Access Leopard Open Directory remotely

Hi,
I run my OSX leopard server at a colo and want to be able to authenticate to the OD from my laptop which is at home. Is this possible? Is it just a matter of opening certain ports on the firewall?

should work with the correct Firewallports open and DNS etc set up correctly
It worked for us and we have to use iCal on the road …

Similar Messages

Ubuntu Karmic authentication against Snow leopard open directory server

Hi,
I'm looking for help. I've tried to configure an installation of Karmic to authenticate against our office's open directory server running on an osx snow leopard server. Currently `getent password` show all users including those from the open directory server when running the command as both root and normal users. However authentication against the open directry users fails with the following messages in the /var/log/auth.log:-
Dec 7 22:42:05 [hostname] getent: nss_ldap: failed to bind to LDAP server ldap://server.domain.com: Invalid credentials
Dec 7 22:42:05 [hostname] getent: nss_ldap: could not search LDAP server - Server is unavailable
(I've changed the hostname and ldap url)
/etc/ldap.conf has:-
base dc=server,dc=domain,dc=com
ldap_version 3
rootbinddn cn=diradmin,dc=server,dc=domain,dc=com
bind_policy soft
pam_password md5
/etc/ldap.secret is set to the password of the diradmin user and has a permission mask of 600
/etc/pam.d/common-passwd :-
password sufficient pam_ldap.so md5
password required pam_unix.so nullok obscure md5
password optional pam_smbpass.so nullok use_authtok tryfirstpass missingok
/etc/pam.d/common-auth:-
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so usefirstpass
auth requisite pam_deny.so
auth required pam_permit.so
/etc/pam.d/common-account:-
account [success=2 newauthtokreqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so
/etc/pam.d/common-session
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
session optional pamckconnector.so nox11
Does anyone have any ideas where to go from here?
Message was edited by: zebardy

Hi
It's easy enough to 'connect' any version of OS X Server to any other version of OS X Server. Use the Join button in the Users & Groups Preferences Pane. Alternatively use the Directory Utility itself.
You seem to be misunderstanding what an Open Directory Master and Replica are? They are not what I think you think they are. They are not a 'back-up' of each other if you're providing more than the shared Directory Service.
An OD Replica maintains a read-only copy of the LDAP Database (Usernames, Passwords and Policies etc) that's stored on the OD Master and nothing more. If the Master was to go offline for any reason the Replica can be quickly promoted to a Master Role and continue to provide information for the shared directory. This assumes it has easy and quick access to the Volume storing networked home folders? The LDAP Database in that case would then become writable. Later on and whenever you've fixed the problem with the old Master it can quickly be demoted and made a Replica of the now new Master.
Although this is for 10.6 Server (it is nevertheless still applicable) everything you need to know about Master and Replica relationships is here:
http://manuals.info.apple.com/en_US/OpenDirAdmin_v10.6.pdf
Page 55 onwards.
From Page 64:
"The Open Directory master and its replicas must use the same version of Mac OS X Server. . ."
If your OD Master is also providing Mail, Calendar and Contact Services then none of these will be replicated. You will have to maintain a backup of these databases yourself using whatever method you deem fit for your needs.
HTH?
Tony

OS X Server Open Directory Remote Login

In short, I can't bind a remote machine to authenticate users at the remote location. I can get the machine to initially setup using RFC2307 search and mappings. Once I let that, "marinate" for a bit. I can then go in, change the mappings to Open Directory, and all will work. However, that doesn't persist across reboots. The only thing that will persist across reboots is RFC2307 search and mappings. But with only RFC2307, I don't get home directory access. In the above scenario, when I switch it to Open Directory, I can get home directory access. But, again, not feasible if doesn't persist across reboot.
It works flawlessly in house / local LAN so far. Although this environment is being built from ground up as we speak. So much testing has yet to be done. This is just one big hurdle that came along.
I sincerely appreciate any one's help or advice that could point me in the right direction to achieve this goal.
I should note, I have check all DNS records, connectivity, but am willing to try anything again.
Thanks in advance!!!

Describe for me your network. When you say remote location, do you mean two physical locations separated by distance that are connected via a VPN tunnel? or do you mean that you punched some holes in a firewall to attempt to allow the clients to bind to the server? I am hoping the first option.
If you have a VPN tunnel between the two locations and DNS is available on both sides of the fence, you likely don't need to define the mappings. I tend to leave the option set to "from server" and I've never run into any issues.
When you are binding, are you using the simple bind via System Preferences or are you using Directory Utility? Are you performing authenticated binds or unauthenticated binds?
If you have two locations, Main office 10.0.0.0/24 and Remote office 10.0.10.0/24. Make sure that the Remote side is using DNS that resolve to devices in Main. For example, if the server is at 10.0.0.10 and it is the DNS server, then the clients on the 10.0.10.0/24 network should be hitting 10.0.0.10 for name resolution (unless you have replicated DNS to the 10.0.10.0/24 network.
Since you are building this from scratch, you might want to consider using two OD servers, Master and Replica, placing a replica in the remote office and then using OD Locales to better direct your clients.
Reid
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Lost Access to Open Directory after Updating to 10.6.5

Hallo
We have connected 2 Office connected which eachother over a leasted line with VPN. In the smaller branch (B) we have now a problem. both office has a different IP-subnet 172.xx.11.x and 172.xx.10.x
The OS X server 10.6.4 is installed in the headquarter (A). All machines in (B) get a list of users on the server. This works well till we update one of the clients in Office (B).
After Updating to 10.6.5, we still got the list of all the users, but trying to access gives an error?
Then I installed 10.6.5 on another client and directly the same problem
I really getting mad of all the bug builtin 10.6.5 (Mail, OD, MobileMe).
Is their someone who knows a workaround for this OD Problem. Otherwise I will go back to a clean install of 10.6.4
ps. I looks like the quality of the Apple OS X Software getting as worse as Micro$oft. I think they builtin more gadgets but forgot to do the quality control of the basics

It's likely you can just remove the plug-in from the plug-ins folder inside the Photoshop application folder.
http://kb2.adobe.com/cps/409/kb409112.html

Exception in servermgr_accounts when creating open directory master...

Just to give you some background, I'm new to Mac Os X Server. And I'm trying to get a mail/ical/web-server with "open directory" setup. The server is placed in a remote location, behind a NAT-firewall.
I thought I hade everything setup, took a while to figure out the DNS-configs. But I managed to get everything working, and apply the server through a NetworkAccountServer on a client.
When I wanted to setup some e-mail aliases for my e-mail accounts, I remembered I hade seen that in "Server Preferences".
But when opening "Server Preferences" i got the following message:
"Multiple errors occurred on the server while processing commands. Use the Console application to view the error messages.", I could access everything accept Users and Groups, when clicking these it tried to create a new open directory.
The Console App shows this Message:
2/4/11 1:15:31 AM servermgrd[3725] servermgr_accounts: noteDirectoryNodeAdded (reopening nodes)
2/4/11 1:15:31 AM servermgrd[3725] * Terminating app due to uncaught exception 'NSUnknownKeyException', reason: '[<NSCFDictionary 0x102021680> valueForUndefinedKey:]: this class is not key value coding-compliant for the key VR.'
* Call stack at first throw:
0 CoreFoundation 0x00007fff878fc7b4 __exceptionPreprocess + 180
1 libobjc.A.dylib 0x00007fff890ce0f3 objcexceptionthrow + 45
2 CoreFoundation 0x00007fff87954969 -[NSException raise] + 9
3 Foundation 0x00007fff87e61c92 -[NSObject(NSKeyValueCoding) valueForUndefinedKey:] + 245
4 Foundation 0x00007fff87d915a8 -[NSObject(NSKeyValueCoding) valueForKey:] + 420
5 Foundation 0x00007fff87d8d0f6 -[NSDictionary(NSKeyValueCoding) valueForKey:] + 173
6 servermgr_accounts 0x00000001005799c1 scDynamicStoreNotificationCallback + 25876
7 servermgr_accounts 0x0000000100579948 scDynamicStoreNotificationCallback + 25755
8 servermgr_accounts 0x0000000100577648 scDynamicStoreNotificationCallback + 16795
9 servermgr_accounts 0x0000000100573521 scDynamicStoreNotificationCallback + 116
10 SystemConfiguration 0x00007fff82273dad rlsPerform + 115
11 CoreFoundation 0x00007fff87899401 __CFRunLoopDoSources0 + 1361
12 CoreFoundation 0x00007fff878975f9 __CFRunLoopRun + 873
13 CoreFoundation 0x00007fff87896dbf CFRunLoopRunSpecific + 575
14 Foundation 0x00007fff87dc08e4 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 270
15 Foundation 0x00007fff87dc07c3 -[NSRunLoop(NSRunLoop) run] + 77
16 servermgrd 0x0000000100003f13 0x0 + 4294983443
17 servermgrd 0x0000000100001388 0x0 + 4294972296
18 ??? 0x0000000000000002 0x0 + 2
2/4/11 1:15:31 AM com.apple.launchd[1] (com.apple.servermgrd[3725]) Job appears to have crashed: Abort trap
2/4/11 1:15:31 AM com.apple.ReportCrash.Root[3831] 2011-02-04 01:15:31.997 ReportCrash[3831:2a03] Saved crash report for servermgrd[3725] version ??? (???) to /Library/Logs/DiagnosticReports/servermgrd2011-02-04-011531localhost.crash
2/4/11 1:15:32 AM edu.mit.Kerberos.kadmind[3848] kadmind: starting...
2/4/11 1:15:33 AM Server Admin[1931] Error '-1' when applying directory role change
2/4/11 1:15:34 AM com.apple.launchd[1] (edu.mit.Kerberos.kadmind[3848]) Exited with exit code: 2
2/4/11 1:15:34 AM com.apple.launchd[1] (edu.mit.Kerberos.kadmind) Throttling respawn: Will start in 9 seconds
2/4/11 1:15:34 AM com.apple.launchd[1] (edu.mit.Kerberos.krb5kdc) Throttling respawn: Will start in 9 seconds
2/4/11 1:15:43 AM edu.mit.Kerberos.kadmind[3951] kadmind: starting...
2/4/11 1:15:51 AM com.apple.launchd[1] (com.apple.suhelperd[4009]) Exited with exit code: 2
I tried reseting the "Open Directory Service" in "Server Admin", by setting it to "standalone directory".
It did stop the "Open directory", but the console was again showing the message above.
With the server in stand-alone mode, I could access "Server Preferences" again, but as soon as I create an "Open Directory again", it fails with the above error, and I cant access the Open Directory from Server Preferences.
To summarize, the message shows when:
1. Creating an Open Directory Master.
2. Removing a Open Directory Master.
3. Entering Server Preferences with Open Directory Master running.
A wierd thing is that the "Open directory" seems to be fine. I can manage it in "Workgroup manager", login to webmail, calenders, VPN etc. I just can't manage it from "Server Preferences".
I did make som misstakes in the beginning (primarly not setting a proper host-name before creating the first "Open Directory", and also having a local-user with the same short-name as a user in the "Open Directory") But that should all solved now.
Any Idea's on what could be wrong?
Where else can I set e-mail aliases for my "Open Directory" users? Is it possible for them to administer aliases themselves?
Thanks in advance!
PS. Anyone have any tips on mail-forwarding to multiple external accounts? Do I really need to edit this manually in /etc/postfix/aliases? Is there anyway I can let my users administer forwarding?

If anyone else has similar issues, I didn't find a solution. Re-installed the server from scratch...

Uncaught exception raised in Open Directory client-side plugin

I am having an issue whenever I try to access my Open Directory. It says Uncaught exception raised in Open Directory client-side plugin.
In updateConfigurationViewFromDescription: NSInvalidArgumentException *** - [NSplaceholderMutableString initWithString:]: nil argument.
I'm having a hard time finding a directory with the relative plugin. Could you point me the right way? Perhaps finding and deleting that little bugger would help? I'm running Lion Server 10.7.3 with the 10.7.3 Server Admin tools. The goal here is to set up Deploy Studio for our organization, which I had working for a little while until this little guy started rearing his ugly head.
Thanks much-

Dear cdolan92,
not really. It has been a while. I think I also deleted server.app and admin tools and reinstalled those.
Perhaps I even did a backup of open directory and turned off the master to local and back to master.
But I am not sure any more.
Sorry.
Best
H.

Php authenticate to Open Directory

I have a Mac OS X Server with several realms, including some which require ssl. At present, when attempting to open a file in the secure realms, the default 401 http (or in this case https) authentication browser dialogue is brought up to request ID and password.
Ideally, I would like to avoid this by inputting the ID and password in a form (which I can customise, e.g. with help tips) which is submitted to a php script. I imagine if the form was in the secure realm, but accessible to all, and the script to which it was directed looked up the ID and password from Open Directory or LDAP(?) then I may be able to achieve this. However, I am at a loss as to how I can access the Open Directory IDs and passwords via php. Does anyone have any experience with this? According to phpinfo(), OpenLDAP 3001 is enabled.
Alternatively, I would be interested if anyone has some other customisable authentication method for accessing a secure realm.

The process is basically:
1. connect to ldap server
2. search for user by login name given
3. if user is found, try binding to server with login name and password given
4. if binding is successful then user supplied correct name and password; else login fails
Here is a snippet of my login function:
<pre>function login($name, $pass)
// connect to ldap
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
$ldap_connect = ldap_connect("ldap.domain.com");
if($ldap_connect == false) {
return false;
elseif($ldap_connect == true) {
if( !empty($name) && !empty($pass) ) {
$dn = 'dc=domain,dc=com';
$filter = "(&(objectclass=person)(userPassword=*)(|(uid=$name)(cn=$name)) )";
$attributes = array( 'cn', 'userpassword', 'uid');
$search_result = ldap_search($ldap_connect, $dn, $filter, $attributes);
$info = ldap_get_entries($ldap_connect, $search_result);
if( $info\['count'\] ) {
$ldap_bind = ldap_bind($ldap_connect, $info[0]\['dn'\], $pass);
if($ldap_bind == false) {
return false;
else
return false;
else
return false;
}</pre>
Message was edited by: skrying

Open Directory access from outside of network / internet

Hello all,
Got a question I'd love to get some help on, I have some users who are outside of my network and I'd like them to connect into the open directory on our leopard server so they can use the Shared iCal calendars, addresses, etc.
So my questions are A) Is it possible to connect in from outside the network and get access to the directory without having to have a seperate user account and use our VPN every time you want to connect? - if not is this the only way to do it (would you have to connect via the Mac VPN and then connect to the directory?)
B) is it possible to do this "seamlessly" so that you don't have to change any settings, login details each time you switch between your local user from outside the network and your directory access. (so basically if you are in iCal if you have internet access it will connect you to the directory, without you doing anything extra?)
Hope that makes sense, I can't seem to find the answers I need in the manuals, if I knew how this was meant to work I could probably have a fair go at figuring out how to actually do it (firewall changes etc)
Thanks in advance for the help
Martin

So my questions are A) Is it possible to connect in from outside the network and get access to the directory without having to have a seperate user account and use our VPN every time you want to connect? - if not is this the only way to do it (would you have to connect via the Mac VPN and then connect to the directory?)
If your OD server is visible from the internet -- i.e., it has a public address -- then you can do this without the VPN. However, it's not advisable to have a server exposed in that fashion.
You would be better off doing this through the VPN:
- Remote user connects to internet at hotel, for example.
- Remote user initiates VPN connection.
- Remote user now has access to iCal server and directory information.
Explain to the users that this information is private to the company, and private company resources are only available through the VPN. Allowing access without the VPN would be similar to the company posting its Employee roster and meeting calendars on the face of the building where any person (or competitor) could see them.
B) is it possible to do this "seamlessly" so that you don't have to change any settings, login details each time you switch between your local user from outside the network and your directory access. (so basically if you are in iCal if you have internet access it will connect you to the directory, without you doing anything extra?)
It's just one extra step: Connect to VPN. You're still the same local user on the computer.
If you're talking about laptop users needing directory access to authenticate when logging into their computers, well...That sounds like a whole other situation.
Hopefully this helps.
Bryan Vines

Leopard and panther open directory server hate each other

So I got Leopard the first day but didn't install it till a week later 'coz I was working on a Final Cut project. When I was ready to install I saw all these problems people are having and decided to backup all my user files before I do it which I've never done before (what can you say, I trust Apple engineers!) Anyway, after an upgrade install I found that my PowerMac Dual 2.7GHz G5 with 3.5GB of RAM was slow, very slow, crawling slow. Every button I pressed, every app I tried to open, every response seemed it'd take at least 5 mins and Activity Monitor showed that those apps I was trying to interact with were not responding but if I was patient enough to wait, most of them would eventually come around.
After a whole night searching the Apple forum and googling, I couldn't find any solution. So I decided to wipe the hard disk clean and do a clean installation. Amazingly everything worked just as they should and installation only took like 15 mins or so. After I finished installing all my usual apps back into my PowerMac I was, again, busy working on another Final Cut project. And finally that project was concluded so I can look at my new Leopard installation and see if I've missed anything after the clean installation. I found out that I forgot to add my office LDAP server information into the Directory Access and I went ahead and added it.
I was distracted by something else after I added the LDAP info and an hour or so later when I restart my PowerMac, it started to act weird and crawling slow again, just like when I first did the upgrade installation. I totally forgot what I did to make it slow and I was super worry. After like 2 hours of ghost hunting in my PowerMac, I decided to let it sleep for the night and try to figure it out in the morning. On my way home I finally remembered what I did to make it slow! It's the LDAP info!!!! That's the only system related thing I added since before I did the last Final Cut project.
I searched the Apple forum again last night to see if anyone has the same or related problem but I couldn't find anything close. I came to work this morning and decided to test my finding. The PowerMac was still super slow and I figured if it's directory access related, then if I unplug the network cable, my Mac should be smart enough to understand that there is no point in searching for a directory and simply gives up. I unplug the cable and my Mac is up and running smoothly again. I opened the Directory Access app and delete the LDAP entry, restart the Mac, plug the network cable back in and everything is fine now!
I believe the problem is more on my Panther (10.3.9) server (ok fine! we are cheap, we didn't think a Tiger server was worth it! was I wrong!) than on the Leopard itself and that's why I couldn't find anything related on the forum. Is the Panther server LDAP module faulty to begin with that caused the problem? I don't know. I just know that Leopard does not play well with Panther's Open Directory service.

I've convinced myself that all the problems which I'm experiencing with failures to mount, disappearing CD/DVD drives are nothing to do with Windows XP because all my problems are occurring under Windows 2000 (on different computers). Looks like Apple have taken a leaf out of Microsoft's rule book (put the product out in the market before it's ready and let the punters do all the hard work finding and fixing the bugs).

Users cannot connect to Open Directory Leopard server

Just testing Leopard server and running into all sorts of problems...
Clean install of Leopard Server running DNS, AFP and Open Directory.
Set up DNS first and checked both forward and reverse look-up was correct.
Promoted to Open Directory master from Standalone.
Created two test user accounts (without Home directories) and gave them access to a specific sharepoint.
Setup LDAP on the client machine (Leopard client) and could see the user accounts in the Directory app.
Try to log in.....'username or password incorrect'.
Check the OD logs and cannot find any reference to the attempted log-in.
I understand that it appears that user accounts require a Home Directory in Leopard, regardless of whether you actually want one (I don't). I tried creating a home directory using Workgroup Manager but as noted in other threads, the 'create home directory' button doesn't work.
I then created a home directory via the command line for one of the user accounts but am still unable to log-in.
Any ideas?
Thanks.

This may be a stupid question but have you run sudo chown on the user's home directory after creating it?
I had the same problem and my solution is posted here: http://discussions.apple.com/thread.jspa?threadID=1290158&tstart=0
Let me know if that works. If not, we'll work on it together.

Configure DNS on Snow Leopard for private NAT with Open Directory

I am needing to set up DNS on Snow Leopard server 10.6.4 for use with Snow Leopard clients only. On the server, I have two IPs, one public connections outside the network, and one private within the NAT range. DNS was not originally set up on the server, but Open Directory was (sort of). I've demoted the server from OD master to stand alone, but still can't get this to work.
This server is only for setting up and using Open Directory + NetInstall services inside the network. In effect, it isn't serving web pages and isn't registered with our upstream DNS. What I am assigned to do is get Open Directory to set up user profiles and network shares and home directories. So, what I need is this -
a basic DNS config I can do in Server Admin that will set up DNS to resolve to the local server NAT IP for Open Directory purposes;
and provide DNS for outside the OS X server for the specified Snow Leopard clients.
DHCP is running (but the clients were configured with static IPs in the NAT range). This serves as the DHCP server for the entire network (Windows + Mac clients that aren't in the static NAT range).

Thanks for your replies. I realize I'm not making clear the way this network is configured . Also, the only services running on the Snow Leopard server are (at this time):
dhcpd - in the 10.136.31.x range;
dns - same as before;
planned to add are:
Open Directory (for network logins)
Software update;
Web (only on the 10.136.31.x Ethernet);
mySQL (localhost only - for moodle);
NAT is not set up on the Snow Leopard server itself. We have an outside router, a Cisco 2811. This router provides routing for both the public IP range, and the NAT range is configured in this router. The forwarding dns is located in LR and Fayetteville. So what I need is dns on Snow Leopard to forward outside queries to the state DNS servers, and resolve the local NAT IP only for Open Directory and a set of Snow Leopard clients.
Is this going to be possible?

Authenticate windows users accessing os x client using open directory?

I need to setup an OS X client machine (10.4.6) so that windows users (XP) can access folders based on their open directory credentials. (Using OS X server, open directory, windows PDC). If I turn on windows sharing in system preferences on the mac, it will only share local home folders to users with local accounts - not what I need. Any ideas? thanks.

Thanks! So now I see Open Directory, but it seems like it should be listed under the Server app with all the other services...
Anyhow, I seem to remember a way to administer the users and groups. This app shows me the status of the services, logs, settings. The Server app, if I click on Add Users button, then click "connect to it" to supposedly connect to the directory server, it won't take my credentials. I always get "Cannot authenticate to server. Please authenticate by entering the name and password of a user account in this server's directory."
Connect anonymously doesn't seem to do anything, it doesn't even dismiss the dialog.
So what am I missing?

Define a remote linux nfs home directory for an open directory's user

Hi,
I want to migrate from nis to open directory. Everything but "auto homes" looks good. As I create a user with the workgroup manager, under the 'Home' tab, I'm unable to specify a remotre nfs home directory(linux).
So, I want client01(linux) to authenticate on macsvr01(mac osX 10.6.2 / opendirectory). When authenticated, I want macsvr01 to tell client01 that it's home directory is hosted nfs on linuxsvr01(linux nfs file server).
When i look the workgroup manager, the only possibility seems to be 'afp'.
When I try to specificy nfs entries, I can't validate my setting because the 'Ok' button remains grayed out.
Any suggestions?
Thank you,
Luc

I assume you are creating folders in a file server and its a windows machine , is it ?
You can install a remote manager on file server or on any other machine in network and execute your scripts remotely using remote manager
Also you can execute your script like wscript c:\CreateFolder.vbs
Thanks
Suren
Edited by: Suren.Singh on Aug 10, 2010 3:20 PM

Open Directory users can't access shares

Greetings all.
I apologize if this has been covered, but I couldn't find a search term that would locate the issue.
I have a 10.5.8 Server running on a MDD dual 1Ghz G4. I have it set up as an OD Master and providing time services, DNS, file sharing, portable home directories and calendaring for a small workgroup of 7 computers. At least that's the idea when it's functional.
It is behind a NAT and only serves the local network.
Until I have the user's data all transferred from local directories to portable home directories, I need to make it so that the users can access the shares.
In testing, when I try to access a share, I get an error message that the login failed because the username or password was invalid.
However, when I go look at the Password Service log, the user was authenticated and in good standing.
Any ideas?
Thank you,
John

maybe some additional information or rephrasing might help.
I have users and groups set up with ACLs on the shares that are set up with automount over NFS. The shares should also be available via appleshare, but not automount.
The users are configured now with Portable Home Directories.
The client computers are bound to the Open Directory Master on which the shares reside.
The server runs network time services and the client computers use that for their time service.
The server also runs DNS, and the client computers use that DNS.
Users can log into their Portable Home Directories ok.
Users can not log into shares via "connect to server" as it says that the username/password is invalid, even though the password service log says that the user was authenticated and in good standing.
Users can see the NFS automount shares at /Network/Servers/Library (where it is supposed to be), but they cannot write, even though the ACL gives the user account permission to do so.
For the permissions on the automount, I can't tell if the user is not being detected as the authenticated user, and is therefore being given "everyone" permissions, or if the ACL is not working on the mount and so the user is being given ""everyone" permissions.
Anyone have any idea how I can find out?
As to why a user can't log in via "connect to server" I'm clueless.
Thank you,
John

Open Directory / Active Directory SSH access

I have recently bound all of our web and database servers on our active directory and open directory realms. I am able to augment the AD records for my account and the accounts of the other admins, give them NFS home directories and all is great. We can login to any machine with our AD password and get our homes. Problem is 9 times out of 10 we all prefer using SSH and the CLI for most of what we do. I can login to any of these machines with an OD user and get their home directory, but when I try with an AD user I cannot authenticate.
So to recap:
* Login works for both OD / AD users at the login window
* SSH login works for OD users
* SSH login does not work for AD users.
I don't even know where to begin with debugging this one. Any help would be greatly appreciated.
Message was edited by: Coleman Nitroy

Okay adding even more information to this (maybe this topic needs to be moved to a different sub forum)
Instead of assuming SSH would automatically work via AD/OD binds like the Login window does (apparently magically) I went thru and setup the SSHd on a test box to work via kerberos logins.
On the client side I enabled GSSAPIAuthentication as well and here is the error I get for (ssh -v [email protected]):
debug1: Unspecified GSS failure. Minor code may provide more information
Server not found in Kerberos database.
Then it kicks over to the next authentication method. To enable AD login via the login window I didn't have to do anything special. Kerberos tickets are generated and all is well. I am not certain as to why or how SSH works via OD automagically but still no luck getting it to work with AD. Not getting this working would be a large loss for our lab.
Anyone....?
Message was edited by: Coleman Nitroy

Access Leopard Open Directory remotely

Similar Messages

Maybe you are looking for