We're moving all our Mac's from local logins to OpenDirectory logins in an effort to keep everything secure and to also solve issues we have with a Tiger server buggering permissions on an AFP shared drive.

To cut it short, I want users to be able to login to their OpenDirectory account and I then want the AFP share point to mount using the credentials they just logged in with.

Firstly, is this possible (I assumed it was) and secondly how might I go about doing it?




It's simple in principle, you just need to manage preferences for the users' login items list, and add the share point to it. In practice, it's a little weird because you need to add it from a client (on the server, it's just a local folder, not a network share). You also need to decide how to apply this setting: you could apply it to each user as a per-user managed preference, or put the users in a group and apply the managed setting to the group. The group option usually winds up being easier to maintain -- e.g. when you add a new user, you can just put them in the group rather than having to recreate the setting for them.

  1. Copy Workgroup Manager from your server to one of the clients (or put it on a keychain drive, and plug the keychain drive into the client)
  2. On the client, mount the server share point manually
  3. Run Workgroup Manager on the client, tell it to connect to the server, and authenticate as the directory administrator
  4. Select Preferences in the WGM toolbar
  5. Select the user(s) or group you want to apply the preference setting to
  6. Click the "Login" icon on the right side of the WGM window
  7. Select the Items tab
  8. Select Manage: Once if you want the users to be able to change this setting, or Manage: Always if you want the setting to be locked
  9. Click the + button, select the mounted network share point, and click Add
  10. Click Apply Now, then Done
  11. Quit WGM, log out, and log back in as one of the users you applied the setting to. The share should automatically mount using the user's credentials.

If it asks for the a username and password to mount the share, that pretty much tells you Kerberos authentication isn't working. Kerberos is very slick when it works, but a bit fragile, especially if DNS isn't set up quite right.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.