I have the really important part of my magic triangle working - Mac OS X clients that I bind to AD & OD can log in with domain credentials. What isn't working is sharing a folder from the mac server to clients. When a client uses Go -> Connect to server, and specifies either smb://mac-server/sharedfolder or afp://mac-server/sharedfolder, the user is prompted for credentials, and domain credentials don't work (shaking window rejection). I've tried prefixing the username with the domain, but no luck.
DNS is working properly, and the client can resolve both mac-server and our AD domain controller
The mac server's DSCONFIGAD is as follows:
mac-server:~ macadmin$ dsconfigad -show Active Directory Forest = campus.zzz.edu Active Directory Domain = campus.zzz.edu Computer Account = mac-server$ Advanced Options - User Experience Create mobile account at login = Disabled Require confirmation = Enabled Force home to startup disk = Enabled Mount home as sharepoint = Enabled Use Windows UNC path for home = Enabled Network protocol to be used = smb Default user Shell = /bin/bash Advanced Options - Mappings Mapping UID to attribute = not set Mapping user GID to attribute = not set Mapping group GID to attribute = not set Generate Kerberos authority = Enabled Advanced Options - Administrative Preferred Domain controller = not set Allowed admin groups = not set Authentication from any domain = Enabled Packet signing = allow Packet encryption = allow Password change interval = 14 Restrict Dynamic DNS updates = not set Namespace mode = domain mac-server:~ macadmin$
My shared folder is configured like this:
Interestingly, clients can: * log in with Active Directory credentials * access other network resources they have permission to (like our regular file server), without being prompted for credentials
Clients cannot: * connect to the mac-server file share.
Both AD & OD added from client side:
I'm guessing that only the AD integration is working in my magic triangle, but the OD integration is not. Unfortunately, OpenDirectory doesn't appear to have any/many options to fiddle with in Server.app.
In the log viewer built into server.app, I do see one weird error in the AFP log saying:
Jul 15 15:18:42 mac-server.campus.zzz.edu AppleFileServer <Info>: **** - - "SACL membership failure for user chalstead" 0 0 0
I'd be happy to provide more details. I'm curious about this SACL membership failure, but not sure if that's a tree to bark up right now. I suspect I'm missing something far more basic.