Bind to Open Directory Script
I have been trying to come up with a script that I can run in ARD for each computer to bind to Open Directory. It seems like a hassle to log into each machine and bind it through Directory Utility. There are 10.4 and 10.5 machines as well as a few 10.3 on the network. The script I came up with is as follows:
dsconfigldap -u {USERNAME} -p {PASSWORD -l {LOCAL USERNAME} -q {LOCAL PASSWORD} -f -a {OD SERVER} -c {HOSTNAME} -n {OD SERVER}
sleep 20
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search -append / CSPSearchPath /LDAPv3/fps-curry.wildwood.edu
exit 0
Some computers run the script with no errors, others do not. The error I get is this:
Cannot open remote host, error: DSOpenDirServiceErr
Data source (-l) is not valid.
Cannot open remote host, error: DSOpenDirServiceErr
Data source (-l) is not valid.
I am now getting the following error on some computers:
<main> attribute status: eDSNodeNotFound
This has something to do with adding the search policy. What is weird though is that sometimes if I run just the search policy again it will run without errors.
Similar Messages
-
How to bind (if possible) Windows 8 clients to OSX Open Directory 10.8?
I read several articles that I have to go through the magic triangle (bind the Open Directory to an Active Directory), but almost all of the articles are from 2012 and below.
This is possible now?
Thank you.Hi mbellido,
Are you trying to bind a Windows 8 client to Open Directory (OS X 10.8)?
Thanks
Dan -
Binding imaged clients to Open Directory?
We created 10.5.2 image that we are trying to bind to Open Directory.
The first imaged client binds fine and adds itself to OD. However, additional clients won't bind. They claim that the computer account already exists.
I assume this is caused by each imaged client having the same "key" somewhere that it is using to bind to OD. Is there a way to regenerate this "key" on our clients once they are imaged?The answer is to remove the local KDC on the 10.5 clients. 10.5 uses the LKDC for personal file sharing - not needed for networked clients.
Run the following commands to kill LKDC before binding the machine to Open Directory:
sudo dscl /Local/Default delete /Config/KerberosKDC
sudo rm -rf /var/db/dslocal/nodes/Default/config/KerberosKDC.plist
See: http://forums.bombich.com/viewtopic.php?t=11834&highlight=lkdc -
Directory Binding Script (Active and Open Directory) 10.7
Hi everyone
I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
#!/bin/sh
#Uncomment the following line to abort the script on errors
#trap exit ERR
## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
## Script written by Marc Horat, URZ Basel, 11.6.2010
## Updated: 12.08.2011
# With the use of the following sources as inspiration:
# http://www.howtomac.co.uk/?p=247
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
# Bombich's AD-Bind Script:
# This script binds to AD and configures advanced options of the AD plugin
# As this scripts contains a password, be sure to take appropriate security
# precautions
# A good way to run this script is to set it as a login hook on your master machine
# Because it only needs to be run once, the last thing this script does is to delete
# itself. If you have another login script that you typically run, include the
# script on your master machine, and indicate its path in the "newLoginScript"
# variable.
# If running this as a one-time login hook to bind to AD after imaging,
# be sure to enable auto-login (for any local user) before creating your master image
#################CONFIGURATION##########################
#OD
# These variables need to be configured for your env
odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
odPassword="YOURODPW" # Enter your OD admin password between the quotes
oddomain="YOURODDOMAIN" # FQDN of your OD domain
computerGroup="YOURNEWODCOMPGROUP" # Add appropriate computer group you want machines to be added to, case sensitive
oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
#AD
# Standard parameters
domain="YOURADDOMAIN" # fully qualified DNS name of Active Directory Domain
domainname="YOURADDOMAINNAME" #Name of the Domain as specified in the search paths
udn="YOURADADMIN" # username of a privileged network user
password="YOURADPW" # password of a privileged network user
ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN" # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
# Advanced options AD Plugin
alldomains="disable" # 'enable' or 'disable' automatic multi-domain authentication
localhome="disable" # 'enable' or 'disable' force home directory to local drive
protocol="smb" # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
mobile="enable" # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="enable" # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="enable" # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash" # e.g., /bin/bash or "none"
preferred="-preferred $domain" # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
packetsign="allow" # allow | disable | require
packetencrypt="allow" # allow | disable | require
passinterval="14" # number of days
namespace="domain" # forest | domain
# Login hook setting -- specify the path to a login hook that you want to run instead of this script
newLoginHook="" # e.g., "/Library/Management/login.sh"
################################# End of configuration
############ Begin of Script
# Host-specific parameters
# computerid should be set dynamically, this value must be machine-specific
# This value may be restricted to 19 characters! The only error you'll receive upon entering
# an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
#computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
#computerid=`hostname | sed 's/.unibas.ch//'`
#computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
#computerid=`/usr/sbin/scutil --get LocalHostName`
computerid=`scutil --get ComputerName`
adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
# These variables probably don't need to be changed
# Determing if any directory binding exists
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
check4OD=${check4ODtmp//[[:space:]]/}
echo "Found LDAP: "$check4ODtmp
check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
check4ODacct=${check4ODaccttmp//[[:space:]]/}
echo "Found LDAP-Computer-Account: "$check4ODacct
else
check4OD=""
check4ODacct=""
echo "No bound LDAP Server found"
fi
if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
then
check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
check4ODgroupMembership=$check4ODgroupMembershiptmp
echo "LDAP Group Membership in Group: "$oldComputerGroup
else
check4ODgroupMembership=""
echo "No LDAP Group Membership defined or not bound to a server"
fi
if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
then
check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//' | sed 's/=//'`
check4AD=${check4ADtmp//[[:space:]]/}
echo "Found AD: "$check4AD
check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
check4ADacct=${check4ADaccttmp//[[:space:]]/}
echo "Found AD-Account: "$check4ADacct
else
check4AD=""
check4ADacct=""
echo "No AD-Account found"
fi
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
#Time Sync
#Restart ntpdate
StartService ()
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
CheckForNetwork
if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
touch /var/run/NetworkTime.StartupItem
echo "Starting network time synchronization"
# Synchronize our clock to the network’s time,
# then fire off ntpd to keep the clock in sync.
ntpdate -bvs
ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
echo ""
echo ""
sleep 5
#### Removing any existing directory bindings
#Clear OD Computer Account and delete entry from Computer group
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
echo "This computer is bound to the following Open Directory Services:"
dscl localhost -list /LDAPv3
echo "With the Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
sleep 5
if [ "${check4ODacct}" == "${computerid}" ]
then
echo "This machine already has a computer account on $oddomain."
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
echo "Found GUID: "$GUID
if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
then
echo "Removing entry from group $oldComputerGroup"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
fi
echo "Removing Computer entry $computerid in OD"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
fi
#List existing Directories
echo "Removing OD-Binding to "$check4OD
dsconfigldap -r "$check4OD"
echo "Removing Search Path entries"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
sleep 5
else
echo "No LDAP or OD Binding present.";
fi
echo ""
# Check a second time in order to delete any remaining LDAP-Bindings
echo "Scanning for further LDAP servers"
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
echo "Found:"
dscl localhost -list /LDAPv3
echo "Removing OD-Binding to "$check4ODtmp
dsconfigldap -r "$check4ODtmp"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
sleep 5
else
echo "No further LDAP or OD Binding present."
fi
echo ""
echo ""
#Remove the Active Directory binding
if [ "$check4AD" != "" ]
then
echo "This computer is bound to the following Active Directory Services:"
dscl localhost -list "/Active Directory"
echo "With the Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
sleep 5
echo "Removing any existing AD-Binding to "$check4AD
dsconfigad -f -remove -username "$udn" -password "$password"
echo "Removing Search Path entries"
if [ "$preferred" != "-nopreferred" ]
then
dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
fi
dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
#remove search path entries from 10.6
if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
then
dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
fi
sleep 5
else
echo "No Active Directory Binding present."
fi
echo ""
#Remove Existing Directory Services Config
echo "Removing existing DS Config"
if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
then
rm -R /Library/Preferences/edu.mit.Kerberos
fi
if [ -d "/etc/krb5.keytab" ]
then
rm -R /etc/krb5.keytab
fi
# Clean up the DirectoryService configuration files
rm -Rfv /Library/Preferences/DirectoryService/*
#OD
echo ""
echo ""
echo "Binding to OD-Damin "$oddomain
sleep 5
dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
echo "Killing opendirectoryd"
killall opendirectoryd
sleep 5
echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
# Add computer to ComputerList and ComputerGroup
if [ $computerGroup != "" ]
then
echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
fi
echo "Finished OD Binding."
sleep 5 # Give DS a chance to catch up
echo ""
echo ""
echo "Performing the AD Binding"
#AD
# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
#Use the existing AD-Computername or generate a new one
computeridtmp="default"
if [ "$check4ADacct" == "" ]
then
LEN=$(echo ${#adcomputerid})
if [ $LEN -lt 15 ]; then
echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
computeridtmp=$adcomputerid
else
echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
echo "Removing any -"
computeridtmp=${adcomputerid//-/}
LEN=$(echo ${#computeridtmp})
if [ $LEN -lt 15 ]; then
echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
else
echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
computeridtmp=${computeridtmp:(-15)}
fi
echo "Cropped Computername to "$computeridtmp
fi
else
computeridtmp=${check4ADacct//$/}
echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
fi
echo ""
# Bind to AD
echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
echo ""
echo "Setting the Advanced AD Plugin options"
# Configure advanced AD plugin options
if [ "$admingroups" = "" ]
then
dsconfigad -nogroups
else
dsconfigad -groups "$admingroups"
fi
dsconfigad -alldomains "$alldomains"
dsconfigad -localhome "$localhome"
dsconfigad -protocol "$protocol"
dsconfigad -mobile "$mobile"
dsconfigad -mobileconfirm "$mobileconfirm"
dsconfigad -useuncpath "$useuncpath"
dsconfigad -shell "$user_shell"
dsconfigad "$preferred"
dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
dsconfigad -namespace "$namespace"
sleep 5
echo ""
echo ""
# Add the OD & AD node to the search path
if [ "$alldomains" = "enable" ]
then
csp="/Active Directory/$domainname/All Domains"
else
csp="/Active Directory/$domainname"
fi
echo "Finished AD Binding."
echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
echo "Adding OD.."
dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
echo "Adding AD.."
#Adding all Domains first to improve reliability under 10.7
if [ "$alldomains" != "enable" ]
then
cspadall="/Active Directory/$domainname/All Domains"
dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
dscl /Search -append / CSPSearchPath "$cspadall"
fi
dscl /Search/Contacts -append / CSPSearchPath "$csp"
dscl /Search -append / CSPSearchPath "$csp"
echo "Finished Updating Search Paths."
echo ""
echo ""
# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall opendirectoryd
# Destroy the login hook (or change it)
if [ "${newLoginHook}" == "" ]
then
defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
else
defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
fi
sleep 5
# Customizing the login-Window
#defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
#defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
#defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
# This works in a pinch if the above code does not
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
#plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
#killall opendirectoryd
# Disable autologin
defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
srm /etc/kcpassword
echo ""
echo ""
echo ""
echo "Now bound to OD Domain:"
dscl localhost -list /LDAPv3
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
echo "Now bound to AD Domain:"
dscl localhost -list "/Active Directory"
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
exit 0 ## Success
exit 1 ## Failure
Any inputs, questions and improvement suggestions are, of course, most welcome!
Cheers
SeeHi everyone
I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
#!/bin/sh
#Uncomment the following line to abort the script on errors
#trap exit ERR
## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
## Script written by Marc Horat, URZ Basel, 11.6.2010
## Updated: 12.08.2011
# With the use of the following sources as inspiration:
# http://www.howtomac.co.uk/?p=247
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
# Bombich's AD-Bind Script:
# This script binds to AD and configures advanced options of the AD plugin
# As this scripts contains a password, be sure to take appropriate security
# precautions
# A good way to run this script is to set it as a login hook on your master machine
# Because it only needs to be run once, the last thing this script does is to delete
# itself. If you have another login script that you typically run, include the
# script on your master machine, and indicate its path in the "newLoginScript"
# variable.
# If running this as a one-time login hook to bind to AD after imaging,
# be sure to enable auto-login (for any local user) before creating your master image
#################CONFIGURATION##########################
#OD
# These variables need to be configured for your env
odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
odPassword="YOURODPW" # Enter your OD admin password between the quotes
oddomain="YOURODDOMAIN" # FQDN of your OD domain
computerGroup="YOURNEWODCOMPGROUP" # Add appropriate computer group you want machines to be added to, case sensitive
oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
#AD
# Standard parameters
domain="YOURADDOMAIN" # fully qualified DNS name of Active Directory Domain
domainname="YOURADDOMAINNAME" #Name of the Domain as specified in the search paths
udn="YOURADADMIN" # username of a privileged network user
password="YOURADPW" # password of a privileged network user
ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN" # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
# Advanced options AD Plugin
alldomains="disable" # 'enable' or 'disable' automatic multi-domain authentication
localhome="disable" # 'enable' or 'disable' force home directory to local drive
protocol="smb" # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
mobile="enable" # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="enable" # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="enable" # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash" # e.g., /bin/bash or "none"
preferred="-preferred $domain" # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
packetsign="allow" # allow | disable | require
packetencrypt="allow" # allow | disable | require
passinterval="14" # number of days
namespace="domain" # forest | domain
# Login hook setting -- specify the path to a login hook that you want to run instead of this script
newLoginHook="" # e.g., "/Library/Management/login.sh"
################################# End of configuration
############ Begin of Script
# Host-specific parameters
# computerid should be set dynamically, this value must be machine-specific
# This value may be restricted to 19 characters! The only error you'll receive upon entering
# an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
#computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
#computerid=`hostname | sed 's/.unibas.ch//'`
#computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
#computerid=`/usr/sbin/scutil --get LocalHostName`
computerid=`scutil --get ComputerName`
adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
# These variables probably don't need to be changed
# Determing if any directory binding exists
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
check4OD=${check4ODtmp//[[:space:]]/}
echo "Found LDAP: "$check4ODtmp
check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
check4ODacct=${check4ODaccttmp//[[:space:]]/}
echo "Found LDAP-Computer-Account: "$check4ODacct
else
check4OD=""
check4ODacct=""
echo "No bound LDAP Server found"
fi
if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
then
check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
check4ODgroupMembership=$check4ODgroupMembershiptmp
echo "LDAP Group Membership in Group: "$oldComputerGroup
else
check4ODgroupMembership=""
echo "No LDAP Group Membership defined or not bound to a server"
fi
if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
then
check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//' | sed 's/=//'`
check4AD=${check4ADtmp//[[:space:]]/}
echo "Found AD: "$check4AD
check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
check4ADacct=${check4ADaccttmp//[[:space:]]/}
echo "Found AD-Account: "$check4ADacct
else
check4AD=""
check4ADacct=""
echo "No AD-Account found"
fi
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
#Time Sync
#Restart ntpdate
StartService ()
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
CheckForNetwork
if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
touch /var/run/NetworkTime.StartupItem
echo "Starting network time synchronization"
# Synchronize our clock to the network’s time,
# then fire off ntpd to keep the clock in sync.
ntpdate -bvs
ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
echo ""
echo ""
sleep 5
#### Removing any existing directory bindings
#Clear OD Computer Account and delete entry from Computer group
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
echo "This computer is bound to the following Open Directory Services:"
dscl localhost -list /LDAPv3
echo "With the Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
sleep 5
if [ "${check4ODacct}" == "${computerid}" ]
then
echo "This machine already has a computer account on $oddomain."
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
echo "Found GUID: "$GUID
if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
then
echo "Removing entry from group $oldComputerGroup"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
fi
echo "Removing Computer entry $computerid in OD"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
fi
#List existing Directories
echo "Removing OD-Binding to "$check4OD
dsconfigldap -r "$check4OD"
echo "Removing Search Path entries"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
sleep 5
else
echo "No LDAP or OD Binding present.";
fi
echo ""
# Check a second time in order to delete any remaining LDAP-Bindings
echo "Scanning for further LDAP servers"
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
echo "Found:"
dscl localhost -list /LDAPv3
echo "Removing OD-Binding to "$check4ODtmp
dsconfigldap -r "$check4ODtmp"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
sleep 5
else
echo "No further LDAP or OD Binding present."
fi
echo ""
echo ""
#Remove the Active Directory binding
if [ "$check4AD" != "" ]
then
echo "This computer is bound to the following Active Directory Services:"
dscl localhost -list "/Active Directory"
echo "With the Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
sleep 5
echo "Removing any existing AD-Binding to "$check4AD
dsconfigad -f -remove -username "$udn" -password "$password"
echo "Removing Search Path entries"
if [ "$preferred" != "-nopreferred" ]
then
dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
fi
dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
#remove search path entries from 10.6
if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
then
dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
fi
sleep 5
else
echo "No Active Directory Binding present."
fi
echo ""
#Remove Existing Directory Services Config
echo "Removing existing DS Config"
if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
then
rm -R /Library/Preferences/edu.mit.Kerberos
fi
if [ -d "/etc/krb5.keytab" ]
then
rm -R /etc/krb5.keytab
fi
# Clean up the DirectoryService configuration files
rm -Rfv /Library/Preferences/DirectoryService/*
#OD
echo ""
echo ""
echo "Binding to OD-Damin "$oddomain
sleep 5
dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
echo "Killing opendirectoryd"
killall opendirectoryd
sleep 5
echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
# Add computer to ComputerList and ComputerGroup
if [ $computerGroup != "" ]
then
echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
fi
echo "Finished OD Binding."
sleep 5 # Give DS a chance to catch up
echo ""
echo ""
echo "Performing the AD Binding"
#AD
# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
#Use the existing AD-Computername or generate a new one
computeridtmp="default"
if [ "$check4ADacct" == "" ]
then
LEN=$(echo ${#adcomputerid})
if [ $LEN -lt 15 ]; then
echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
computeridtmp=$adcomputerid
else
echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
echo "Removing any -"
computeridtmp=${adcomputerid//-/}
LEN=$(echo ${#computeridtmp})
if [ $LEN -lt 15 ]; then
echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
else
echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
computeridtmp=${computeridtmp:(-15)}
fi
echo "Cropped Computername to "$computeridtmp
fi
else
computeridtmp=${check4ADacct//$/}
echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
fi
echo ""
# Bind to AD
echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
echo ""
echo "Setting the Advanced AD Plugin options"
# Configure advanced AD plugin options
if [ "$admingroups" = "" ]
then
dsconfigad -nogroups
else
dsconfigad -groups "$admingroups"
fi
dsconfigad -alldomains "$alldomains"
dsconfigad -localhome "$localhome"
dsconfigad -protocol "$protocol"
dsconfigad -mobile "$mobile"
dsconfigad -mobileconfirm "$mobileconfirm"
dsconfigad -useuncpath "$useuncpath"
dsconfigad -shell "$user_shell"
dsconfigad "$preferred"
dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
dsconfigad -namespace "$namespace"
sleep 5
echo ""
echo ""
# Add the OD & AD node to the search path
if [ "$alldomains" = "enable" ]
then
csp="/Active Directory/$domainname/All Domains"
else
csp="/Active Directory/$domainname"
fi
echo "Finished AD Binding."
echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
echo "Adding OD.."
dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
echo "Adding AD.."
#Adding all Domains first to improve reliability under 10.7
if [ "$alldomains" != "enable" ]
then
cspadall="/Active Directory/$domainname/All Domains"
dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
dscl /Search -append / CSPSearchPath "$cspadall"
fi
dscl /Search/Contacts -append / CSPSearchPath "$csp"
dscl /Search -append / CSPSearchPath "$csp"
echo "Finished Updating Search Paths."
echo ""
echo ""
# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall opendirectoryd
# Destroy the login hook (or change it)
if [ "${newLoginHook}" == "" ]
then
defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
else
defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
fi
sleep 5
# Customizing the login-Window
#defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
#defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
#defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
# This works in a pinch if the above code does not
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
#plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
#killall opendirectoryd
# Disable autologin
defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
srm /etc/kcpassword
echo ""
echo ""
echo ""
echo "Now bound to OD Domain:"
dscl localhost -list /LDAPv3
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
echo "Now bound to AD Domain:"
dscl localhost -list "/Active Directory"
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
exit 0 ## Success
exit 1 ## Failure
Any inputs, questions and improvement suggestions are, of course, most welcome!
Cheers
See -
Can't open perl script "/opatch.pl": No such file or directory
After installed Oracle 9.2.04 and applied patch p3006854, p3948480 and p4188455 on Linux AS4, I found that I can not start agent. If I execute "agentctl start", oracle will through our error like:
Starting Oracle Intelligent Agent.../u01/app/oracle/product/9.2.0/bin/dbsnmpwd: line 156: 1855 Segmentation fault nohup $ORACLE_HOME/bin/dbsnmp $*
$DBSNMP_WDLOGFILE 2>&1/u01/app/oracle/product/9.2.0/bin/dbsnmpwd: line 156: 1868 Segmentation fault nohup $ORACLE_HOME/bin/dbsnmp $* >>$DBSNMP_WDLOGFILE 2>&1
/u01/app/oracle/product/9.2.0/bin/dbsnmpwd: line 156: 1880 Segmentation fault nohup $ORACLE_HOME/bin/dbsnmp $* >>$DBSNMP_WDLOGFILE 2>&1
/u01/app/oracle/product/9.2.0/bin/dbsnmpwd: line 156: 1892 Segmentation fault nohup $ORACLE_HOME/bin/dbsnmp $* >>$DBSNMP_WDLOGFILE 2>&1
I searched Internet and some article said p3238244 is needed. So I started to install it. At the very beginning, the error is "Can not find ../oui/OraInstall.jar". I found this file in "../oui/jlib" and copy it to "../oui". Then I run "opatch apply" and the error is "Can't open perl script "/opatch.pl": No such file or directory". This time I can not find much similiar information from google.
Any idea?
PS: I changed path of inventory during the installation to "/henry/cwdata" ($ORACLE_HOME=/henry/app/oracle/product/9.2). Will this action cause the error below? What is the usage of inventory path exactly?
Much appreciated!
HenryBelow is my env and .bash_profile.
[oracle@henrylinux lib]$ env
SSH_AGENT_PID=2814
HOSTNAME=henrylinux
SHELL=/bin/bash
TERM=xterm
HISTSIZE=1000
NLS_LANG=AMERICAN_AMERICA.ZHS16GBK
GTK_RC_FILES=/etc/gtk/gtkrc:/home/oracle/.gtkrc-1.2-gnome2
WINDOWID=39880874
OLDPWD=/home/oracle
ORACLE_OWNER=oracle
USER=oracle
LS_COLORS=no=00:fi=00:di=00;34:ln=00;36:pi=40;33:so=00;35:bd=40;33;01:cd=40;33;0 1:or=01;05;37;41:mi=01;05;37;41:ex=00;32:*.cmd=00;32:*.exe=00;32:*.com=00;32:*.b tm=00;32:*.bat=00;32:*.sh=00;32:*.csh=00;32:*.tar=00;31:*.tgz=00;31:*.arj=00;31: *.taz=00;31:*.lzh=00;31:*.zip=00;31:*.z=00;31:*.Z=00;31:*.gz=00;31:*.bz2=00;31:* .bz=00;31:*.tz=00;31:*.rpm=00;31:*.cpio=00;31:*.jpg=00;35:*.gif=00;35:*.bmp=00;3 5:*.xbm=00;35:*.xpm=00;35:*.png=00;35:*.tif=00;35:
ORACLE_SID=ora92
GNOME_KEYRING_SOCKET=/tmp/keyring-BckaCh/socket
ORACLE_BASE=/henry/app/oracle
SSH_AUTH_SOCK=/tmp/ssh-nsWlKX2762/agent.2762
KDEDIR=/usr
SESSION_MANAGER=local/henrylinux:/tmp/.ICE-unix/2762
GDN_LANG=en_US
MAIL=/var/spool/mail/oracle
DESKTOP_SESSION=default
PATH=/usr/kerberos/bin:/usr/local/bin:/usr/bin:/bin:/usr/X11R6/bin:/home/oracle/ bin:/henry/app/oracle/product/9.2/bin:/henry/app/oracle/product/9.2/Apache/Apach e/bin:
INPUTRC=/etc/inputrc
PWD=/henry/app/oracle/product/9.2/ctx/lib
THREADS_FLAG=native
LANG=en_US.UTF-8
LC=en_US
ORACLE_TERM=xterm
GDMSESSION=default
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
HOME=/home/oracle
SHLVL=2
LD_ASSUME_KERNEL=2.4.19
GNOME_DESKTOP_SESSION_ID=Default
LOGNAME=oracle
LC_CTYPE=zh_CN.GB2312
CLASSPATH=/henry/app/oracle/product/9.2/JRE:/henry/app/oracle/product/9.2/jlib:/ henry/app/oracle/product/9.2/rdbms/jlib:/henry/app/oracle/product/9.2/network/jl ib
DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-Z7HVMAC8Dh
LESSOPEN=|/usr/bin/lesspipe.sh %s
ORA_NLS33=/henry/app/oracle/product/9.2/ocommon/nls/admin/data
DISPLAY=:0.0
ORACLE_HOME=/henry/app/oracle/product/9.2
G_BROKEN_FILENAMES=1
COLORTERM=gnome-terminal
XAUTHORITY=/home/oracle/.Xauthority
_=/usr/bin/env
# .bash_profile
# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
# User specific environment and startup programs
PATH=$PATH:$HOME/bin
export ORACLE_BASE=/henry/app/oracle
export ORACLE_HOME=$ORACLE_BASE/product/9.2
export PATH=$PATH:$ORACLE_HOME/bin:$ORACLE_HOME/Apache/Apache/bin:/sbin
export ORACLE_OWNER=oracle
export ORACLE_SID=ora92
export ORACLE_TERM=xterm
export LD_ASSUME_KERNEL=2.4.19
export THREADS_FLAG=native
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib
export NLS_LANG="AMERICAN_AMERICA.ZHS16GBK"
export ORA_NLS33=$ORACLE_HOME/ocommon/nls/admin/data
export DISPLAY=:0
export LANG=en_US
export GDN_LANG=en_US
export LC=en_US
export CLASSPATH=$ORACLE_HOME/JRE:$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib:$ORACLE_HOME/network/jlib
export LC_CTYPE=zh_CN.GB2312
export PATH
unset USERNAME -
Scripts for adding/deleting/modifying Open Directory accounts?
I think I have searched high and low for an answer to this question, but if I missed it please point me in the right direction. Where can I find information on scripts for adding/deleting/modifying open directory accounts? At the very least, a command line utility with some syntax guidelines! Any help would be greatly appreciated.
Hi
I personally don't know if any scripts although you can use the command line to do pretty much anything you want with the Open Directory. Consult the manual: man dscl. If you launch terminal and issue dscl you should see something like this:
my-Laptop:~ me$ dscl
dscl (v20.4)
usage: dscl [options] [<datasource> [<command>]]
datasource:
localhost (default) or
<hostname> (requires DS proxy support, >= DS-158) or
<nodename> (Directory Service style node name) or
<domainname> (NetInfo style domain name)
options:
-u <user> authenticate as user (required when using DS Proxy)
-P <password> authentication password
-p prompt for password
-raw don't strip off prefix from DS constants
-url print record attribute values in URL-style encoding
-q quiet - no interactive prompt
commands:
-read <path> [<key>...]
-create <record path> [<key> [<val>...]]
-delete <path> [<key> [<val>...]]
-list <path> [<key>]
-append <record path> <key> <val>...
-merge <record path> <key> <val>...
-change <record path> <key> <old value> <new value>
-changei <record path> <key> <value index> <new value>
-search <path> <key> <val>
-auth [<user> [<password>]]
-authonly [<user> [<password>]]
-passwd <user path> [<new password> | <old password> <new password>]
Entering interactive mode...
The above is for 10.4 and should server equally as well for 10.5.
Hope this helps, Tony -
Binding Exchange server to Open Directory
So I am setting up an exchange 2010 sandbox machine to see how feasible the install and usage of the software is within the company. When running through the installation it wants the exchange server machine to be bound to an active directory. Well I dont have any active directory servers all I have is our open directory. How can I tie in the exchange binding to the open directory? I have heard about integrating between OD and AD but it seems like it requires yet another AD machine.
Any thoughts? Success Stories?The answer is to remove the local KDC on the 10.5 clients. 10.5 uses the LKDC for personal file sharing - not needed for networked clients.
Run the following commands to kill LKDC before binding the machine to Open Directory:
sudo dscl /Local/Default delete /Config/KerberosKDC
sudo rm -rf /var/db/dslocal/nodes/Default/config/KerberosKDC.plist
See: http://forums.bombich.com/viewtopic.php?t=11834&highlight=lkdc -
How do you bind Vista / XP clients to Open Directory?
I have an OSX Server OD Master set up in 10.5.6.
My OSX Clients can bind to it just fine using Directory Utility.
How do you bind Vista / XP clients to Open Directory masters?
Thanks@ jakelh:
Make sure Kerberos is working on your server. Without it, PC logins will probably fail at least for Vista clients. Otherwise you'd have to downgrade a client-side setting on the Vista clients,
http://www.builderau.com.au/blogs/codemonkeybusiness/viewblogpost.htm?p=33927074 6
DNS is critical here, but Vista can have a problem with things that are correctly configured.
IE: Vista defaults to a TCP/IP setting that can make it incompatible with existing network hardware
http://www.tech-recipes.com/rx/1744/vistatcp_cannot_communicate_primary_dnsserve -
Trouble binding 10.5 Server to 10.6 Open Directory
After a recent power outage one of my 10.5 Servers lost its connection to the OD Master. I am unable to get this system to re-bind to an Open Directory Master (10.6 Server). I had to force un-bind the 10.5 machine (via Directory Utility) because it could not contact the OD Master. After force unbinding the 10.5 Server system I checked Open Directory settings in Server Admin and the role was "Standalone Server".
Steps to reproduce problem:
1) Change role of 10.5 Server to "Connects to a Directory System" and rebooted the system.
2) Launch Directory Utility, click add server and enter the FQDN for my OD Master. SSL option is not checked.
3) Directory Utility tries to communicate with the OD Master for a few moments...displaying "verifying server address", then comes back with the error "there was no response from SERVER. Please check that the address you entered is correct".
(where SERVER = the FQDN for the OD Master)
I Checked that DNS was working and that the system (10.5 Server) could resolve the FQDN of the OD Master. When the above steps did not solve the problem I went to the OD Master and (from Workgroup Manager) deleted the previous entry for the 10.5 Server. This had no effect on the problem. Not sure what to try next?Hi,
Welcome to the Discussions
10.5 Server and specifically iChat Server has it's own forum
http://discussions.apple.com/forum.jspa?forumID=1235 (for Export)
10.6 Server has Forum called Collaboration Services for iChat Server (And a few other bits)
The Forums are within Categories.
Technically each is within it's own OS Category but Tiger, Leopard and Snow Leopard are all shown in this "Master Category" here
The reason I am posting these links is that I don't know enough about the Server version of iChat.
The chances are that someone in the 10.6 Server > Collaboration Services forum knows how to Export the list from 10.5 Server and input it in to 10.6 Server.
Hope this helps.
7:53 PM Monday; July 19, 2010
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat" -
Open Directory Binding doesn't want to activate
Hi all,
I have the following problem with binding computers to Open Directory. My setup is as follows: Master on one server, slave on the other, clients running in the network, no firewalls or anything. I took over from another guy and he didn't have binding enabled, I would like to set up a Software Update Service and push the SUS server to the computers using OD.
When I try to enable binding in the server config tool, it doesn't work (the box unchecks itself) the error message in slapconfig.log is the same as on terminal (running as root) where I have the following:
# slapconfig -setmacosxodpolicy -binding enabled
command: /usr/bin/ldapadd -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
modifying entry "cn=macosxodpolicy,cn=config,dc=try,dc=tohide,dc=this"
ldapadd command output:
ldap_modify: No such object (32)
matched DN: cn=config,dc=try,dc=tohide,dc=this
ldapadd command failed with status 32
Does anybody have an idea what this is or where the problem is?
The ou macosxodpolicy and container config are in the correct location (I think) and seem readable:
dn: cn=config,dc=try,dc=tohide,dc=this
cn: config
objectClass: container
entryUUID: 0c305f06-85a6-1028-9911-993fd9058318
creatorsName: uid=root,cn=users,dc=try,dc=tohide,dc=this
createTimestamp: 20040818210515Z
entryCSN: 2004081821:05:15Z#0x0002#0#0000
modifiersName: uid=root,cn=users,dc=try,dc=tohide,dc=this
modifyTimestamp: 20040818210515Z
dn: ou=macosxodconfig,cn=config,dc=try,dc=tohide,dc=this
ou: macosxodconfig
objectClass: top
objectClass: organizationalUnit
entryUUID: 0c335882-85a6-1028-9912-993fd9058318
creatorsName: uid=root,cn=users,dc=try,dc=tohide,dc=this
createTimestamp: 20040818210515Z
...Just a couple thoughts and basic questions:
Is DNS properly configured? Can you do forward and reverse lookups? If you rin changeip checkhostname, what happens? And finally, how have you configured DirectoryAccess on the clients?
By your post, you've got a handle on this, but just want to cover all the bases.
I'm guessing it's possible your predecessor didn't have everything setup quite right to begin with. If you've setup a server before, then you know you need to setup DNS while the server is set as a standalone, then promote it to an OD master. If this was not done to begin with, you may be pounding your head against a wall to make it work. If possible, consider re-installing the server to get it right from the get go. You may be able to make a mis-configured server work (if that is the case) but you may see different issues down the road.
good luck and post back with more info - maybe someone smarter than me can help...
Jeff -
Php authenticate to Open Directory
I have a Mac OS X Server with several realms, including some which require ssl. At present, when attempting to open a file in the secure realms, the default 401 http (or in this case https) authentication browser dialogue is brought up to request ID and password.
Ideally, I would like to avoid this by inputting the ID and password in a form (which I can customise, e.g. with help tips) which is submitted to a php script. I imagine if the form was in the secure realm, but accessible to all, and the script to which it was directed looked up the ID and password from Open Directory or LDAP(?) then I may be able to achieve this. However, I am at a loss as to how I can access the Open Directory IDs and passwords via php. Does anyone have any experience with this? According to phpinfo(), OpenLDAP 3001 is enabled.
Alternatively, I would be interested if anyone has some other customisable authentication method for accessing a secure realm.The process is basically:
1. connect to ldap server
2. search for user by login name given
3. if user is found, try binding to server with login name and password given
4. if binding is successful then user supplied correct name and password; else login fails
Here is a snippet of my login function:
<pre>function login($name, $pass)
// connect to ldap
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
$ldap_connect = ldap_connect("ldap.domain.com");
if($ldap_connect == false) {
return false;
elseif($ldap_connect == true) {
if( !empty($name) && !empty($pass) ) {
$dn = 'dc=domain,dc=com';
$filter = "(&(objectclass=person)(userPassword=*)(|(uid=$name)(cn=$name)) )";
$attributes = array( 'cn', 'userpassword', 'uid');
$search_result = ldap_search($ldap_connect, $dn, $filter, $attributes);
$info = ldap_get_entries($ldap_connect, $search_result);
if( $info\['count'\] ) {
$ldap_bind = ldap_bind($ldap_connect, $info[0]\['dn'\], $pass);
if($ldap_bind == false) {
return false;
else
return false;
else
return false;
}</pre>
Message was edited by: skrying -
SAMPLE RECEIVING OPEN INTERFACE SCRIPT(ROI 이용자를 위한 SCRIPT)
제품: MFG_PO
작성날짜 : 2006-05-11
SAMPLE RECEIVING OPEN INTERFACE SCRIPT(ROI 이용자를 위한 SCRIPT)
================================================================
PURPOSE
Receiving Open Interface(ROI)를 좀더 쉽게 사용할 수 있도록 만들어진
tool이라고 할 수 있다. 이 script를 이용을 통해 user는 PO no, user id,
Org id를 입력하면 script는 PO에서 최소한의 data를 가져와 receiving
transaction을 생성하기 위해 ROI에 data를 입력한다.
Receiving Transaction Processor는 insert 된 data를 실행한다.
Explanation
Instructions:
1.Script exroi.sql을 local computer에 copy 하거나 sqlplus 환경의 text
edior에 script 내용을 cut&paste 한다.
2.사용가능한 PO no, User id, Org id를 결정한다.
3.sqlplus prompt에서 아래와 같이 입력한다.
SQL> @ezroi.sql
4.PO no, User id, Org id를 입력하라는 prompt를 볼 수 있을 것이다.
5.exroi.sql script를 관련된 PO data를 가져와 rcv_headers_interface 및
rcv_transactions_interface tables에 insert 한다.
만일 PO shipment lind이 closed, cancelled, fully received 되었다면
ROI table에 data를 insert 하지 않는다.
Note: 이 script가 data를 validate 하진 않으며,ROI API 자체 validation
이 실행될 뿐이다.
6.Script가 끝나면 Receiving Transaction Processor를 실행하여 insert 된
lines을 처리할 수 있다. Transaction Status Summary 화면을 통해 실행된
line이 pending 인지 error 상태인지 확인할 수 있다.
Notes:
1.Org_id parameter 값을 찾는법:
a) Application에 접속, Help> Diagnostics> Examine으로 이동.
Block:$Profile$, Field: ORG_ID 를 선택한다.
b) ORG_ID 값을 note 해 놓고 ORG_ID prompt시 이 값을 입력한다.
2.User_Name parameter 값을 찾는법:
a) Application에 접속, Help> Diagnostics> Examine으로 이동.
Block:$Profile$, Field: USER_NAME 를 선택한다.
b) USER_NAME 값을 note 해 놓고 USER_NAME prompt시 이 값을 입력한다.
Example
"eZROI.sql' script...
--*** eZROI ***
--*** by ***
--*** Preston D. Davenport ***
--*** Oracle Premium Applications Support ***
--*** Oracle Worldwide Global Support Services ***
--*** Date: 23-JUL-2003 - Beta release ***
--*** Date: 09-SEP-2003 - Rev A Added multi- ***
--*** shipment line capability ***
--*** Parameters: ***
--*** ORG_ID Organization ID ***
--*** USER_NAME FND User Name ***
--*** PO_NUMBER Purchase Order Number ***
--*** This script intended for a standard Purchase ***
--*** Order document to be inserted into the Oracle ***
--*** Receiving Open Interface (ROI) via the standard ***
--*** Oracle open interface api for a simple Receive ***
--*** transaction. ***
--*** Note: This script only considers open Purchase ***
--*** Orders. This script will not allow over- ***
--*** receipt, cancelled or closed PO's to be ***
--*** inserted into the ROI and received ***
CLEAR BUFFER
SET VERIFY OFF
SET LINESIZE 140
SET PAGESIZE 60
SET ARRAYSIZE 1
SET SERVEROUTPUT ON SIZE 100000
SET FEEDBACK OFF
SET ECHO OFF
DECLARE
X_USER_ID NUMBER;
X_PO_HEADER_ID NUMBER;
X_VENDOR_ID NUMBER;
X_SEGMENT1 NUMBER;
X_ORG_ID NUMBER;
X_LINE_NUM NUMBER;
BEGIN
DBMS_OUTPUT.PUT_LINE('***ezROI RCV API Insert Script***');
SELECT PO_HEADER_ID , VENDOR_ID , SEGMENT1 , ORG_ID
INTO X_PO_HEADER_ID , X_VENDOR_ID , X_SEGMENT1 , X_ORG_ID
FROM PO_HEADERS_ALL
WHERE SEGMENT1 = '&PO_NUMBER'
AND ORG_ID = &ORG_ID;
SELECT USER_ID INTO X_USER_ID
FROM FND_USER
WHERE USER_NAME = UPPER('&USER_NAME');
INSERT INTO RCV_HEADERS_INTERFACE
HEADER_INTERFACE_ID ,
GROUP_ID ,
PROCESSING_STATUS_CODE ,
RECEIPT_SOURCE_CODE ,
TRANSACTION_TYPE ,
LAST_UPDATE_DATE ,
LAST_UPDATED_BY ,
LAST_UPDATE_LOGIN ,
VENDOR_ID ,
EXPECTED_RECEIPT_DATE ,
VALIDATION_FLAG
SELECT
RCV_HEADERS_INTERFACE_S.NEXTVAL ,
RCV_INTERFACE_GROUPS_S.NEXTVAL ,
'PENDING' ,
'VENDOR' ,
'NEW' ,
SYSDATE ,
X_USER_ID ,
0 ,
X_VENDOR_ID ,
SYSDATE ,
'Y'
FROM DUAL;
DECLARE
CURSOR PO_LINE IS
SELECT PL.ITEM_ID , PL.PO_LINE_ID , PL.LINE_NUM ,
PLL.QUANTITY , PL.UNIT_MEAS_LOOKUP_CODE ,
MP.ORGANIZATION_CODE , PLL.LINE_LOCATION_ID ,
PLL.CLOSED_CODE , PLL.QUANTITY_RECEIVED ,
PLL.CANCEL_FLAG, PLL.SHIPMENT_NUM
FROM PO_LINES_ALL PL ,
PO_LINE_LOCATIONS_ALL PLL ,
MTL_PARAMETERS MP
WHERE PL.PO_HEADER_ID = X_PO_HEADER_ID
AND PL.PO_LINE_ID = PLL.PO_LINE_ID
AND PLL.SHIP_TO_ORGANIZATION_ID = MP.ORGANIZATION_ID;
BEGIN
FOR CURSOR1 IN PO_LINE LOOP
IF CURSOR1.CLOSED_CODE IN ('APPROVED','OPEN')
AND CURSOR1.QUANTITY_RECEIVED < CURSOR1.QUANTITY
AND NVL(CURSOR1.CANCEL_FLAG,'N') = 'N'
THEN
INSERT INTO RCV_TRANSACTIONS_INTERFACE
INTERFACE_TRANSACTION_ID ,
GROUP_ID ,
LAST_UPDATE_DATE ,
LAST_UPDATED_BY ,
CREATION_DATE ,
CREATED_BY ,
LAST_UPDATE_LOGIN ,
TRANSACTION_TYPE ,
TRANSACTION_DATE ,
PROCESSING_STATUS_CODE ,
PROCESSING_MODE_CODE ,
TRANSACTION_STATUS_CODE ,
PO_LINE_ID ,
ITEM_ID ,
QUANTITY ,
UNIT_OF_MEASURE ,
PO_LINE_LOCATION_ID ,
AUTO_TRANSACT_CODE ,
RECEIPT_SOURCE_CODE ,
TO_ORGANIZATION_CODE ,
SOURCE_DOCUMENT_CODE ,
DOCUMENT_NUM ,
HEADER_INTERFACE_ID ,
VALIDATION_FLAG
SELECT
RCV_TRANSACTIONS_INTERFACE_S.NEXTVAL ,
RCV_INTERFACE_GROUPS_S.CURRVAL ,
SYSDATE ,
X_USER_ID ,
SYSDATE ,
X_USER_ID ,
0 ,
'RECEIVE' ,
SYSDATE ,
'PENDING' ,
'BATCH' ,
'PENDING' ,
CURSOR1.PO_LINE_ID ,
CURSOR1.ITEM_ID ,
CURSOR1.QUANTITY ,
CURSOR1.UNIT_MEAS_LOOKUP_CODE ,
CURSOR1.LINE_LOCATION_ID ,
'RECEIVE' ,
'VENDOR' ,
CURSOR1.ORGANIZATION_CODE ,
'PO' ,
X_SEGMENT1 ,
RCV_HEADERS_INTERFACE_S.CURRVAL ,
'Y'
FROM DUAL;
DBMS_OUTPUT.PUT_LINE('PO line: '||CURSOR1.LINE_NUM||' Shipment: '||CURSOR1.SHIPMENT_NUM||' has been inserted into ROI.');
ELSE
DBMS_OUTPUT.PUT_LINE('PO line '||CURSOR1.LINE_NUM||' is either closed, cancelled, received.');
END IF;
END LOOP;
DBMS_OUTPUT.PUT_LINE('*** ezROI COMPLETE - End ***');
END;
COMMIT;
END;
SET VERIFY ON
Reference Documents
Note 245334.1I have the same problem on ESXI 5.5 for over a month now, tried the patches, tried the LTS kernel which others say results in an immediate result without patches, nothing seems to work and nobody seems to be able to offer a solution.
Did you make any progress ??
Error! Build of vmblock.ko failed for: 3.10.25-1-lts (x86_64)
Consult the make.log in the build directory
/var/lib/dkms/open-vm-tools/2013.09.16/build/ for more information.
make[2]: *** No rule to make target '/var/lib/dkms/open-vm-tools/2013.09.16/build/vmblock/linux/inode', needed by '/var/lib/dkms/open-vm-tools/2013.09.16/build/vmblock/vmblock.o'. Stop.
Makefile:1224: recipe for target '_module_/var/lib/dkms/open-vm-tools/2013.09.16/build/vmblock' failed
make[1]: *** [_module_/var/lib/dkms/open-vm-tools/2013.09.16/build/vmblock] Error 2
make[1]: Leaving directory '/usr/src/linux-3.10.25-1-lts'
Makefile:120: recipe for target 'vmblock.ko' failed
Last edited by crankshaft (2014-01-10 11:32:32) -
Binding to Active Directory Problem. I am a Newb! probably something stupid
Hey All,
Trying to get my apple xsever to join our windows domain. I got it to bind and the user accounts show up on the machine but then it askes me to join it to the Active Directory Kerberos realm. I am confused.
what i am trying to do is joint it to the windows domain for my admin account on the actual server and then set up local user accounts on the machine so when my mac users log in they authenticate using the local mac account and not the windows domain account. Does this make sense? From what i read macs authenticate using the local account before going to the windows account which is what i want. I am a total newb to this so forgive me for the stupid questions.
cheers all,
jessHi
set up the xserve as an Open directory Master
will it place nice on the network
with the rest of the windows servers that we have.
There should be no problem in doing this. All you need to do is decide whether you want your Mac Server to run its own DNS Service or to use the existing DNS service being provided by the AD Server. Open Directory Master requires DNS Services running somewhere.
i just want to have a mac studio of about 35 people be
kind of an island within a sea of windows users. If
there can be cross over there then fine.. but really
i want the mac to work well with the apple server and
if i can get the windows clients hooked up also then
fine.
There should be no problem with this.
When you say studio do you mean a graphics design studio? Or are you talking about a video production studio? If the answer is yes to either one or both then perhaps a simple file server would do. An Open Directory Master is OK in this environment but your network needs to be up to job. Ideally gigabit ethernet certainly for video production and also if your studio are heavy photoshop users. You could get away with 100Base-T but with 35 heavy users editing files stored on the server as well as Home folders it may be a bit too much. If this is the situation in your studio you would be better placed working locally and saving the files back to the server at the end of the day. You would set up your users with names and passwords in the OD directory node. Your studio can use those account details to log on to the server to access share points but still work locally if they need to. If you start windows services on the mac server then there should be no reason for windows clients to access share points on the mac server as well. Be careful how you configure windows services as you already have existing PC servers on the network.
As you have already stated your aim is to keep the macs completely separate from the PCs then consider connecting all your macs to a separate switch and have them running of a different IP address range and subnet mask. You could then use an intervening router to handle traffic between the two networks, this way you control cross platform access to shared resources. If you understand networks, routers etc then you should be able to accomplish this without too much trouble. Again searching the Server forums should give you plenty of ideas and advice on the best way to achieve what you want. As ever defining and deciding what you want you want the server to do is half the problem. -
Open Directory Migration Question
Setup:
My company has two servers, both running 10.5.6. We are migrating from the server Fubar (xserve) as it has had a lot of problems and we want to do a fresh install on it (I was not the admin who initially set it up).
In order to get a 'fresh' OD going, we are recreating all the accounts on the new server Edoras (powerpc mac pro), making sure to preserve UID of the users.
Problem:
User A cannot change his password on Edoras after Directory Utility has been changed to point at it. He can change his password locally, but it does not propagate to Edoras, nor does a password change on Edoras affect his local machine.
The questions I haven't been able to get answers for are:
* Should the OD search string be different on Fubar and Edoras? Currently our search string is 'dc=fubar,dc=domain,dc=com'.
* Are there other attributes that have to be setup in OD besides UID? I noticed when using the Target tab in Workgroup Manager that there is a GeneratedUID attribute, does this need to match?
Thanks for any information/help.I did something like this recently. Unfortunately I couldn't get an answer on the Internet and had to re-configure Directory Access on the client machines manually.
I moved our system from a POwerMac G4 with several upgrades (eSATA card, eSATA Coolgear Enclosure, 7200.11 (yeah I know, bad drives to use) Seagate drives, 1.8 GHz PPC 7447 upgrade, 1.5GB of ram) to a new Mac Pro with a Highpoint RAID controller. The old G4 was very unreliable and couldn't hand
I had to go to each machine with ARD, open Directory Access, delete the LDAP entry and re-enter it. This was really annoying and confusing for me as the old server and the new server had:
The same version of OSX (ok, one was a PPC version and I special ordered the Intel version from Apple Tech Support), but they both were running 10.4.11 with the newest security patches.
The same OD Search Strings
The same IP Address for the Server
The same DNS name for the server
and the same user IDs and group settings
and I still had to re-do Directory Access using the client machines. Before re-doing the Directory Access re-binding I would try to login. The "other" icon would appear on the loging window, but when I would loging with the correct username and password the login windows would "shake it's head" and wouldn't let me login.
The biggest pain was that portable directories didn't sync correct anymore, so I had to manually backup, then delete the account, then re-bind, then re-create and restore the portable directory on each laptop manually.
Unfortunately I do not know the unix command to change directory binding to client computers using ARD. If such a command exists it would make things much easier for you. Does anyone know if a command exists? -
Open directory unable to start up after crash
Hi everyone,
Our OS X Server 10.8.4 crashed. After booting up again open directory doesn't want to start up so LDAP isn't running which means nobody can access their mails or do anything.
When trying to start the Open Directory service in the "Server" app it just says "Unable to load replica list"
Looking at the Open Directory Log after trying to switch it on this is what I get :
2013-06-28 15:22:53.830872 SAST - 43.7184, Module: AppleODClientLDAP - unable to create LDAP connection context - no server specified
2013-06-28 15:22:53.830888 SAST - 43.7184 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
2013-06-28 15:22:53.830888 SAST - 43.7184, Module: AppleODClientLDAP - unable to open connection to LDAP server - unable to create connection context
2013-06-28 15:23:23.832473 SAST - 43.7189 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
2013-06-28 15:23:23.832473 SAST - 43.7189, Module: AppleODClientLDAP - unable to create LDAP connection context - no server specified
2013-06-28 15:23:23.832488 SAST - 43.7189 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
2013-06-28 15:23:23.832488 SAST - 43.7189, Module: AppleODClientLDAP - unable to open connection to LDAP server - unable to create connection context
Does anyone have any advice on how to get it up and running again? I'd hate to lose all my users emails and do the server over. I have a time machine backup of a week ago as well which I guess is the second-to-last resort to restore the entire server from there?
Please help, I'm desperate here
Thanks
JI was able to restore the existing server with the automatic OD backup that Server.app creates. When my OD fails to start after a crash and db_recover commands don't work, it's always worked for me to restore the odmaster from a backup using the command:
sudo slapconfig -restoredb /private/var/backups/ServerBackup_OpenDirectoryMaster.sparseimage
I'm careful to keep an independent OD backup with Carbon Copy Cloner and this preflight script.
You can also grab an earlier version of the sparse image ServerBackup_OpenDirectoryMaster.sparseimage from a Time Machine backup. It's also possible to rsync the database files directory from a Time Machine backup.
Maybe you are looking for
-
Log File name and path to check Excel Download
Hi , When we download a report in Excel/PDF/HTML is it logged in any log file ? What is the log file name and path? Regards Anand
-
Project Systems - Report on WBS and Settlement recievers
Need help in searching for any PS report wherein I can get list of WBS elements along with the settlement receivers defined in the settlement rule. Or else how can we get such a report.
-
Why can't I install airport express utility onto my computer
I need to install the airport utility from the disc onto my compter. When I tried to install the utility it would not allow me to install it, because the software on the computer was not supported. Any suggestions on how to get the utility from the a
-
Tried to install vmware server, now i cant login as user
[root@L1nuXan7 ~]# tail /var/log/messages.log Dec 6 23:30:27 L1nuXan7 [drm] Initialized i915 1.5.0 20060119 on minor 1 Dec 6 23:30:43 L1nuXan7 kdm: :0[2777]: Can't save user authorization in home dir Dec 6 23:30:54 L1nuXan7 kdm: :0[2853]: Can't save
-
OPEN FORM WHEN-TREE-NODE-SELECTED
hello all... i have a tree and i wanna when i click on the node another forms open due to form name i have table includes form_if,form_name " as in H.D.D" when i present all nodes and i click on the node the form opened and when i click on other node