will probably require substantial ...


2

The kerberos principal is username@realm, not username@domain, and the realm is case-sensitive, so please try your kinit for igor@SERVER.domain.CO.UK, capitalized exactly the way you have the realm capitalized in your conf. The subtle distinction between server and realm is why your error is so hard to interpret - what it's trying to say is "I don't know ...


2

Yes, you can nest/add the OD group (e.g. workgroup) to which the networked users belong to the admin group in the local directory of the Macs. Something like this should do it (you could issue this to the client Macs using ARD, or include this in a configuration script applied with something like munki or DeployStudio): dseditgroup -o edit -u localadmin -P ...



Only top voted, non community-wiki answers of a minimum length are eligible