6

Google have just released Secure LDAP which does what you want. Note you'll need to have G Suite Enterprise, G Suite for Education or add Cloud Identity Premium to your domain


3

I am not sure how this works with newer OS X server variants, but at least up to 10.6 this was correct. They were using a special password server that had an encrypted database of passwords in various hash formats that could be queried by all types of services (some of them specifically modified to do this, e.g. Apples Samba server) but it was impossible to ...


2

Open Directory has an LDAP backend so you would use something like simplesamlphp with LDAP to get what you want. However, some big caveats. If you’re happy with your Windows Server experience there are very few compelling reason to switch to OS X and Open Directory. Apple has put a lot of work into making OS X a good Active Directory client. For a broad ...


2

To follow along your question's line of thinking, check your modem/router configuration. You need to make sure that WAN->LAN ports are open for both TCP and UDP. Warning: this may be a real pain to configure and maintain! It looks like you have VPN configured and working. I'd suggest continuing down that line unless you want to spend a bunch more time ...


2

S-1-5-88- is the NFS base RID S-1-5-88-1-1029 is User ID 1029 S-1-5-88-2-100 is Group ID 100 S-1-5-88-3-16832 is the access mode (octal 40700) S-1-5-21- is the domain, which the client is apparently not a part of. Try joining the windows client to the domain to get the SID for S-1-5-21 resolved. The S-1-5-88 can't be mapped since W7/...


2

I have also been looking at a solution for this and the only thing I can find is this https://jumpcloud.com/ It provides the LDAP and uses the Google directory for user information.


2

ldapsearch -x \ -b "cn=<your group name>,ou=group,dc=<your org>,dc=com" \ -H ldaps://<ldap server>:<port> This works very well.


2

Not sure how much Apple has changed things from a typical LDAP/Kerberos setup. In LDAP, a password change would involve TCP client:highport -> server:389 (or the LDAPS equivalent port, or possibly UDP if they've adopted the LDAP-via-UDP thing like ActiveDirectory does). In Kerberos the password change should be made to the kpasswd (464) port on the ...


1

There is no way to make this work. Open Directory is too different to be able to replicate from an Active Directory domain. It can only replicate from Open Directory, and even there it's (mostly) restricted to the same major version of OS X Server (i.e. OS X Server v10.6 cannot replicate from anything other than v10.6).


1

You can change the options in the Directory Utility Command + Spacebar > Type and open 'Directory Utility' > Directory Editor > Viewing > Mounts > NFS mount > VFSOpts > Unlock the locker > Modify the options then save


1

You should be able to configure the default mount options that automountd applies using the AUTOMOUNTD_MNTOPTS option in /etc/autofs.conf. Alternatively, for just the home directory mounts, you can add options to the auto_home map in /etc/auto_master.


1

I found a solution to this problem. The critical point is that using kadmin on OS X Server is not enough to create a valid service principal that can be exported via keytab and used on a different server. OS X Server requires the use of the command "krbservicesetup". Even though the manpage states that it can/should only be used for setting up local ...


1

This is not possible with server versions after OS X Server Snow Leopard. Since the first release of the 'simple' server in OS X Lion, binding Windows clients to OS X Server is not possible anymore. For authentication a client such as pGina can be used though, however it is not officially supported.


1

In El Capitan, you can use this: pwpolicy -u target -disableuser To reverse pwpolicy -u target -enableuser


1

Here's what worked for me solving this login issue on OS X 10.11.6 with Server 5.1.7. These steps also resolved several other problems like not being able to install profiles due to trust issues, user permissions issues, or the inability to contact the server, etc. From https://support.apple.com/en-us/HT200018 : Check DNS: Open Terminal and type ...


1

Try listing the password server's supported hash types with pwpolicy -n /LDAPv3/127.0.0.1 -getglobalhashtypes ...and see if it includes RECOVERABLE (which I believe is needed for both DIGEST-MD5 and WEBDAV-DIGEST) (note that this won't list GSSAPI/Kerberos, since this is handled by a separate service). Unfortunately I don't have a way to test this right ...


1

Since I see nobody has answered this question... it seems that yes, this is a reasonable thing to do, and so long as you match the fields used in the automatically-generated certificate, it works. It's been a long time since I fixed this now, so I can't remember all the details. The one thing I do remember is that at that time, OpenDirectory would refuse to ...


1

If your AD environment uses Kerberos for authentication, then in principle, moving from the AD functions to a combination of a Kerberos server (e.g. MIT's krb5) and an LDAP server would work (running on Linux). Mac OS X clients supports Kerberos authentication and SSO; Safari (and Chrome, Firefox) support SPNEGO extension for handling Kerberos auth over HTTP....


Only top voted, non community-wiki answers of a minimum length are eligible