Practical usage / difference - local vs server (local / network) accounts

I have purchased a book on Mountain Lion Server, looked on the Apple support community and the Internet but I cannot find a clear answer, or explanation, to my query.
Instead of looking at the features in Mountain Lion (ML) Server and Open Directory (OD) I'd like to approach this in terms of the functionality I would like to achieve. I am sure that many other people have had, will have, the same sort of questions.
Some background: I have an all Apple home network — few Mac machines (iMac, MacBook), iPad, iPhone & Airport Extreme. I recently purchased a Mac mini running ML which I have setup as a server. The installation went OK and the DNS setup is fine.
This is my question / requirement / clarification needed.
As I understand it there are three types of user accounts in OS X + OS X Server with OD:
Computer (standalone) Local — basically the account you would have on a Mac if you had only the one machine. Using (as I believe) a local 'Open Directory' (?) database.
Server 'Local User' — an account on the server using a local OD database on that specific server.
Server 'Local Network User' — an account on the server using a networked OD database on the server.
Below is what do I want to do — this is the functionality I want / don't want. I am aware that some of this functionality may, or may not, be available on OS X + Server + OD. Also I am looking at this from the perspective of a systems administrator of Windows + Active Directory sites — not saying that Windows & AD is better, but that that is my experience & frame of reference.
Access to shared common services — DHCP, DNS, Files, Mail, Calendar, Contacts, Messages, Time Machine backup, VPN. That is all the goodies I expected to get with a dedicated Mac mini OS X server machine.
To have access to those services within the home LAN and, as relevant (Mail, Contacts, Calendar, Messages) via the Internet. If via the Internet then securely via use of certificates.
Each user (currently) has their own machine with their (Unix style) home folder & files on that machine (the MacBook may have more than one account on it) and is logging locally onto their specific machines.
I do NOT want to have the user's (Unix style) home folder (and all folders within) to be on the server.
Users must be able to log onto their machines (i.e. MacBook) when outside the LAN and be able to access their local machine files.
Now we come to the question of which type of OS X + OS X Server (OD) account do I use for people — keep the local machine account? Use server account? If so then which — server 'Local User' or 'Local Network User'. Of course this can be framed as which OD a user authenticates against and what are the ramifications of each method.
Also relevant is the point that I don't believe OS X Server + OD supports the same concept of Windows called 'cached credentials'. Which means that I couldn't have, for example, files on a computer (MacBook) which have an ACL referencing a server user account GUID because they could not be accessed if the user account was not able to authenticate (outside the LAN) with the OD server.
Anyway to the questions — to achieve all, most of, the five functionality points in the list should I use (and why if someone could explain rationale):
Combination of computer (standalone) Local + server 'Local User' accounts? Obviously as users will be accessing resources on the server it cannot be just Computer (standalone) Local accounts.
Combination of computer Local + server 'Local Network User' accounts?
Just server 'Local Network User' accounts
I am suspecting that it will be option 1, combination of computer (standalone) Local + server 'Local User' accounts. If this option is used would there be a problem if the two accounts have the same username?
Thanks for any help, advice, and/or instruction. Also if anyone has links to further information that would be much appreciated.

Most services (calendar, contacts, vpn) require that your users authenticate via Open Directory.
Your admin account can be local, but put your users in Local-Network (in 10.8 terms)

Similar Messages

Can't login on iMac to Local Network accounts on server

I'm a volunteer at the Marjorie P Lee retirement community. We had two iMacs that were available for residents to use. We recently bought two more iMacs and a Mac Mini Server. The goal is to make it possible for residents to use any of the computers and have their files available.
I have set up the server and did the updates so the machine is running 10.9.4 and the latest update of the server software. I have enabled Open Directory and created a couple of Local Network User accounts for testing. I also enabled file sharing and Time Machine backups.
One of our older iMacs is running OS X 10.6.8. On this iMac, I went to the Users & Groups pane and under Login Options I connected to the Network Account Server. I got the green dot indicating that the connection was successful. I then enabled network logins. This worked; I am now able to login on this iMac to the local network accounts on the server.
I did exactly the same thing on one of our brand new iMacs. Again I got the green dot indicating a successful connection to the server. Unfortunately I have been unable to login to the local network accounts from this machine. When I try to login, the password shakes as though I had entered the wrong password.
What do I need to do to fix this?
Thanks for any help you can provide.
~~Dan

Most likely your Imac is using g or n to broadcast wirelessly while your router is using b. Solution update your router.
Greetings from Northern Ontario, Canada

Mail service doesn't authorizes local network accounts

Hi,
i am new to OS X Server, to i am still playing with a test server before i will move it to production:
1. what i have:
Mac Mini with clean Mavericks install and clean Server 3 installed.
It has real IP and FQDN.
services launched via Server App: DNS,DHCP,LDAP,Mail.
I have one local user (admin)
and created one local network user.
The problem i that from mavericks client i can authorize to IMAP server only using local user name and when i try local network user - that doesnt work.
What am i doing wrong?

The fact you are using a 46.xxx.xxx.xxx address means that your server has a public IP address. This is of course not illegal but perhaps unusual. More commonly the server would be on your internal network and you might setup your firewall to forward necessary ports to it.
A possible consequence of having a public IP address is that another DNS server might be in charge of your domain, e.g. your ISP. Your ISP would then have to define both the hostname and equally importantly the reverse DNS record. It is possible to run the master DNS server for an official domain name yourself but this is usually only done by enterprise level businesses, SME size organisations would leave this to the ISP.
If our ISP is running the domain then either you need to get the to add all the necessary records including the correct reverse DNS records, or you will have to duplicate every record i.e. hostname yourself and ensure you don't make any mistakes. The Mac software will automatically setup the reverse DNS records.
Your server then needs to use the correct DNS server and so do your clients.
Try testing either in Terminal.app or using Network Utility doing forward and reverse DNS lookups. This might be easier in Terminal as explained below. Do this on the server itself.
In Terminal type nslookup serverhostname.domain.ru 127.0.0.1 (This will do a forward lookup using the servers own DNS server, it should return the IP address of your server i.e. 46.xxx.xxx.xxx)
In Terminal type nslookup 46.xxx.xxx.xxx 127.0.0.1 (This should do a reverse DNS lookup and return your server FQDN)
In Terminal type nslookup serverhostname.domain.ru 8.8.8.8 (This will ask Google to do a forward lookup and return your server IP address of 46.xxx.xxx.xxx)
In Terminal type nslookup 46.xxx.xxx.xxx 8.8.8.8 (This will ask Google to do a reverse DNS lookup and should return your server FQDN)
The above will help show if the rest of the world is using a different DNS server with different settings for your domain. It will also show what your own DNS server is doing. Usually you will have your server configured to use itself as the DNS server and this is usually done by entering the address of 127.0.0.1 in network settings.

AD and Local Network accounts take three attempts to log in successfully

Our lab's Mac Mini server is running a patched-up 10.9 + OS X Server (though this problem has persisted since 10.7)
Our server is 'local' to our laboratory and serves 4-5 machines, 10-15 people.
The server (and the connected machines) are bound to the college's Active Directory server.
We have a 'Local Network' group (called FlipLab) on the Server that contains laboratory members from the AD server.
The lab client machines are set to only allow network logins from that group. We also have an occasional 'visiting' scholar who doesn't have a college-wide AD account, so we set them up as a 'Local Network' user and add them to the FlipLab group so they too can log in to the lab's machines.
About 75% of the time, a user logging into a lab machine take three attempts to get logged in successfully. We've noticed that they don't need to re-type the password or username each time, just once and hit 'enter/return' three times in the password field. It never takes two tries- only either one (very rarely, usually after successfully logging in earlier in the day) and more commonly three tries.
This doesn't seem to happen with file sharing (though I think one of the guys has noticed an occasional problem logging in to a SMB share from a Boot Camp'd machine). It isn't a problem w/ Time Machine backups either. BUT We recently noticed that even the 'Local Network' users (e.g. belong to the FlipLab group but don't have AD credentials) occasionally have this problem. Hitting 'return' three times in the password field gets you logged in though in any case (well, assuming you have your password correct).
I've tried moving around the directory search order on the client machines, but not in a systematic-enough way.
Since we can get logged in this isn't the worst problem ever. But I'd like to be able to figure out what is going on - and maybe learn something about configuring it in the process.

Thanks- good observation.
Unusual, perhaps, but it is what we need in our setting. And- allegedly this is supported / encouraged based on my understanding of the OS X Server docs. I don't have any control over the AD server (since it's in the university-level IT management's hands) but I -do-, of course, have control over my own server. So I just want to use their authentication (and save my students / lab folk the trouble of having multiple logins, etc).
You make a good point / observation / point-of-debuggery. Indeed, if I set the client machines to use -only- the main campus AD server (and thus allow logins from everyone on campus) it works first time. So it is some interesting interaction betwixt the Mac OS Server and the client methinks. In fact, across campus, all the 'public' machines are simply bound to the AD server and you can just log in that way.

OS X Server and Network Account Server

May I install OS X Server on Mavericks when it has a network account server configured? Or is the one functionality (here network account server) excluding the other one (OS X Server)?
Thanks,
Yves

Thanks for your reply.
I believe I got it to work, but,... How do you get the network account users to show up on the login window of the client computer? The login window shows the name of the client computer and the local accounts on the client computer. When I select Other in the login list I can login using a network account user id and it logs in. The network account user names do not show up on the login window

New Snow Leopard Server, Slow Network Accounts

We've installed Snow Leopard Server on our XServe quite a while ago and since then all users who work with network accounts are complaining about serious perfomance issues. These issues are for instance logins which may very well take up to several minutes, or applications like Adobe InDesign which take their time to load files from the users network shares.
Our System consist of:
1 XServe running OS X 10.6.8 Snow Leopard Server
48 iMacs running OS X 10.5
1 Windows Server 2008
The XServe serves as an OpenDirectory and Fileserver, while the Windows Server delivers DNS.
We have created ~500 users and 25 groups in the OpenDirectory. All user files are located in their roaming profiles on the Xserve. Additionaly every user has access to one group folder, which is located on the Xserve as well.
All group folders are Sharepoints and added to the dock of all users in the appropriate group.
I have already checked DNS settings, user accounts, network connectivity in general, network load during peak hours, the ACLs on the group folders....
By now im simply out of ideas what my cause the problem, let alone how to solve it.
Any hints are greatly appreciated.

Are you using any redirections? Redirecting the cache folder from the network home to the /tmp should improve speed. Use this white paper from apple. http://images.apple.com/education/docs/Apple-ClientManagementWhitePaper.pdf The redirections are on page 53.

Does it make a sens to have network account without Mobile

Hello there,
I am setting a server with network account.
From my Imac, I joint it to the server, I can see the remote home folder.
But I really ask me if it make a sens to work without Mobile because Illustrator CS4 crate file in /Home/user/Library/Preferences/Adobe...
Without Mobile enable it can not crarte that folder on the remote account (in the server side). To make it working, I enable Mobile it the Synch setting. Then when you lunch for the fusrt time Illustartot it creates the concerned forlder in Local, and when we log oft, the folder is synchronized into the server.
Then I ahve to enable th Mobile to make it working,
But My boss deoes not want to have Mobile. excepted for me above comment, does it make sens to work without Mobile?
thank for your point of view

Any idea? Thank

I can not run any Adobe application (Not responding) with a network account

HEllo All,
My First question:
Which impact will I have if I copy the content of
/Users/Library/Preferences/
to:
HD/Library/Prefernecs/
Here is my problem related to my first question:
I installed Illustaror, photoshop, adobe Acrobat Pro, and adobe reader on my iMace runing 10.6.1.
I installed its with my local admin account and all run fine.
I also have a X OS Server with network account.
I joined my iMac on that server and when I log with a network account, all of my a
Adobe application are not responding (Illustartor, Photoshop, Adobe Pro and Adobe)
I red That I should copy /users/Library/Preferences/Adobe Illusratot CS4 Setting/ folder to the user home folder within the same path.
This is work.
But how can I make sure that all of ALL my Adobe application will work for all Users??
many than for your help
Message was edited by: pierrot10

Hello,
Someone has an idea to help?
The problem is for illustrator, adobe reader and adobe pro. For all of them, when I run it with a locl account, it works, but when I run its from the same workstation but with a network account:
- illustartor freez
- adobe reader craches and retsat and craches...
- Adobe Acrobat pro freez.
Only photoshop works.
Do you have an idea how can I make it working with a network account but only from the same workstation?
Many thank for your help
Pierrot

How can I connect to SQL server database thru local network by using JSP?

I'm currently doing a project by using JSP..And I need to display record from the SQL Server database in our school's local network. May I know how can I do that? How can I write the code so that I can able to access the SQL Server databsase Throught school's network by using JSP? Please tell me step by step how can I do that. I'm using Tomcat 4.1 as Web Server. And I had J2SE and J2EE installed in my computer.

first you have to establish a ODBC DSN on your computer,
that connects to the database...you can do that from your control pannel.
i assume that the TOMCAT server is residing on your computer....(if the webserver is in other computer then you would have to create a System DSN on the data sources ODBC option in the settings>control pannel of that machine)
then you can use that DSN name to connect to the data base from the class file....for further assistance on how to create the class that access the tutorials in sun site.
regards
G

VPN Server with two router local network

I just got a Mac Mini Server 2011 to set up as a home server. One of the main features I want to use is a VPN so I can access my files on my local network when I'm away from home. I live in Japan and I have a Japanese optical connection to the internet that runs through two boxes before I can use it in any form: some sort of modem, and a "gateway" which I literally just found out is also acting as a router and serving DHCP addresses. In addition, I have a 2TB Time Capsule that, until just recently, I had been using in the "Share a Public IP" mode because I didn't realize the gateway was also issuing DHCP addresses. I cannot simply plug my TC into the modem in place of the gateway - both are required to access the internet.
Until today I had both routers using DHCP on the local networks they each created. Under that environment, I had finally configured Lion Server to file share (easy), manage network accounts (moderate), and serve Profile Manager (difficult). But despite my best efforts at mapping the ports on the Time Capsule, I just couldn't get the ports open using tools like canyouseeme.org, so the VPN was a no-go. That's when I realized the gateway could be a router too, so with some creative google searches, and extensive use of google translate, I was able to figure out how to open ports on the gateway. It does it pretty differently from the Time Capsule and other routers I've seen. It asks you define the host on the LAN (what i assume to be the target IP), the protocol (TCP vs. UDP), and then a range of ports for it to open. I plugged in the IP of the Time Capsule, opened all the UDP ports (since it was an option to just open all, and I figured 1) the TC would still protect my network and 2) it would just be a test), but I still couldn't see the ports as being open.
So then I got desperate, and I switched the TC back to Bridge Mode, reconfigured the Server and my MBP (my client Mac) to the new IP addresses being served by the Japanese gateway, and tried again. I think I reconfigured the DNS settings in Server Admin properly to account for the change in IP, and then updated the services in Server.app, but now I can't even get to my server homepage (the apple placeholder page) using either its IP or its .private domain, and to make matters worse, I STILL can't seem to get the ports open (yes, I changed the port mapping to send it directly to the server IP as the target after the change).
To add insult to injury, the wired ethernet connection I had been running from my TC to the MM Server is now reporting a cable unplugged (it's not), even when I plug it directly into the gateway, though I am able to connect wirelessly.
Does anyone have any idea what's going on? Why can't I get these ports open? (By the way, I called my ISP and they said they aren't blocking any of the ones I'd want to use for VPN.)
What is the *better* set up - using the TC as a second LAN, serving its own DHCP addresses, or using it in Bridge mode?
Why did these changes sever my wired connection?
I was getting even more problems (like loss of internet connectivity on all devices) using the TC in bridge mode, so I decided to go back to the dual network setup.

Hello Eric,
As I mentioned above.
For external Internet access, I would create a Generation
1 VM
and use 2 Legacy Network Adapters for
the Interfaces . Connect it to the External and Internal network, and then install VM Linux IPFire (How
to install) and
configure IPFire with RED and GREEN interface.
You don't need router or any firewall.
I have the same set-up that you are trying to do in your lab and it's working great.
All my VMs / computers on the LAN have their gateway the Linux VM.
Hope this help.
Regards,
Charbel Nemnom
MCSA, MCSE, MCS, MCITP
Blog: www.charbelnemnom.com
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

My server has Two NICs ! I want to use one of the NIC for the internet and the other to a local Network .

In my case , there is a server ( windows 2008 enterprise) . Instead of sharing the internet using the server . i have done the following .
i have 24 port switch which is connected with the modem (ISP Gave it to me). My server then is connected with the switch . the client pcs are also connected with the switch(d-link switch).
my objective is to enable efficient way of file sharing from server for client pcs and also internet sharing at the same time for client pcs!
my server has two NICs ! how to make the local network and internet work with out a fight!
how could i achieve this ? help me guys
regards

It really depends on exactly what the equipment from the ISP is. If it is a simple modem there is no point in connecting it to a switch. It needs to connect to a router.
You can connect it to one NIC of the server and configure the server as a (NAT) router (with the other NIC connected to the switch).
If either of the switches is actually a router you can use it as the NAT router and run the server on the LAN using one NIC.
Bill

TS3090 Is there any good way for using a network account locally on the server?

We have a bunch of macs at home. I want to be able to login to a laptop and have my account (home dir) in sync with de desktop account in a noninvasive way.
For achieving this I thought promoting one imac to be a network profile server would be a good solution.
This way we can work on any machine and sync portable home directories (phd) with our laptops.
The server should also be usable as a workstation.
One problem is: is possible to login on the server (locally) and work in a network account?
I know it is possible, but this article describes issues.
Also i am concerned about perfomance because files wil be mounted over afp rather than being on the harddisk. (one workaround would be to have a phd on the desktop, this would however not be possible on the server itsself (unless you have two copies of the home directory there))
Does anyone have any experience with a simular situation or perhaps some other helpfull insights.

Sorry, you must have edited your message. When I saw it, only the title showed .
Embedded is what you want. You can change the windows apperance (e.g. hide the scroll bars) by changing the VI properties.
Uncheck "request control" in the web publishing wizard, and it will be read only.
Works fine here in LabVIEW 7.1. I don't remember if 6.1 had any limitations.
LabVIEW Champion . Do more with less code and in less time .

Console cannot connect to Admin Server in a local network

Hi,
This issue may has been asked before, but I didn't find corresponding answer. So I ask again:
The Directory server 5.2 P4 is running on Windows XP and a console running on the same server (192.168.1.80) works fine. However second console which is running on 192.168.1.50 can not connect to admin server. Error message is:
Cannot connect to the Admin Server "http://homeserver.keiban.com:5201/" The URL is not correct or the server is not running.
I noticed that if I use http://192.168.1.80:5201 to connect admin server instead of http://homeserver.keiban.com, it took 10 seconds to show Initialization Failure:
Connect connect to the Directory Server "ldap://homeserver.keiban.com:5200" LDAP error: failed to connect to server ldap://homeserver.keiban.com;5200 Would you like to attemt to restart the Directory Server?
In Control Panel -> Windwos Firewall -> Exceptions, I have added port number 5201 for Sun ONe Admin Server 5.2 on TCP.
In etc/host file, an entry is already added:
192.168.1.80 homeserver.keiban.com homeserver
Both computers are in a local network and via cable DSL to connect to Internet. Is there some thing I am missing?
Your help will be appreciated,

1. Make sure your FQDN is set up correct on both
client and Server.Victor, you are right! I setup FQDN on server properly, but forgot to have FQDN setup to map FQDN to IP address on client. So the Console goes to Internet to find the directory server in which it causes failure.
Thanks your hint,
a. ping xxx.xxx.xxx.xxx from client to Server
Check the Admin Server for Client Access Control
configuration.
Victor

Can't access BI 11g server from local network.

I have a problem..
Hope someone can tell me the solution.
I've installed BI Publisher 11g in my server. From the server, I can access it via web browser with URL http://localhost:7001/xmlpserver/servlet/home
The problem is, when I try to access it from other PC in my local network with URL http://10.11.9.190:7001/xmlpserver/servlet/home, the page fail to show and there's connection timed out error.
I'm using Windows7 in my server.
Is there any configuration that I missed?
Thanks for helping me..

The best way around firewalls is to stream using port 80. This is a preference setting in QuickTime Streaming Server and QuickTime Broadcaster. This will allow the stream to pass through the hole in the firewall usually used for HTML (web page) traffic. HOWEVER, you cannot use this port if you are also running web server services (Apache) on the same computer/server since they need to use port 80 also. If you need to host a web site AND stream QuickTime using port 80, you will need two computers (or at least two IP addresses; one for each service which is a little tricky. If both services are trying to use port 80, weird things will happen, most often the HTML data will rule and the streams won't work. This has been my experience. Good luck!

If remote access is allowed on the server, Then can my users on the local network access this server by ie

Dear all,
If my server is enabled for the remote desktop connection, then the users on the local network can access my server IIS services by entering the IP address of my server in the IE (http/https) on the local network only.
I went to control panel>>system>>Allow Remote desktop Connection>>with network level authentication.
Now If my team wants to access this server not by opening the Remote Desktop Connection, rather by entering the IP address of my server on the IE and access the resources offered.
Is it possible by this way,
Or is there any other method to do so.
Regards,
Ahmed

3. My web Developer is installing an application on the server for our department team. To test this application running, he wants to access this application through the local machine from browser (rather than logging in through the remote desktop connection).
4. He wants this application to run on the local network only.
5. He wants me to do some setup, that he must be able to enter the IP address of the server in the browsers address bar on his local machine and test the functionality of his application on the local network.
If this is the requirements of the developer, I guess he wants you to configure IIS.
You can do a test, whether IIS is working properly.
Log on to server, enter https://localhost or http://IP_address_of_the_server don't know whether some ports are configured in order for your IIS to work.
check out this youtube video:
https://www.youtube.com/watch?v=tNAdv1EPj-I
Every second counts..make use of it. Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
IT Stuff Quick Bytes

Practical usage / difference - local vs server (local / network) accounts

Similar Messages

Maybe you are looking for