Slashdot Mirror
"Seamless" Integration of Mac OS X w/ Active Directory
eexlebots asks: "I work for a small college which has a few Mac OS X 10.2 machines and a fairly standard Active Directory setup. Actual deployment of these clients rides on getting them to authenticate at login to our Active Directory server. Apple has stated that this is possible (easy! seamless!) with Jaguar without the use of an additional Mac OS X server, but I have found the case to be quite different. It is possible, but not without a good deal of nightmarish configuration issues. Documentation? HA! No sign of it anywhere on Apple's site. I'm not alone: at macwindows.com I found a good many people who think that Apple's claims of seamless Windows Network integration to be a bad joke and nothing more. I was wondering who else out there is having this problem, and what they have done to solve it."
Active desktop and Active directory are *slightly* different...
In the title: Desktop != Directory
Active Desktop???
Change the title or no one will know what the heck you're talking about.
The title was "Seamless" Integration of MAC OS X w/ Active Desktop, but shouldn't be Active Directory, or did I somehow miss the Active Desktop part of things?
Fix the headline.
It isn't exactly in Microsoft's best interest to make this easy for them is it?
I do not fear computers. I fear the lack of them. Isaac Asimov (1920 - 1992)
Guys, please add an UPDATE! 2:02 EST by cmdrTaco it's Active Directory, not Active Desktop.
Today's recipie: Hot Spinach and Artichoke Dip
Why would you want to hook up a bastardized BSD box to a windows network... that goes against darwin.. survival of the fittest... like lyle lovett.. HOW
Not Active Desktop
Big Difference!
Mmmm.. Donuts
It wasn't until this very column, titled Mac OS X with Active Desktop, until I realized how very stupid the humans at slashdot are. I never paid any attention to others who insisted this, but now I'm a believer. I mean, come on! Active Desktop when the text clearly says Active Directory. Jeez, where does slashdot find them? On topic now.. I've seen documentation on Apples's site on how to do it, but it's quite a mess. We currently support Win2k(soon XP) and Linux boxen in the Bio dept. at MIT, because of the kerberos. With the release of Jaguar, Macs become a viable managed platform for us, as opposed to the unmanaged platforms we have to support, such as Irix, NT4, Solaris(although 9 finally supports kerberos). Any success stories and/or caveats will be appreciated by many.
Do you see the sig? Do you have it in your sights? Why yes, Miss Moneypenny...
doing an smb://machinename/ works just fine (thank goodness 10.2 keeps us from having to announce the share on that line anymore), but it's lame that i can't browse the network.
that said, 10.2 works just fine on my simple workgroup based network at home.
Get rid of that stupid AD and install a real catalogue system like LDAP or NDS. Active Directory is made for Windows and nothing but windows. Making anything else to work with it is very hard and not worth it. What on earth do you need from AD that cannot be solved otherwise? If its just a matter of a few machines there shoudnt be any significant gain in ease of admin in AD. If there are plenty then you should install a MAC server. Microsoft does not and will never play nice with anything else but Microsoft.
HTTP/1.1 400
Step 1: plug into the network
Step 2: login using AD credentials
Step 3: There's no step 3! There's no step 3!
You sure like being part of the crowd, don't you?
Not really. Apple has been partners with M$ for quite a while now. ANd you do know the best way to win users over is to make it easy to incorporate the new into the old.
T Money
World Domination with a plastic spoon since 1984
Can't you just use Winbind from the SAMBA project to use AD authentication? Just configure Winbind to point to your Domain controller and setup NIS to work with it.
Or am I off base? I've done this on FreeBSD i386 boxes so it should not be difficult, unless Apple has mucked up logins.
I'm stating this at a very high-level perspective, but I know Samba is an actual component of OS X Server, and it is known to compile and install on OS X perfectly.
:)
So why not use Samba for integration to Active Directory? I'm not perfectly clear on the details of doing so, but I'm pretty sure you can use Kerberos to hook up to an AD domain, and go from there.
Any reason not to try? After all, Unix folk are generally pretty adamant about not reinventing the wheel
-brain
Active Directory is Microsoft's enterprise X.500-like security and authentication scheme. You set it up on a network of Windows servers and the clients all authenticate with those. Active Desktop is putting a webpage on your desktop.
...have always been that their single user experience was good. Mac users don't just like their macs at home, they love them. Apple realized this and catered to that strength. Meanwhile Wintel took over the corporations of america. Besides from schools and maybe graphics/multimedia places, who would implement an Apple network?
Thus it doesn't surprise me that their implementation is unpolished. Polish is, however Apple's strength, so give em hell, and give em time, and they'll come round.
Why, o why must the sky fall when I've learned to fly?
Couldn't we just ask nicely for Microsoft to open up the APIs for Active Directory?
Oh wait they don't have to since this would involve Security, DRM, Authentication, Innovation, The Butterfly, etc...
If someone can make this work with MacOS, I'm sure linux/unix is not far away. Solaris supports LDAP and I'm sure so do a lot of other Unix os... and the fact that Active Directory can be accessed using LDAP queries does make you wonder why we don't have any linux/unix server connecting to Active directory as of today.
Active directory, just like any other MS stuff likes to maintain its own standards and its hard to get inside documentation on it on the web.
Solaris LDAP and linux LDAP implementations have a lot of problems. Its just not ready for Enterprise class networking. I sat on a simple netgroup bug for months before SUN came out with a patch. And linux doesn't even support netgroup as cleanly as Solaris yet.
Its a pain.... if MacOS X can solve all these hiccups ( and if they do manage to come out with a documentation) I'm sure it will inspire the other Unix environments.
rkt
i've found that you can go into /Utilities/Directory Access and configure the SMB entry, but, for whatever reason, the macs on my domain elect themselves the domain controller and cannot see any machines on the domain. it's pretty annoying.
doing an smb://machinename/ works just fine (thank goodness 10.2 keeps us from having to announce the share on that line anymore), but it's lame that i can't browse the network.
that said, 10.2 works just fine on my simple workgroup based network at home.
If Apple really wants to make OSX compatible with the entrenched NOS's out there, they need to hire a few Active "Directory" and Netware engineers and teach them about the MAC as opposed to the other way around.
Keep passing the open windows...
Have you tried this?
I'm not sure what active directory is but I do know that using Jaguar, my machine can browse my windows network and connect to any shared folders very easily.
I also have it sharing folders out to the windows machines though it doesn't give out a listing of what's shared (probably for security reasons). You have to tell it what username, password and share you want to access.
What exactly are you trying to do?
I currently work in a smallish office with about 15 workstations and 3 or 4 different file servers. Our workstations are about 70% Mac and 30% Windows. The servers run FreeBSD 4.x, Linux (with a 2.2.x kernel) and Windows 2000/XP. On the FreeBSD/Linux servers we run two different versions of Samba (2.2.x & 2.0.x).
No matter which server we connect to, if we copy files from the Mac to the server using SMB as the protocol, we experience a significant amount of file corruption (it appears to be that there are just chunks of the file that don't get copied). It is repeatable, but doesn't happen every time. This is a serious inconvenience. I should also point out that we did NOT have this problem prior to upgrading to 10.2 (we also have upgraded to 10.2.1).
I've have sent numerous reports with details to Apple with no response.
--fp
Most likely, the configuration issues are with configuring the AD with the proper schema. When the AD is properly set up, then all you have to do is go into the Open Directory Assistant and create an LDAP service that is configured to use the Active Directory preset. Yes, it's a preset and so there is little or configuration on the OS X side. Once the LDAP service is created, then you select it as an authentication service (in the same utility) and you are done.
I use it all the time... That is, I use the "Windows crashed, press this button to restore your active desktop" button all the time.
I alternate between posting +5 and -1 Comments. Karma: +53 -47 = 6
Apparently not. By entering "Active Directory under OS X" the very first entry is a PDF by Apple with instructions on page 35 on how to setup clients to authenticate to the active directory domain controller.
Here is the link for the uniniated:
MacOSXwithActiveDirectory.pdf
We are still in mixed mode and using connetix ( what a piece of crap product ) on a 9x mac, to authenticate to the NT side.
I worry that it will die when we go native in teh spring. And no upgrade to 10x in sight due to application issues. fun fun wish us luck !
---- Booth was a patriot ----
I'll save you the time:
"M1cr0s0pht sux0Rz@@!@! Use LiNuX it RAWKZ#(*#@*(#@#@#"
For a second I thought they were trying to make a rotten apple
Any idea how to take Active Desktop out of windows?
Read The Fucking Manual
You know, slashdot really isn't as good of a search engine as Google.
1) Go to google.com
2) search for "active directory mac os x"
3) click the third result.
4) prof- nah.
Or you can click this link:
Integrating Mac OS X with Active Directory
Sheesh, yeah, it must be a Microsoft conspiracy. It can't be that Apple's implementation simply sucks. After all, we know that Apple NEVER writes any software that sucks (*cough*Quicktime Player*cough*).
Who said anything about Active Desktop?
reech bee-yond ur clip-0n
A quick google returns this as the first reference: MacOSXwithActiveDirectory.pdf.
All they lose out on, is the OS License. Which when purchased from a Dell, et al, isn't that significant. When a Mac gets roped into the AD network seamlessly, they still get revenue from a copy of Office so the user can share docs with other users (LOTS more profitable than Windows). Plus a few more CAL's as well, for the file server(s) as well as the exchange server(s). All in all, it's still a good revenue stream for MS.
"Politicians are interested in people. Not that this is always a virtue. Fleas are interested in dogs." P.J. O'Rourke
No, I've not tried it as I don't have anything which talks Active[sic] Directory, so YMMV.
I use AD here at our school. I have often considered moving to Linux or BSD but am terrified at the prospect of having connectivity issues like this.
BTW, is it possible through Samba to get home directories mapped automatically? This is a showstopper for us as our users all have mapped personal and public shares.
A quick searc for Active Directory on the Apple website turns up these results:
this
this and the PDF linked to on that page can be found here
There ae also links on Apple's site to third pary sites which deal specificaly with Mac - PC network integration.
T Money
World Domination with a plastic spoon since 1984
Just because OS X supports LDAP for authentication does not mean there will be seamless integration with Active Directory.
Active Directory (at least the MS implementation) is like a network-level "registry". It holds everything from integrated DNS records, to DHCP server authorization, users, permissions, replication controls and information....you get the idea.
To participate in most of this, you need to have client side stuff that can take advantage of all of this. OK, you get samba authentication without needing LDAP support on OS X, but who cares...that isn't enough for "seemless" integration.
Can you add users to OS X and have them appear in Active directory?....I don't think so.
Can you get your DHCP server (on OS X) to authenticate itself in Active Directory?...probably not.
Can you get user lists and permissions to replicate into OS X's user list? Maybe...but i'm still not sure about that.
Lastly...can you get a user to log into OS X and have OS X process login scripts replicated to domain controllers? Doubtful...most of the windows login scripts don't apply to the Unix world.
I may be wrong on this stuff. My experience with OS X has been a handful of workstations connecting to a windows file server via samba. It seems that the platforms are too far apart to get this "seemless" integration.
It appears the best you can do is simple user authentication....it might be worth it if the OS X server can get it's user list from the Active Directory machines. Does anyone know if this is possible? I'd love it if a Linux distribution could do that so I don't have to maintain two sets of user lists.
-ted
A disclaimer first: I haven't tried to do this on MacOS X, but just did the same for Linux; you can do it on any unix that supports PAM for authentication.
It is certainly possible, however I wouldn't call this integration a "seemless" one (I didn't use samba for that).
You can extend AD schema to support unix by using AD4Unix package.
After that you need to install nss_ldap and pam_ldap. A good starting point on how to configure these two can be found at Security Focus. You may want to use Kerberos for authentication, as pam_ldap transmits username and password over the network (although with SSL support this data will be encrypted).
Hope this helps,
AC
http://a1584.g.akamai.net/7/1584/51/7f99c60f0c08bf /www.apple.com/macosx/server/pdf/MacOSXwithActiveD irectory.pdf
As I mentioned earlier, we have Active Directory, as well as a Jag server. We had an Apple engineer here for two days, and not even he was able to get AD-style login-auth to work - the basics like proper mapping and creation of home dirs on network instead of local host and all that. It looks like Apple still has quite a bit of work to do here. On the bright side, I use Cmd-K to logon to any of the network shares, and the perms are correctly handled. But we are looking for a logon screen for OS X that uses our AD for auth, and so far nyet.
political_news.c: warning: comparison is always true due to limited range of data type
Probable webpage on Microsoft.com:
"This link will let you download instructions on how to use Active Directory for 3rd part OS'es, such as MacOS. By clicking on this link, you agree to the following:
1) I will not redistribute this document
2) I will hyperlink to this document, bypassing this EULA.
3) I will not use the information contained wherein to bypass Windows security settings by authenticating any 3rd part OS via Active Directory ( DMCA )"
I don't have a sig...Do you??
Go to Google. Type "apple.com active.directory" in the search box, and mind the periods. The very first result is a PDF from Apple's site entitled "Integrating Mac OS X With Active Directory." (Just to be clear, that link is directly to the PDF, so don't click unless you're ready to download.) In it you can find step-by-step instructions for setting up both the clients (simple) and the server (complex, but only has to be done once).
Since you said in your submission, "Documentation? HA! No sign of it anywhere on Apple's site," it seems clear that you haven't read this document yet. Give it a try. As I wrote elsewhere, I don't have any Windows servers, but from reading the instructions, it looks like it will be very easy for you to set this up just the way you want it.
I write in my journal
It's in the Samba configuration. It's something like "OS Level" and it will be set to some number, like maybe 50.
This number is how MS machines determine who is the Primary Domain Controller, basically the one with the highest OS level gets it, unless things are specifically configured otherwise. IIRC, Windows NT 4 has an OS level in the low 30s. Newer versions of Windows have higher OS levels, and server versions have higher levels than workstation or desktop versions.
So, all you have to do is use SWAT, or otherwise edit smb.conf, and set your OS level to some low number, like 1.
This site is a good introduction with lots of useful tips. If you really need to know Samba, though, I highly recomend this book.
Under capitalism man exploits man. Under communism it's the other way around.
What exactly is the difference between these?
/etc/passwd with the user's uid/gid/homedir (It IS possible to get around this with the "nolocal" option, but needless to say it only works for a limited subset of services), but that entry doesn't need a password set, just * (Which would disallow logins normally, in this case if pam_smb_auth clears the authentication, you can log in)
Or is AD just the authentication portion of SMB?
I know on RedHat systems, you can choose the pam_smb_auth PAM module to authenticate against a Windows domain controller. Pop in your domain and the server name, pam_smb_auth handles most of the rest. You still need a local entry in
I have this set up on a Linux box at work - At the moment I need to use adduser to create local accounts, but I don't need to give the users passwords - They use their current domain userid/pass.
retrorocket.o not found, launch anyway?
Sometimes rather than doing an exhaustive search it really is easier and I think in many cases proper to just "Ask Slashdot". You are likely to get someone who has already solved the problem quickly and easily, and has the expirence. So give people a break, they are just taking the route that is quickest to a solution. If you don't have anything useful to say to solve the problem they are Asking about...SHUT the F**K UP!
Power Corrupts,Absolute Power Corrupts Absolutely, leaving one person(group)in charge is absolutely corrupt.
Getting OS X working with AD can be done, but you need to do it with Samba. Read the Samba documentation, learn to use Samba, and you should have no problem getting your OS X systems to work with AD. This will require research, effort, and scariest of all, it will require editing text files and maybe even working with the command line, but with some time even a Mac user should figure it out.
Comment removed based on user account deletion
I'm an IT admin, and we have Win2k running AD on our server, and we have 10+ Mac clients running OS 10.2. The key is, make sure the user accounts and the user alias on the domain controller are the same..meaning, if your user account is named joe smith, make sure the alias is the same. Hope that helps.
~~~ Nicole
...always blames his tools.
I have a Windows wlan at home (3 windows boxes) and my powerbook running X.2 worked *prefectly*, no problems at all. And setting the PB up was easy.
Our school's network is split about 55% PC, 45% Mac. Our Tech-Coordinator is a Mac obsessive, so everything has to work so that the administration doesn't complain.
I am the sole user of Mac OS 10.2, and as a student, I am very pleased with its ability to access my files on the Windows server. It is truely seamless.
Colin Dean Go a year without DRM
My primary complaint against SMB is that it doesn't really work all that well. When I tried to look at the list of computers in Network Neighborhood, I often saw only a partial list (some computers that I knew were connected did not show up). The only way I could connect to these was by specifying their IP address. Other times, I could not access them at all (even though in some cases they could still access my machine!). I switched to Linux a while ago, and I have had similar results using SAMBA.
This leads me to believe that the fault for bad Windows Network performance lies not in the implementation (whether SMB on Windows, SAMBA on Linux, or the Apple implementation) but in the protocol itself.
Based on Apple's adverts of "seamless" we told people they'd be able to browse my organization's full list of local windows servers from MacOsX10.2's [Connect to Server] command. As stated in the linked article, it quickly became clear that browsing using active directory only works for severs on the local subnet. Fortunately, if you already know the name or address of the machine you're trying to connect to, you can log on directly by entering: . So far, this has worked just fine on non-local subnets.
So for my org, it's a mixed review. It's a long way from "seamless", but it's a LOT better connectivity than MacOS has ever had before. If Apple had advertised what they actually delivered ("Now you can log onto a windows server"), we'd be thrilled.
Apple is sponsoring XServe road shows all across the country, targeted toward educational institutions and businesses which are interested in "XServe Integration."
/ index.h tml
I attended one of these demonstrations a few weeks ago. If you are in Education, (especially higher-ed) and are interested in integrating XServe with your Active Directory server, check with your Account Executive to see when/if this "XServe Roadshow" will be coming to your town.
Here's information about the "XServe Roadshow" from Apple's site:
http://seminars.apple.com/tours/unixserver
Jaguar's alleged Windows network integration is lacking to say the least. In my case it is that windows network browsing is limited to your subnet only, making it nearly useless. I.e. you don't see and can't get to (even nearly) everything when you browse. You CAN get to anything via typing in an appropriate smb URL in the "Connect To Server..." window, but obviously then you have to know the server is there.
Mind you, I have little to no need to do any of this anyway so it isn't a big deal to me, but if they're going to advertise seamless windows network integration then it ought to be that. I want $1 back for that alleged feature.
--- What?
It was changed soon after being posted...
Samba is built into OSX and samba can be compiled on OSX. I dont see a problem with documentation because if you go to www.samba.org you will have plenty of documentation. Albeit apples gui configuration of samba is a little lacking but if you configure smb.conf you wont have any issues.
The article originally used Active Desktop rather than Active Directory. It appears to have changed, though.
You know what kills me... Microsoft has different meanings for "active desktop". I had to deal with the other meaning extensively on my last project.
Random is the New Order.
I beg to differ about NDS on Windows ever being a problem.
I have no great love for Windows. Novell, I happen to like very much but it is cost prohibitive. But is NDS worth the money? Yes. Also, GroupWise is capable of driving Outlook properly, even better than my beloved OpenMail [RIP, now Samsung Contact - yeach, thanks Carly] was.
My experience since Novell 4.x (I've used it back in the bindery days as well) and NDS has been flawless. It supports DOS, WinALL, and anything else. It has native file sharing so it can appear as a Winderz box. The server is ugly as sin at the console, but it runs more reliably that one would ever imagine, I had several servers stay up for more than a year. The Novell client integration with Windows NT based operations systems is superior, supporting advanced network trashcans, robust undelete for idiots, and does interesting things like server side searches (as in, if you are looking for the word "cat" on a network file system, the server does the searching 'for you.'
Also, NDS is much more scaleable than ADS. It has the proper notion of root, it is possible to merge trunks together, if you've ever used ConsoleOne, you'll see more granularity on this directory and its objects than was ever dreamed possible, cleanly integrated and rather fast.
Is Novell run by intelligent business people? No. Are the products of incredible quality? Yes. Novell's image has been so heinously stained, with angry red color schemes, idiotic pictures of polyester clad fools running around on my console dancing or holding up red N's.
Novell needs to do only this: Change colors to blue or something, and rip out that licensing shit and start offering to replace ADS/Exchange with NDS/GroupWise for $100 bucks. All it costs them is a CD. It would cost Microsoft a lot of pain.
If you haven't given Novell a shot, please do,. You'll realize that the free stuff right now is primitive compared to NDS. Any other comments on good directory service implementations are welcome.
I just setup a Novell 6 server the other day to stay sharp with that stuff. Besides the fools in the marketing department over there, I was impressed with it. I would take a job working with Novell and Unix, but if someone wanted me to deal with Windows ADS or NT4 DS again, and not be open to Samba, I would probably not take the job or demand a premium.
Legalize the constitution. Think for yourself question authority.
Judging from all the -1 flamebait/troll posts above, the article apparently was originally posted with "Desktop" in the title instead of "Directory". Makes for some confusing reading when you RTFA.
Have you ever tried to get "Mac People"and "Windows People" to integrate. They run on the same hardware yet seem totally incompatible.
http://www.kubuntu.org/
http://acctsync.sf.net - It's difficult to deploy, but it works.
There are other such products, like PSych and NDS, which may be easier to work with.
Using this ensures that you don't have to rely on a Win2k LDAP network for authentication services ( read Win2k license for every AD replica, additional CALs )
But you can alternatively deploy an OpenLDAP set of replicas and have all your services/computers authenticate against them ( read free, their don't care how many you deploy or what you put into them ).
Microsoft not having Win2k play nice with others is having the beneficial side-effect of increasing their Win2k sales.
Hmmm... Hey! You think that was their plan to begin with?
Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
Had you actually *read* the document you linked to, rather than googling for forty seconds and then patting yourself on the back, you might have found that this is the sole reference to Active Directory:
The poster's problems are a very real issue and are well-deserving of a public question on Slashdot.four nine eighteen twenty-7 thirty-nine forty-7 fiftyeight sixty-nine seventy-9 eighty-8 one-hundred-and-nine one-twenty
It sounds like your real problem is getting AD to play nice with LDAP clients. The reason that Microsoft clients integrate "seamlessly" with AD is that they use some funky proprietary directory protocol, whereas everything else (Linux, Mac, etc.) speaks straight LDAP. I've found that 10.2 has pretty darn good LDAP integration, but getting it to work with Microsoft takes some accomodation on the AD side.
Remember that Macs use open protocols and tools for their Windows integration. Samba is used for the SMB stuff and LDAP for directories. Any time you're using proprietary MS protocols, you're going to run into problems. You'll run into the same situation with Linux, Novell, or anything non-MS. If your mandate is to make the Macs behave exactly like Windows, then they're setting you up for failure
That being said, you can really help yourself out by getting a 10.2 server to act as a bridge. Apple's OpenLDAP is still fairly young, but it really simplifies AD integration. With your modest requirements, you probably use an old iMac. The server software for 10.2 server is pretty cheap with educational discounts ($250 for 10 clients, $500 for unlimited), and it doesn't require much of a box. I'm using an iMac server to get a 20 station lab on AD and it works pretty well. You get some really cool deployment and workstation management tools, too. ;)
I hear you about the documentation, though. I don't mind so much, because I like tinkering with things and Apple's stuff is fairly intuitive. However, when you're just starting out, Apple's "Why would you need a manual?" attitude gets pretty annoying.
This
There are no impossible dreams
there are no invisible seams
Who says John Osbourne is a fool?
Say it ain't so!
Ehrm. Not only do I have Windows machines, I have an OS X box, and my workstation is Linux.
Now, the windows boxes DO have random crashes regarding the TCP/IP stacks (Exception 0E), but that has nothing to do with Netware/NDS.
Stop spreading FUD, I've run NDS for 5 years, and logging into the server is not an issue. Sure, there can be other issues (client-side caching of shared documents - umm turn it off), but nothing that is specific to NDS.
Plus, with NDS, you don't even need Netware. (Oh, and it's also LDAP v3, so we've used it for web app auths also)
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
I have had the same problem with computers not showing up under Network Neighborhood. As a suggestion: configure your Linux SMB server to also act as a WINS server and pass the necessary WINS statements to clients from your DHCP server (assuming you have access to it.) This will make every smb-based client (i think) register with WINS so that they are "seen" as soon as they appear, much sooner than the 20/30 minutes it normally takes for Windows/Linux clients to discover themselves by themselves.
As always, IMHO(it's my humble opinion) and YMMV..
Partnership for an idiot free America!
I haven't actually done it I got real close
. html
I would reccommend learning netinfo from the command line
man nidump, niutil there's some shell scripts out there but nothing which explicitly works
netinfo has multiple password domains, smbpasswd so you have to add machine accounts to the correct domain for smbpasswd to find it
here's a start
http://food.tamu.edu/mosxs_scripts/adduser
I read that sample chapter. It seems useless in relation to the topic. They list appletalk and netinfo as the legacy services, and then proceed to go into great detail on how to setup netinfo, not discussing any of the others at all... Why would we want to use the legacy directory service?
music lover since 1969
If you ever look at the properties in a typical user's account in AD vs LDAP you will get the screaming heebeejeebies!!! :)
LDAP user = a paragraph or two of logically arranged and named fields.
AD user = a page and a half of garble!
There's a reason MS has an AD "connector for LDAP" product (for a small fee).
AD might technically have the same modes of communication as LDAP but that's like saying just because I can use the same phone to call my Aunt and that friendly guy in Nigeria that they can and should talk to each other. (Okay, bad analogy, but I thought iwas funny.
So, to summarise for anyone who hasn't had the pleasure of attempting to integrate AD and LDAP, they ain't even close to compatible Jack!!
Keep it coming ;-)
;-)
I really like to see people putting out the word for Novell.
I work with Novell and Windows servers everyday and it is so clear what the better product is.
Getting an AD installation working takes twice as much time, pain, and agony that setting up NDS.
Had to say it
Apple, in its attempts to get into more enterprise accounts, has not learned that system administrators require documentation ad nauseum. They wrote their documentation for AD in the old 10.1 Server AD/LDAP PDF and in their System Administrators guide for 10.2 Server much too simply.
Recently I worked with Apple to receive an Xserve for two tests--getting a Macintosh to authenticate by AD (which is an LDAP superset) from login, and to provide authentication on file shares from AD using the Connect to Server command, where the shares would be provided by the Xserve.
I had no success in getting anything to work with 10.1 Server. After getting 10.2 Server from Apple, we had luck in getting authentication for file shares working. Part of the problem involved how LDAPv3 (the main component in Apple's Open Directory) relates to the AD schema. I'm not an AD expert, but Apple has got a "not-invented-here" mindset here; the LDAP components don't match up with with sysadmins expect. I was unable to get the login authentication component working at all.
As a result, I couldn't recommend an Xserve for my customers, and stuck in Services For Macintosh, a component in Windows 2000 Server that provides the same authentications to file shares by AD without the Xserve acting as a middleman for file sharing. It's got its own issues, but at least it worked as advertised; it took us only 5 minutes to set this up on a working W2K server.
Apple MUST have the documentation and software working and tested before making claims. This is a completely unacceptable way to sell their wares, and is worsening an already bad reputation for many in IT.
Just so you know, Macintosh system integration is my business, so I feel quite justified in flaming Apple for such a bad implementation. It's not really their technology, but how they sold this currently-snake oil concept to Mac professionals.
Vos teneo officium eram periculosus ut vos recipero is.
... but how about porting your AD environment to Samba + LDAP on a unix-based Samba PDC?
;)
Save lots of $$$ on server licenses, and Win2k works fine in NT4 backwards-compatibility mode..
Depends on how many people, departments, etc.. But it could be a cost-effective solution.
As long as M$ isn't paying your college off, of course
Depends if you *have* to use Active Directory. Some people have sucessfully deployed OpenAFS in heterogenous environments. It does run on Windows and MacOS X. There are even some success stories mentioning this setup.
http://www.openafs.org/success.html
One DOES...Microsoft's DHCP server must register itself with Active Directory. This keeps rogue DHCP servers off the network. This is a nice feature in a large organization. How many networks have been interupted by some bozo accedentally activating DHCP on his windows NT/2000 server box? I know of a few.
Sure, that doesn't stop the same bozo from enabling DHCP on his wireless access-point/router...but it does help.
I guess what I want is Linux or OS X to act like an Active Directory DC....to do all the things that Microsoft's AD-DC's do.
-ted
Uh, what the hell is the purpose of this article? Shouldn't this be under "Ask Slashdot" or perhaps "Senseless Ranting"?
Will do that. I think in the end, I think the benefits of few less win2k servers to maintain/buy is worth the client install.
Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
I work for a company that looked into it recently. We bought an XServe, read the docs, and when I tried to assemble it in a test environment (Fresh AD infrastructure, own address space, etc) I ran into problem after problem. Finally when all the people at the Apple Support Forums (http://discussions.info.apple.com/) we got an error. So I called apple support. Would they help? They said no. Would Apple Pro support help? They said no. They said "We can get you in touch with Apple Consulting Services to help you get it working."
WTF? I have to buy consulting? They won't even *help* you through it over the phone, they direct you to the discussion forums. Basically my point is that Apple won't even support vanilla test-only installs, let alone ones in production.
The way it basically works is that Apple's own LDAP flavor (OpenDirectory) only works with Apple clients. *But* you can make some additions to the Win2k/AD Schema (not that scary) and make it so Apple's OpenDirectory can read attributes (users and shares) from AD, letting AD users login locally to a mac. Great stuff, yet to see it work.
The documentation sends you all over the whitepaper, looking for info on how to do this and that, and leaves out crucial steps (enabling LDAPv2 in AD, for example, as well as enabling LDAPv2 write access).
I'm no apple basher, but at the very least they should stop saying it's easy.
the only platform that quicktime sucks on is windows for some reason... the mac version is pretty damn nice, stable, and fast.
Uhh, we're talking about extending an LDAP (MS AD) schema and maybe setting up Samba here. Not exactly friggin rocket science. I would suggest you read up some on LDAP and SMB, once you understand the basics of this stuff all will become clear to you. I would hardly call what is going on here a nightmare.
Keep in mind that nothing you are doing here would be at all new to someone who has used LDAP, or MS AD, in a Linux + Windows or Sun + Windows environment. Keep in mind that your shiny Mac is a Unix based machine and eperience and tools from other platforms will apply. Get off your ass and spend 5 minutes with google.
Is is possible you are just stupid? I read the site you linked to, most of these people are definately stupid. You have a MCSE right?
This may be OT, but mixed-mode doesn't have anything to do with how your clients authenticate. It has to do with what types of domain controllers you have. If you have nothing but Win2k DCs, you can run in native mode.
I'm running my ActiveDirectory in native mode and I have plenty of "downlevel" clients authenticating using the old NTLM protocols.
10.2 and 10.1 are vastly different in authentication for this purpose. The PDF file on Apple's site doesn't talk about 10.1, so it isn't exactly useful, nor are the myriad of stupid Google search results people are posting.
Instead of telling peoplt to search first, you might want to do a bit of background checking yourself first!
I recently plugged a new Mac with Jaguar on it into our office Windows network. I firmly believe that this machine does Windows networking better than Windows 9x, and it's easier to configure than anything I've used so far.
Active Directory aside, I find Mac OS X to work on a Windows network better than Windows does, honestly.
Having worked on Active Directory interoperability in Linux along with giving a presentation at the recent CIFS conference on the topic, I can speak to this issue with a certain degree of confidence.
My understand of the OS X client is that it doesn't contain true Active Directory client support. Instead, it relies on the fact that most AD installations are in mixed-mode where they still accept old client logins. In fact, only the bleeding edge versions of Samba actually support true Active Directory client login as it erquires some pretty obscure protocols that only recently have been understood (LDAP over UDP and other various nonsense).
Chances are, your network is in native-mode. That would kill your chances of using the native OS X CIFS clients (although Samba should allow you to access network resources if you use a beta 3.0 version).
int func(int a);
func((b += 3, b));
Perhaps it goes without saying, but ActiveDirectory is not intended for supporting a heterogeneous network easily. It is intended to support a Windows-based network with the hope of providing some services (with intended frustration) to non-Windows hosts on the same network.
What you are looking for is an LDAP service on your network (freeware, commercial, whatever). You will find that management of a true LDAP service and interoperability with it will be much easier. Moreover, it will be more "seemless" for your Macs.
Your IT department cannot be entirely clueless. At least one person in the department must be aware of the issues related to ActiveDirectory. It's just that your site made a conscious decision to go with the higher-cost deviant-from-standard semi-proprietary solution rather than the more mature less-expensive cross-platform solution. It's that sort of thinking that keeps a lot of the software industry afloat and product quality marginal.
And, while I understand that having Apple say "its easy" makes you want to blame them, you really ought to blame MS or yourselves for purchasing MS technology.Believe me, if it were my choice, we wouldn't have a single Windows machine on our network, either server or client. But it's not my decision to make. Given the reality that I am in a Windows shop, I do my best to make things work right. And, so far, OS X clients only work marginally well. Users can manually mount NT shares using their AD auth, but we'd relly prefer to see login screens at bootup authing against the AD. And that's where the problem lies. I agree that the problem is probably M$, but what can I do?
political_news.c: warning: comparison is always true due to limited range of data type
It is possible, but not without a good deal of nightmarish configuration issues. Documentation? HA! No sign of it anywhere on Apple's site.
But I thought Macs "just work"?
The theory of relativity doesn't work right in Arkansas.
use the domain in front of the user name for the OSx client side login.
registered user: domain\username
password: xxxxxxxx
Apple haven't broken LDAP by modifying it. They are using OpenLDAP, which is published under an open source licence.
All they have done is provide a bridge and NetInfo schema such that current NetInfo account information can be published via LDAP directly from the NetInfo database. They're not the bad guys here.
i don't read slashdot anymore.
You may have to put the Apple schema into eDirectory, it's easy. After that, it should work fine. P.S. Run the eDirectory (renamed NDS) on Solaris. Screamin' fast, and only 320 GB for a million users. (All attributes filled.)
dot-sig.
...when people complain about Apple not documenting when it is Microsoft's non-standard nonsense that caused the problem in the first place.
but I recently had to get Solaris interacting with AD. After digging around and finding no real definitive documentation, I found a set of PAM and nsswitch modules from PADL that provide LDAP support for both setups.
After getting these to compile properly on Solaris (which was it's own nightmare, though they work out of the box for Linux), I had to install the AD4UNIX package. This is a program/plugin/schema update maintained at this site that adds the MS Servies for UNIX version 2 schema to the AD. This gives you places to store uids, gids, home directory, etc. It also gives a nice plugin for the AD user manager to let you set that data.
Finally, you edit a few config files (non-trivial, but possible) and suddenly you have AD users appearing in your passwd entries, and they can login with anything that uses PAM.
Like I said, i don't know how much that would apply to OS X (I haven't had a chance to play with it yet), but if you have PAM and NSS, it does work.
Also, I'm gonna put my notes online once i clean them up so that no other poor sysadmin has to dig for it.
kc8apf
Just to clarify something, although Apple have included PAM in OS X 10.2, it's kind of useless, as /etc/pam.d/login isn't actually consulted at the login window.
yeah. brain dead and bloody annoying.
i don't read slashdot anymore.
You will need 10.2.
/Applications/Utilities, select Directory access. Select LDAPv3, click Configure, drop down the show options button, hit 'new', type a friendly name for your AD server, slap in its name or IP, Select Active Directory from the LDAP Mappings, use SSL if you want, fart around with the other options if you need to, OK everything, go back to Directory Access, Select Custom Path from the Search Drop Down, hit 'add', select '/LDAPv3/Your Friendly name'.
Browse to
Slap back wallop, you should now be authenticating with an AD server, seamlessly it is. Works Good for me, I dont like AD, but I really dont care, it authenticates me thats all I need, keeps management happy too, they love spending that money!!!.
T
Yes, Apple does lie. They made you think they sold you an "Enterprise Solution" when you paid for an XServe. But you bought an experiment. Take it from me, don't wait for Apple to get it right. They have ignored the Enterprise for nearly two decades and the only reason they are selling experiments is for market share.
Mind you, my next question is going to be, OK APPLE wanna play Active Directory? So what's your solution to replacing Active Directory? When they answer that question, I will believe Apple is thinking "Enterprise".
Mac-Mgrs (Macintosh Managers) a mailing list in existence for over 10 years, has covered this issue, and every other issue regarding managing Networked MacOS machines in a multi-platform environment.
They keep an archive, which is available for public searching. Go there, and search the "new" archives (post April 2000) for "Active Directory."
The list is an excellent resource for troubleshooting MacOS (Classic & X) management issues.
Mac-Mgrs also has probably the best s/n ratio on the Internet, as well as throwing a great geek party at MacWorld Expo twice a year. =)
You are soo right. Novell's products are an administration dream! NDS eDirectory is incredible. I have never met a sigle tech guy who didn't praise Novell after having used it. Novell's biggest problem is the fact that Microsoft has much better marketing.
To meta-quote Apple's guide to interact with Active Directory Services:
.. assumes that you have in-depth knowledge of Active Directory, especially the ways in which it need s to be configured to support standard LDAP schema definitions. Because the primary means of accessing Active Directory is ADSI, using LDAP as an alternative implies a thorough working understanding of the use and limitations of the LDAP support provided by Active Directory."
"Mac OS X uses the LDAP protocol, not Microsoft's proprietary Active Directory Services Interface (ADSI), to connect to Microsoft's Active Directory. This
It sounds like someone didn't know Active Directory sufficiently, hence the pain. Otherwise, setting up things on the Mac side is very simple and strait-forward. O'Reilly has a great book " Mac OS X for UNIX Geeks " that goes into great detail on explaining not only what to do, but what is going on behind the scenes.
In this case, I would be Active Directory Services is making things the most difficult for you (and the fact that OS X uses LDAP instead of ADSI).
Cheers!
Sean
The Active Directory documentation for Jaguar Server is now integrated into the Mac OS X Server 10.2 Admin Guide; from http://www.apple.com/server/resources.html:
2 015
Active Directory for Mac OS X Server v10.1: Learn how to integrate Mac OS X Server v10.1 with Microsoft Active Directory. (v10.2 customer, refer to the Administrators Guide for Active Directory integration documentation.)
The Mac OS X Server 10.2 Admin Guide is available from:
http://docs.info.apple.com/article.html?artnum=12
Particularly, see:
Chapter 2: Directory Services (p.65)
Using an Active Directory server (p.104)
I work for a large university, and I've been working to integrate Mac OS X with flat BSD files (for both the GUI and other environments). I have some tips for anyone intent on doing the same - dave (at) math.umn.edu. Apple support (the people to complain about when you've already bought the product) didn't help me at all.
:)
Back to the business: Gordon Shukwit (who I talked to last week) is writing white papers on integration with Active Directory, and said that "[he'd] have them done soon" (<- perfect for slashback). I won't publish his e-mail address because having a slashdot story about it is already enough pressure
Using LDAP is the way to go, but when you already have a Windows-based authentication infrastructure in place, you don't necessarily have that option. Hence pam_smb_auth
retrorocket.o not found, launch anyway?
So I invent something. You create a product that says it will work with my new invention. Your product doesn't. So it's my fault? Total nonsense. About as nonsensical as the score you got for your post by the MS hating, elitist moderators. --gary
I had a excellent Novell experience today. :)
.htaccess file, you can point it to the NDS directory instead, very cool indeed, it would look something like this.
.organization [.context.organization]
I just installed a demo of Netware 6 today, I was amazed by the number of programs coming with the server as default, damn. Just look at the web admninistration.
When talking NDS, I discovered that now that Novell runs PHP,MySQL,Perl there is a greater reason to run apache web servers on it.
And what was even better, you can now authenticate users against your NDS in apache. cool. Just like you would use a
-----
AuthType Basic
AuthName "Secure_Site"
AuthNDSTree TREE_NAME
AuthNDSContext
AuthNDSRequireSSL [on|off]
require valid-user
order allow,deny
allow from all
---
It was very cool to see my php/mysql applications running on a netware server, I didn't need to change anything in the code, I imported my SQL data into MySQL and it was running.
my sig
...you invent a square wheel. I, on the other hand, employ round wheels in my product (i.e., the standard configuration). I tell people that they can use your crummy square wheels if they want. People use your crummy square wheels and complain to me that the ride is bumpy.
Along with the becoming more and more useful macosxlabs.org, there is the idea that if you cough up $150 per AD server for MS Services for Unix, this software will do most of the work in terms of schema modification.
You don't have to use the file/print services installed by this software, but that may be helpful to you.
We've already covered this in slashdot. Check out articles concering using PAM with AD and there should be a thread there as well.
Mod this up, I hope it helps. Irrational bleats like "IT'S a NIGHTMARE" help no one, especially yourself.
Slashdot! Linux Hackers! Hah! It's obvious (based on 90+% of user comments) slashdot is for homosexual windows fanboys.
most of these people are definately stupid. You have a MCSE right?
'nuf said
Yes, it's a blog. Sorry if that offends you.
As a side note check out mod_auth_mysql - http://www.diegonet.com/support/mod_auth_mysql.sht ml
:)
to do user auth against mysql as an apache module, works like above.
There's also http://www.giuseppetanzilli.it/mod_auth_pgsql/
Novell is playing attention to the good stuff
Of those to whom much is given, much is required.
I play it cool, and dig all jive ...
That's the reason I stay alive
Cool to find another Hughes fan on Slashdot.
As for that book, it spends too much time on basic
unix stuff like what a here document is. As a friend
of mine quipped, it should be called "Unix for Mac
OS X Users".
Ben "You have your mind on computers, it seems."
Our method involves authenticating to AD via LDAPv3, and automouting a volume over SMB. We've just put this doc together over the last few hours, but will try and work more on it in the next few days. It can be found here at the bottom.
(the way you're going)
We have a MacOS X Server 10.2 and are having lots of trouble serving up files via SMB to Window users.
There are a bunch of notes on various message boards with similar login/authentication problems. One trick is that you can't use local password storage for SMB accounts - you have to use a password server.
But even then it didn't work for us. Hopefully Apple will get it right soon, but for now MacOS X Server is not quite ready for prime time.
Of course, configuring Windows and Unix servers for cross-platform work isn't exactly simple either.
OS X active directory how to
The first thing to show up is an Apple PDF on how to do it.
Stop wasting everyone's time and making yourself look really stupid.
- type big long SMB connection strings (Apple-K, then smb://WORKGROUP;user@host.domain/volume)
- don't mind having
.nsmbrc on my home directory with stuff like this: - don't mind not being able to print a darn thing.
I can browse the domain more or less (less than more). It's a real joy compared to 10.1.A programmer is a machine for converting coffee into code.
As a friend of mine quipped, it should be called "Unix for Mac OS X Users" hahahahahahaha LOL wow!!! You're friend is very witty and funny indeed User #9959, any chance of catching up with this intellectual giant online my friend? Oh to have friends as smart and quick witted as this unknown person!! You must be a very elite hacker indeed benedict (no-caps on purpose because User #9959 is entirely too cool to capitalize his name you see and if oh piss on it... you are not worthy of my lord and master benedict) ... oh to be your friend and apprentice!
Benedict! Benedict! Benedict Peters....King of the useless posts!
Can I say it again for posterity's sake benedict??? Can I? Please??????
Unix for Mac OS X Users
Great Benedictine!!! I'm excited by our conversation!! Do reply in great detail about your Unix haXory exploits my friend... I cannot wait one minute more!!!
I actually think of it as a feature rather than a "bug", if the poster talks about MACs you can tell immediately that he knows jack about them
There are two rules for success:
1. Never tell everything you know.
(way, way off tangent) the thing that frustrates me about open source is that much of the enterprise stuff is still -not- as good as some of the stuff Novell produces... because most people are content to simply copy Windows features (which is all most people know.) It is _definitely_ worth the effort to spend some time with Novell's technology and see how good network management can really be.
Besides, all of you losers probably belong in prison next to the DoD warez guy..
I just recently setup our Mac OS 10.2 server utilizing our Active Directory server. Here are some tips that may help.
1) Do not test with OS X Server. I used the Java LDAP browser, available at http://www.iit.edu/~gawojar/ldap/ to check for a proper connection. Once I got this to work where I could see the LDAP user data, I plugged those same settings (User/Password, search base, IP, etc) into Directory Access for OS X Server. OS X Server does not give as much diagnostic feedback when testing as the LDAP browser does.
2) Do not add a cn=Users to the search base. Yes it may be necessary, but OS X Server will do this for you. By adding it, you will have 2 cn=Users which breaks it. The search base should look something like dc=mydept,dc=mycompany,dc=com.
3) In Directory Access use the Active Directory template (not From Server, or Custom). In most cases this will work without any mappings making it a simple Directory Access setup.
Hope this helps
Rik
Go all Windows now and mortgage your house. You WILL be assimilated.
Using a 10lb sledgehammer, smash the Active Directory server. If it pops up again, smash it again. Once you've completed this essential step, your Microsoft compatibility problems will be over though your legal problems may be just starting.
See, not complicated at all! If you're locked in, smash your way out...
Password servers? I don't even know what those are, but I got the SMB file server and client on Mac OS X working with Windows XP without any problem at all...
What problem are you having?
What about going the other way?
Can one use Apple's OpenDirectory and netinfo to not only have Windows authenticate against it but also set GPOs?
Could it possibly have something to do with the resource forks Apple incorporates into the file system? You know, the ones to identify file/MIME types to the OS without relying on extensions, and which are typically hidden from users?
I could be way off, but that part of the file which Windows understands could be copied, while the resource fork might be left behind.
You have given me more information on OS X server than any of the Mac "salespeople" I have to deal with. It's greatly appreciated.
:)
...including the ability to change a clone into a master if the master fails...
We are mostly a PC shop, but my boss is a Mac nut....it might just be time to convince him to let me buy an OS X server
In fact, the AD replication process is actually fairly complex...
You said it! Have you ever configured two bridgehead servers? Ugh, no fun to set up, but it works pretty well once up and running.
I have to admit, the Active Directory replication process is pretty cool. It manages lots of info, does conflict resolution well, and does not need tight time synchronization.
Does the failover have to happen manually? I like the idea that if one of my AD-DCs fails, I automatically have another master (since all Active Directory domain controllers have a writeable copy of the Active Directory). Does OS X have the ability to "auto-promote" a slave to a master?
-ted
That's completely different, and you bloody well know it. This isn't an "embrace and extend" kind of extended... Apple is still running OpenLDAP, they haven't broken interopability at all, not like what Microsoft did with Kerberos/Active Directory at all. Any other LDAP client that implements the standard can still talk to Apple's install of OpenLDAP...
i don't read slashdot anymore.
Well, I can definetly say that netware ease the pain of administrating a windows network. I've worked with netware 2, the great file system of netware 3, the excellent NDS with netware 4 and the wounderfull ZEN and groupwise of netware 5. But for the sake of discussion, I'll be the devil's lawyer here( does that expression make sense in english ? ). Novell is great if you have a microsoft os network but beeing a macintosh guy, I can say that I've rarely seen such a lousy mac support. I don't know is it's true for other platform ( linux, solaris, be,...) but for mac, the support was next to 0. You were stucked with an outdated, unreliable, bindary only, badly integrated with the os client. Maybe things have changed in the last 2 years but I doubt it since a search on novell.com download section for product:novell client platform:macintosh returned nothing. And the cost is prohibitive. Even for the education marked, it ran in the 30000$/year.
It's not because we laugh that it's funny
I have setup OSX clients to authenticate and automatically mount their home directories using both 10.1.5 (LDAPv2) and 10.2 (LDAPv2 or v3). It works great once you have it setup correctly.
Just to be clear, this is with *no* replication of account information between AD and OSX. All account information is stored in AD and stays there. The clients don't store any user information.
Also, I have done this with both win2k and OSX servers for home directories.
The article from Apple (OSX integration w/ AD) is a good start for the basics. Much of it applies when moving forward to 10.2, except that many of the setup screens are different.
My main recommendation is to *not* use their schema definitions. The reason for this is that they tell you to piggy back on existing attributes in AD. While this is nice from the standpoint of not having to edit the schema much, other MS applications may need those attributes for their own use. For example, they tell you to put the home directory URL (an xml description of the home directory location) into the "HomeDirectory" attribute. This, however, is used by MS clients to find their home directories. If you have users that cross between windows and mac, it won't work.
Instead, I'd take the schema from the Open Directory service which comes with OSX Server and pull out the attribute names and OIDs from there to use. The only thing it is missing is an attribute/OID for the "NFSHomeDirectory", which they recommend you use "UserSharedFolderOther".
Also, don't add the attributes directly to the existing user class. Create another class with those attributes and add it into user class as an auxiliary.
I agree that the docs really need alot of updating to make this possible for the average admin to deploy. However, Apple has provided the technology to have a very nice integrated solution once you know what you are doing.
This solution is actually fully deployed at one public school in Massachusetts and partly deployed at another one (they are still in testing). Students are able to sit down at any OSX system and have their desktop, preferences, and documents follow them around seamlessly.
Here are some things that might help folks:
Tip #1: /etc/openldap/schema is a directory full of schema information. In particular, you want to look at apple.schema, which has all of the weirdo Apple definitions.
Tip #2: Start with the RFC 2307 definitions and modify from there. Be aware that you will also need to match the objectClass for the type. i.e., when you click on Users in Directory Access, you need to list posixAccount, inetOrgPerson, and shadowAcount so that it pulls all of the necessary fields from those objectClasses. This is different than how it worked with LDAPv2 and under 10.1
Tip #3: Location management does NOT work with LDAPv3, despite the shiny pull-down. If you are on a PowerBook and use Locations to move around, you do not want to set up any sort of services.
Tip #4: "lookupd -d" is your friend. Use it to debug what your machine sees from the LDAP server and what you need to work on.
Tip #5: You can do NFS mount points, but they aren't pretty:
VFSLinkDir =Tip #6: You should match all of the fields for mount, even if you don't fill them in. For some reason, automountd wants to be able to look it up values that make no sense for a remote mount.
Hope this helps somewhat.
And judging from the posters who attacked Apple's supposed "seamless" claim, that's how it would be reasonably interpreted.
The best that Apple claimed was "peaceful". That may be a marketing weasel-word with no meaning, but it's hardly the same as "seamless". After all, the U.S. and North Korea are living peacefully together right now.
Adam Brate
author,
You are a dense man.
In terms of your analogy, Apple has said: my product works with both round and square wheels, so buy it. I buy it. It doesn't work with square wheels. I need it to work with square wheels. So next time I don't buy Apple.
If someone were to 'extend' the way that an LDAP consumer interacts with a supplier, there's an issue. As it is now, every set of LDAP software has its own way to handle direct replication of data.
/etc/passwd normally).
However, the type of information that can be placed into an LDAP directory is handled by the schemas.
In much the same way, a database server doesn't care what your table definitions are to maintain ODBC compliance.
Now, in this case, we have schemas, which much like a table definition, define what sort of information is allowed to be placed into the directory. It may be mail addributes, such as 'rfc822mailalias' and 'mailforwardingaddress', it might be posix authentication information, such as 'loginshell' and 'homedirectory'.
In this case, I have no idea what schema extentions OS X may require, but the standard posix attributes would make sense (ie, what you'd find in
Build it, and they will come^Hplain.
Well, that's all well and good but the subject of the message is integrating Mac OS X with AD. I've played around with the third-party Novell client for OS X and I merely find it, okay.
:P
Besides that you've completely missed the point as the poor sod above is simply looking for some help keeping his new Unix boxes hooked up to the insanely complex and costly network that his bosses have imposed on him, which he (or she) has little or no conrtol over.
-cman-
MCSE, CNE, AppleCare
"Being Irish, he possessed an abiding sense of tragedy which sustained him through brief episodes of joy." -W. B.