10.5 OD Master needed for 10.6 wiki & iCal?

Question

Hi folks,
I am having a hard time getting OD users on 10.5.8 to login to 10.6.2 iCal and wiki. Is this setting up supposed to work? I can't find any info from the Apple's OD Administrator's guide.
Set up :
* one 10.5.8 server running OD master
* one 10.6.2 server running wiki and Apache
* one 10.6.2 server running iCal and Apache
* one 10.6.1 server running Mail service
The server for Mail does not bind to OD for authentication, and after assigning each OD user in group "com.apple.access_mail" all users can connect to mail service and get/send emails. Authentication is working perfectly.
However, based on the same OD master and user accounts, using the same connection methods (enabled iCal and Blog services in 10.5.8 server, without turning them on, and assigning users to both services in SACL) in the Wiki server and iCal server won't let any OD users to log in. In wikid's error log, I can see the following error msg :
[HTTPChannel,19,127.0.0.1] Unhandled Error
Traceback (most recent call last):
Failure: twisted.cred.error.UnauthorizedLogin: Bad username or password: <username>
Here are the questions :
* can 10.5.8 OD be used for 10.6 wiki and iCal service? Or must I configure 10.6.2 OD (either in another server or in the same host?)
* must the servers for wiki and iCal bind to OD in order for the services to work?
* must Kerberos be running for the services to work?
Thanks for any suggestions!
Charles So
Message was edited by: Charles So

Answer 1

Hi Holger
I've got it sorted. Here is what I noticed and did as a result.
There is no need to add group "com.apple.access_mail" to every user who wishes to have access to Mail service. Something has gone inherently wrong in the 10.5.8 OD master. I re-installed the 10.5.8 OD a number of times (due to bad media during installation), and re-input the user accounts one-by-one, WITHOUT restoring the previous archived user data. This step is critical, because it seems that archiving will also archive the bad data, and restoring to a new installation of OD master should mean you still have a bad OD master.
Re-install the other servers (10.6.2) from scratch. During the Server Setup Assistant stage, at the "Users and Groups" screen, choose "Connect to another server". Specify the 10.5.8 OD master. In the next screen "Directory Service", choose "Set up an Open Directory master".
You can also set up iCal service during this stage, and because of the above settings, iCal is automatically, correctly configured.
At the end of this configuration, the new server will use both 10.5.8's and the local's OD master for users and groups authentication and contacts. Running iCal web service should now work.
One thing I learned from all these days of trail and error is that we must plan the set up prior to performing any installation. Plan which machine will run which services. Of course the OD master and DNS should be already running correctly.
Once the installation and configuration is done, don't attempt to make any dramatic changes to it (such as demoting the OD master to local, and re-promote it to master). Doing so will definitely cause something to break, no matter it is 10.5.8 or 10.6.2.
Also if something *weird* happens (weird things are those contradicting the Apple docs), always attempt to perform a clean install of the OS. Don't waste time to try to figure out why the errors and problems happened!
Plan, plan, plan!