Binding imaged clients to Open Directory?

We created 10.5.2 image that we are trying to bind to Open Directory.
The first imaged client binds fine and adds itself to OD. However, additional clients won't bind. They claim that the computer account already exists.
I assume this is caused by each imaged client having the same "key" somewhere that it is using to bind to OD. Is there a way to regenerate this "key" on our clients once they are imaged?

The answer is to remove the local KDC on the 10.5 clients. 10.5 uses the LKDC for personal file sharing - not needed for networked clients.
Run the following commands to kill LKDC before binding the machine to Open Directory:
sudo dscl /Local/Default delete /Config/KerberosKDC
sudo rm -rf /var/db/dslocal/nodes/Default/config/KerberosKDC.plist
See: http://forums.bombich.com/viewtopic.php?t=11834&highlight=lkdc

Similar Messages

How do you bind Vista / XP clients to Open Directory?

I have an OSX Server OD Master set up in 10.5.6.
My OSX Clients can bind to it just fine using Directory Utility.
How do you bind Vista / XP clients to Open Directory masters?
Thanks

@ jakelh:
Make sure Kerberos is working on your server. Without it, PC logins will probably fail at least for Vista clients. Otherwise you'd have to downgrade a client-side setting on the Vista clients,
http://www.builderau.com.au/blogs/codemonkeybusiness/viewblogpost.htm?p=33927074 6
DNS is critical here, but Vista can have a problem with things that are correctly configured.
IE: Vista defaults to a TCP/IP setting that can make it incompatible with existing network hardware
http://www.tech-recipes.com/rx/1744/vistatcp_cannot_communicate_primary_dnsserve

Binding Exchange server to Open Directory

So I am setting up an exchange 2010 sandbox machine to see how feasible the install and usage of the software is within the company. When running through the installation it wants the exchange server machine to be bound to an active directory. Well I dont have any active directory servers all I have is our open directory. How can I tie in the exchange binding to the open directory? I have heard about integrating between OD and AD but it seems like it requires yet another AD machine.
Any thoughts? Success Stories?

The answer is to remove the local KDC on the 10.5 clients. 10.5 uses the LKDC for personal file sharing - not needed for networked clients.
Run the following commands to kill LKDC before binding the machine to Open Directory:
sudo dscl /Local/Default delete /Config/KerberosKDC
sudo rm -rf /var/db/dslocal/nodes/Default/config/KerberosKDC.plist
See: http://forums.bombich.com/viewtopic.php?t=11834&highlight=lkdc

Directory Binding Script (Active and Open Directory) 10.7

Hi everyone
I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
#!/bin/sh
#Uncomment the following line to abort the script on errors
#trap exit ERR
## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
## Script written by Marc Horat, URZ Basel, 11.6.2010
## Updated: 12.08.2011
# With the use of the following sources as inspiration:
# http://www.howtomac.co.uk/?p=247
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
# Bombich's AD-Bind Script:
# This script binds to AD and configures advanced options of the AD plugin
# As this scripts contains a password, be sure to take appropriate security
# precautions
# A good way to run this script is to set it as a login hook on your master machine
# Because it only needs to be run once, the last thing this script does is to delete
# itself. If you have another login script that you typically run, include the
# script on your master machine, and indicate its path in the "newLoginScript"
# variable.
# If running this as a one-time login hook to bind to AD after imaging,
# be sure to enable auto-login (for any local user) before creating your master image
#################CONFIGURATION##########################
#OD
# These variables need to be configured for your env
odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
odPassword="YOURODPW" # Enter your OD admin password between the quotes
oddomain="YOURODDOMAIN" # FQDN of your OD domain
computerGroup="YOURNEWODCOMPGROUP" # Add appropriate computer group you want machines to be added to, case sensitive
oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
#AD
# Standard parameters
domain="YOURADDOMAIN"                              # fully qualified DNS name of Active Directory Domain
domainname="YOURADDOMAINNAME"                    #Name of the Domain as specified in the search paths
udn="YOURADADMIN"                              # username of a privileged network user
password="YOURADPW"                                                  # password of a privileged network user
ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN"                    # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
# Advanced options AD Plugin
alldomains="disable"                              # 'enable' or 'disable' automatic multi-domain authentication
localhome="disable"                              # 'enable' or 'disable' force home directory to local drive
protocol="smb"                                        # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
mobile="enable"                              # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="enable"                    # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="enable"                              # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash"                    # e.g., /bin/bash or "none"
preferred="-preferred $domain"          # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
packetsign="allow"                              # allow | disable | require
packetencrypt="allow"                    # allow | disable | require
passinterval="14"                              # number of days
namespace="domain"                              # forest | domain
# Login hook setting -- specify the path to a login hook that you want to run instead of this script
newLoginHook=""                    # e.g., "/Library/Management/login.sh"
################################# End of configuration
############ Begin of Script
# Host-specific parameters
# computerid should be set dynamically, this value must be machine-specific
# This value may be restricted to 19 characters! The only error you'll receive upon entering
# an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
#computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
#computerid=`hostname | sed 's/.unibas.ch//'`
#computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
#computerid=`/usr/sbin/scutil --get LocalHostName`
computerid=`scutil --get ComputerName`
adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
# These variables probably don't need to be changed
# Determing if any directory binding exists
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
          check4OD=${check4ODtmp//[[:space:]]/}
          echo "Found LDAP: "$check4ODtmp
          check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
          check4ODacct=${check4ODaccttmp//[[:space:]]/}
          echo "Found LDAP-Computer-Account: "$check4ODacct
else
          check4OD=""
          check4ODacct=""
          echo "No bound LDAP Server found"
fi
if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
          check4ODgroupMembership=$check4ODgroupMembershiptmp
          echo "LDAP Group Membership in Group: "$oldComputerGroup
else
          check4ODgroupMembership=""
          echo "No LDAP Group Membership defined or not bound to a server"
fi
if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
then
          check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//' | sed 's/=//'`
          check4AD=${check4ADtmp//[[:space:]]/}
          echo "Found AD: "$check4AD
          check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
          check4ADacct=${check4ADaccttmp//[[:space:]]/}
          echo "Found AD-Account: "$check4ADacct
else
          check4AD=""
          check4ADacct=""
          echo "No AD-Account found"
fi
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
#Time Sync
#Restart ntpdate
StartService ()
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
          CheckForNetwork
if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
          touch /var/run/NetworkTime.StartupItem
          echo "Starting network time synchronization"
# Synchronize our clock to the network‚Äôs time,
# then fire off ntpd to keep the clock in sync.
          ntpdate -bvs
          ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
echo ""
echo ""
sleep 5
#### Removing any existing directory bindings
#Clear OD Computer Account and delete entry from Computer group
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "This computer is bound to the following Open Directory Services:"
          dscl localhost -list /LDAPv3
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /LDAP
          sleep 5
          if [ "${check4ODacct}" == "${computerid}" ]
          then
                    echo "This machine already has a computer account on $oddomain."
                    # Set the GUID
                    GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
                    echo "Found GUID: "$GUID
                    if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
                    then
                              echo "Removing entry from group $oldComputerGroup"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
                    fi
                    echo "Removing Computer entry $computerid in OD"
                    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
          fi
          #List existing Directories
          echo "Removing OD-Binding to "$check4OD
          dsconfigldap -r "$check4OD"
          echo "Removing Search Path entries"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          sleep 5
else
          echo "No LDAP or OD Binding present.";
fi
echo ""
# Check a second time in order to delete any remaining LDAP-Bindings
echo "Scanning for further LDAP servers"
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "Found:"
          dscl localhost -list /LDAPv3
          echo "Removing OD-Binding to "$check4ODtmp
          dsconfigldap -r "$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          sleep 5
else
          echo "No further LDAP or OD Binding present."
fi
echo ""
echo ""
#Remove the Active Directory binding
if [ "$check4AD" != "" ]
then
          echo "This computer is bound to the following Active Directory Services:"
          dscl localhost -list "/Active Directory"
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /Active
          sleep 5
          echo "Removing any existing AD-Binding to "$check4AD
    dsconfigad -f -remove -username "$udn" -password "$password"
    echo "Removing Search Path entries"
          if [ "$preferred" != "-nopreferred" ]
          then
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
          fi
          dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
          dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
#remove search path entries from 10.6
    if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
    then
        dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
        dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
    fi
          sleep 5
else
          echo "No Active Directory Binding present."
fi
echo ""
#Remove Existing Directory Services Config
echo "Removing existing DS Config"
if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
then
          rm -R /Library/Preferences/edu.mit.Kerberos
fi
if [ -d "/etc/krb5.keytab" ]
then
          rm -R /etc/krb5.keytab
fi
# Clean up the DirectoryService configuration files
rm -Rfv /Library/Preferences/DirectoryService/*
#OD
echo ""
echo ""
echo "Binding to OD-Damin "$oddomain
sleep 5
dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
echo "Killing opendirectoryd"
killall opendirectoryd
sleep 5
echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
# Add computer to ComputerList and ComputerGroup
if [ $computerGroup != "" ]
then
          echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
fi
echo "Finished OD Binding."
sleep 5 # Give DS a chance to catch up
echo ""
echo ""
echo "Performing the AD Binding"
#AD
# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
#Use the existing AD-Computername or generate a new one
computeridtmp="default"
if [ "$check4ADacct" == "" ]
then
          LEN=$(echo ${#adcomputerid})
          if [ $LEN -lt 15 ]; then
                  echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
                  computeridtmp=$adcomputerid
          else
                  echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
                    echo "Removing any -"
                  computeridtmp=${adcomputerid//-/}
                              LEN=$(echo ${#computeridtmp})
                              if [ $LEN -lt 15 ]; then
                                        echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
                              else
                                        echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
                                        computeridtmp=${computeridtmp:(-15)}
                              fi
                  echo "Cropped Computername to "$computeridtmp
          fi
else
    computeridtmp=${check4ADacct//$/}
    echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
fi
echo ""
# Bind to AD
echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
echo ""
echo "Setting the Advanced AD Plugin options"
# Configure advanced AD plugin options
if [ "$admingroups" = "" ]
then
          dsconfigad -nogroups
else
          dsconfigad -groups "$admingroups"
fi
dsconfigad -alldomains "$alldomains"
dsconfigad -localhome "$localhome"
dsconfigad -protocol "$protocol"
dsconfigad -mobile "$mobile"
dsconfigad -mobileconfirm "$mobileconfirm"
dsconfigad -useuncpath "$useuncpath"
dsconfigad -shell "$user_shell"
dsconfigad "$preferred"
dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
dsconfigad -namespace "$namespace"
sleep 5
echo ""
echo ""
# Add the OD & AD node to the search path
if [ "$alldomains" = "enable" ]
then
          csp="/Active Directory/$domainname/All Domains"
else
          csp="/Active Directory/$domainname"
fi
echo "Finished AD Binding."
echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
echo "Adding OD.."
dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
echo "Adding AD.."
#Adding all Domains first to improve reliability under 10.7
if [ "$alldomains" != "enable" ]
then
    cspadall="/Active Directory/$domainname/All Domains"
    dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
    dscl /Search -append / CSPSearchPath "$cspadall"
fi
dscl /Search/Contacts -append / CSPSearchPath "$csp"
dscl /Search -append / CSPSearchPath "$csp"
echo "Finished Updating Search Paths."
echo ""
echo ""
# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall opendirectoryd
# Destroy the login hook (or change it)
if [ "${newLoginHook}" == "" ]
then
          defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
else
          defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
fi
sleep 5
# Customizing the login-Window
#defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
#defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
#defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
# This works in a pinch if the above code does not
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
#plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
#killall opendirectoryd
# Disable autologin
defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
srm /etc/kcpassword
echo ""
echo ""
echo ""
echo "Now bound to OD Domain:"
dscl localhost -list /LDAPv3
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
echo "Now bound to AD Domain:"
dscl localhost -list "/Active Directory"
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
exit 0                    ## Success
exit 1                    ## Failure
Any inputs, questions and improvement suggestions are, of course, most welcome!
Cheers
See

Hi everyone
I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
#!/bin/sh
#Uncomment the following line to abort the script on errors
#trap exit ERR
## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
## Script written by Marc Horat, URZ Basel, 11.6.2010
## Updated: 12.08.2011
# With the use of the following sources as inspiration:
# http://www.howtomac.co.uk/?p=247
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
# Bombich's AD-Bind Script:
# This script binds to AD and configures advanced options of the AD plugin
# As this scripts contains a password, be sure to take appropriate security
# precautions
# A good way to run this script is to set it as a login hook on your master machine
# Because it only needs to be run once, the last thing this script does is to delete
# itself. If you have another login script that you typically run, include the
# script on your master machine, and indicate its path in the "newLoginScript"
# variable.
# If running this as a one-time login hook to bind to AD after imaging,
# be sure to enable auto-login (for any local user) before creating your master image
#################CONFIGURATION##########################
#OD
# These variables need to be configured for your env
odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
odPassword="YOURODPW" # Enter your OD admin password between the quotes
oddomain="YOURODDOMAIN" # FQDN of your OD domain
computerGroup="YOURNEWODCOMPGROUP" # Add appropriate computer group you want machines to be added to, case sensitive
oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
#AD
# Standard parameters
domain="YOURADDOMAIN"                              # fully qualified DNS name of Active Directory Domain
domainname="YOURADDOMAINNAME"                    #Name of the Domain as specified in the search paths
udn="YOURADADMIN"                              # username of a privileged network user
password="YOURADPW"                                                  # password of a privileged network user
ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN"                    # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
# Advanced options AD Plugin
alldomains="disable"                              # 'enable' or 'disable' automatic multi-domain authentication
localhome="disable"                              # 'enable' or 'disable' force home directory to local drive
protocol="smb"                                        # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
mobile="enable"                              # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="enable"                    # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="enable"                              # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash"                    # e.g., /bin/bash or "none"
preferred="-preferred $domain"          # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
packetsign="allow"                              # allow | disable | require
packetencrypt="allow"                    # allow | disable | require
passinterval="14"                              # number of days
namespace="domain"                              # forest | domain
# Login hook setting -- specify the path to a login hook that you want to run instead of this script
newLoginHook=""                    # e.g., "/Library/Management/login.sh"
################################# End of configuration
############ Begin of Script
# Host-specific parameters
# computerid should be set dynamically, this value must be machine-specific
# This value may be restricted to 19 characters! The only error you'll receive upon entering
# an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
#computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
#computerid=`hostname | sed 's/.unibas.ch//'`
#computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
#computerid=`/usr/sbin/scutil --get LocalHostName`
computerid=`scutil --get ComputerName`
adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
# These variables probably don't need to be changed
# Determing if any directory binding exists
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
          check4OD=${check4ODtmp//[[:space:]]/}
          echo "Found LDAP: "$check4ODtmp
          check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
          check4ODacct=${check4ODaccttmp//[[:space:]]/}
          echo "Found LDAP-Computer-Account: "$check4ODacct
else
          check4OD=""
          check4ODacct=""
          echo "No bound LDAP Server found"
fi
if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
          check4ODgroupMembership=$check4ODgroupMembershiptmp
          echo "LDAP Group Membership in Group: "$oldComputerGroup
else
          check4ODgroupMembership=""
          echo "No LDAP Group Membership defined or not bound to a server"
fi
if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
then
          check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//' | sed 's/=//'`
          check4AD=${check4ADtmp//[[:space:]]/}
          echo "Found AD: "$check4AD
          check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
          check4ADacct=${check4ADaccttmp//[[:space:]]/}
          echo "Found AD-Account: "$check4ADacct
else
          check4AD=""
          check4ADacct=""
          echo "No AD-Account found"
fi
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
#Time Sync
#Restart ntpdate
StartService ()
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
          CheckForNetwork
if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
          touch /var/run/NetworkTime.StartupItem
          echo "Starting network time synchronization"
# Synchronize our clock to the network‚Äôs time,
# then fire off ntpd to keep the clock in sync.
          ntpdate -bvs
          ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
echo ""
echo ""
sleep 5
#### Removing any existing directory bindings
#Clear OD Computer Account and delete entry from Computer group
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "This computer is bound to the following Open Directory Services:"
          dscl localhost -list /LDAPv3
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /LDAP
          sleep 5
          if [ "${check4ODacct}" == "${computerid}" ]
          then
                    echo "This machine already has a computer account on $oddomain."
                    # Set the GUID
                    GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
                    echo "Found GUID: "$GUID
                    if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
                    then
                              echo "Removing entry from group $oldComputerGroup"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
                    fi
                    echo "Removing Computer entry $computerid in OD"
                    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
          fi
          #List existing Directories
          echo "Removing OD-Binding to "$check4OD
          dsconfigldap -r "$check4OD"
          echo "Removing Search Path entries"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          sleep 5
else
          echo "No LDAP or OD Binding present.";
fi
echo ""
# Check a second time in order to delete any remaining LDAP-Bindings
echo "Scanning for further LDAP servers"
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "Found:"
          dscl localhost -list /LDAPv3
          echo "Removing OD-Binding to "$check4ODtmp
          dsconfigldap -r "$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          sleep 5
else
          echo "No further LDAP or OD Binding present."
fi
echo ""
echo ""
#Remove the Active Directory binding
if [ "$check4AD" != "" ]
then
          echo "This computer is bound to the following Active Directory Services:"
          dscl localhost -list "/Active Directory"
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /Active
          sleep 5
          echo "Removing any existing AD-Binding to "$check4AD
    dsconfigad -f -remove -username "$udn" -password "$password"
    echo "Removing Search Path entries"
          if [ "$preferred" != "-nopreferred" ]
          then
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
          fi
          dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
          dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
#remove search path entries from 10.6
    if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
    then
        dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
        dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
    fi
          sleep 5
else
          echo "No Active Directory Binding present."
fi
echo ""
#Remove Existing Directory Services Config
echo "Removing existing DS Config"
if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
then
          rm -R /Library/Preferences/edu.mit.Kerberos
fi
if [ -d "/etc/krb5.keytab" ]
then
          rm -R /etc/krb5.keytab
fi
# Clean up the DirectoryService configuration files
rm -Rfv /Library/Preferences/DirectoryService/*
#OD
echo ""
echo ""
echo "Binding to OD-Damin "$oddomain
sleep 5
dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
echo "Killing opendirectoryd"
killall opendirectoryd
sleep 5
echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
# Add computer to ComputerList and ComputerGroup
if [ $computerGroup != "" ]
then
          echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
fi
echo "Finished OD Binding."
sleep 5 # Give DS a chance to catch up
echo ""
echo ""
echo "Performing the AD Binding"
#AD
# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
#Use the existing AD-Computername or generate a new one
computeridtmp="default"
if [ "$check4ADacct" == "" ]
then
          LEN=$(echo ${#adcomputerid})
          if [ $LEN -lt 15 ]; then
                  echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
                  computeridtmp=$adcomputerid
          else
                  echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
                    echo "Removing any -"
                  computeridtmp=${adcomputerid//-/}
                              LEN=$(echo ${#computeridtmp})
                              if [ $LEN -lt 15 ]; then
                                        echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
                              else
                                        echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
                                        computeridtmp=${computeridtmp:(-15)}
                              fi
                  echo "Cropped Computername to "$computeridtmp
          fi
else
    computeridtmp=${check4ADacct//$/}
    echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
fi
echo ""
# Bind to AD
echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
echo ""
echo "Setting the Advanced AD Plugin options"
# Configure advanced AD plugin options
if [ "$admingroups" = "" ]
then
          dsconfigad -nogroups
else
          dsconfigad -groups "$admingroups"
fi
dsconfigad -alldomains "$alldomains"
dsconfigad -localhome "$localhome"
dsconfigad -protocol "$protocol"
dsconfigad -mobile "$mobile"
dsconfigad -mobileconfirm "$mobileconfirm"
dsconfigad -useuncpath "$useuncpath"
dsconfigad -shell "$user_shell"
dsconfigad "$preferred"
dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
dsconfigad -namespace "$namespace"
sleep 5
echo ""
echo ""
# Add the OD & AD node to the search path
if [ "$alldomains" = "enable" ]
then
          csp="/Active Directory/$domainname/All Domains"
else
          csp="/Active Directory/$domainname"
fi
echo "Finished AD Binding."
echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
echo "Adding OD.."
dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
echo "Adding AD.."
#Adding all Domains first to improve reliability under 10.7
if [ "$alldomains" != "enable" ]
then
    cspadall="/Active Directory/$domainname/All Domains"
    dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
    dscl /Search -append / CSPSearchPath "$cspadall"
fi
dscl /Search/Contacts -append / CSPSearchPath "$csp"
dscl /Search -append / CSPSearchPath "$csp"
echo "Finished Updating Search Paths."
echo ""
echo ""
# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall opendirectoryd
# Destroy the login hook (or change it)
if [ "${newLoginHook}" == "" ]
then
          defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
else
          defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
fi
sleep 5
# Customizing the login-Window
#defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
#defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
#defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
# This works in a pinch if the above code does not
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
#plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
#killall opendirectoryd
# Disable autologin
defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
srm /etc/kcpassword
echo ""
echo ""
echo ""
echo "Now bound to OD Domain:"
dscl localhost -list /LDAPv3
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
echo "Now bound to AD Domain:"
dscl localhost -list "/Active Directory"
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
exit 0                    ## Success
exit 1                    ## Failure
Any inputs, questions and improvement suggestions are, of course, most welcome!
Cheers
See

Adding Client to open Directory

I am trying to add a client machine to Open Directory but it will not bind. It gives me a error
Unable to add server
An unexpected error of typr -14142 (eDDSchemaError) occurred.
When I try to add the machine it will say machine is already in OD, but I look in OD is is not their. It will not let me over write the machine in OD eather.
Thanks

Is this machine a clone of another machine? My guess is you did not reset the local KDC. This will cause the issue you are describing. You need to do the following on all cloned machines as they will all contain the unique identity of the original master's LKDC. The machine that is the master does not need to be altered.
1: Open Keychain Access.
2: Select the System keychain.
3: Find the three entries labeled com.apple.kerberos.kdc and delete them from the System keychain.
4: Open Terminal
5: Run this command to destroy the local Kerberos DB (you will need to authenticate as initial admin):
sudo rm -R /var/db/krb5kdc
6: Run this command to rebuild a unique LKDC for this machine:
sudo /usr/libexec/configureLocalKDC
7: Repeat this on all cloned machines.
Once complete, you have re-run Directory Utility and perform your bind. You will now be creating a machine record with a unique LKDC value in OD.
PS: You can do these steps 1 through 5 pre-cloning to avoid the issue. Then once cloned, run step 7 as a post-cloning step.
Hope this helps.
Message was edited by: Strontium90 - added the PS

Authenticate windows users accessing os x client using open directory?

I need to setup an OS X client machine (10.4.6) so that windows users (XP) can access folders based on their open directory credentials. (Using OS X server, open directory, windows PDC). If I turn on windows sharing in system preferences on the mac, it will only share local home folders to users with local accounts - not what I need. Any ideas? thanks.

Thanks! So now I see Open Directory, but it seems like it should be listed under the Server app with all the other services...
Anyhow, I seem to remember a way to administer the users and groups. This app shows me the status of the services, logs, settings. The Server app, if I click on Add Users button, then click "connect to it" to supposedly connect to the directory server, it won't take my credentials. I always get "Cannot authenticate to server. Please authenticate by entering the name and password of a user account in this server's directory."
Connect anonymously doesn't seem to do anything, it doesn't even dismiss the dialog.
So what am I missing?

10.7.5 client shows open directory server not responding

Hello,
I am just starting to learn to use OS X Server. I have created an Open Directory Master and want to connect my various Mac's around the home to. My iMac is currently running 10.7.5 client and have tried to add the server as a Network Account Server - re: below, but it shows it is not responding.
As I am a real novice, have I missed something and how do I get this to work?
Thanks,
Nick

You are likely having issues because you are not using DNS correctly. The name "CowShed.local" is a bonjour name. In order to properly use Open Directory you need DNS set up internally. The reason is that the Kerberos component of Open Directory is very dependent on DNS.
Generally, I would discourage the use of bogus top level domain. However, since you say this is for home use, you can likely get away with the use of one (mac.leedern.int, mac.leederm.private, etc). However, if you do, then you will not be able to use hosted services (mail, calendar, contacts, etc) transparently between the home and external networks (names will not route).
If you own a domain name, you can use it internally and setup your DNS on the server. Then distribute the servers's LAN IP address to all clients as the first DNS server. This way, all your client devices can resolve the server's host name while on the LAN.
Your journey starts at DNS.
R-
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

HT200182 Authentication Error when trying to bind client to Open Directory

I know the diradmin password, and I've even tried resetting the password just in case and still no luck in getting the client to bind to the server. It keeps telling me authentication error - invalid username or password. I'm 100% sure the admin username is diradmin (default) and I'm 100% sure on the password. Caps Lock is not on, I've tried everthing. At this point I'm thinking I found a bug. Any ideas?

Logs?

Netboot, diskless clients, and Open Directory users?

Hi, I've been reading through the System Image pdf & maybe it's me but a couple of things aren't clear.
I want to set up diskless clients and allow users to log on to their network home folder using their OD login. Is this possible and where would be a good place to start with instructions on setup?
thanks, Patrick

Ok, I got it.
But what if I want the OD user to have some configuration data on the local client?
Let me explain that a bit better. The configuration I would like for my network and users is as follows: the server works only as an authentication server, I do not want roaming profiles or homes directory on the server; I just want the server to authenticate users when they log in to several client machines amongst the lan.
For documents sharing, in fact, I much rather prefer using Dropbox, which allows my users to share on a WAN-instead-of-LAN basis.
But a home local directory is needed for OD users to keep libraries, preferences files and so on.
Back to the old Windows server (PDC) time, I used the server as a name server authentication only, still the client created a local profile for the user of the server.
Does OD works this way too or am I missing something?
Thank you.

"Send to Color" Not Working in managed clients with Open Directory

Hello,
Previously, i try to do this from a local user, with finished sequence, initiated the "send to color" command from the pop up menu, named the project, graded the footage and output the results.
However when i log with a network managed client when I click, "send to color", the dialog box comes up to name the Color project, which I do, but then when I click past that, nothing happens. Color does not open, nothing seems to be exported or "sent". Any ideas?

Same issue here. Trashed prefs, no effect

How to bind (if possible) Windows 8 clients to OSX Open Directory 10.8?

I read several articles that I have to go through the magic triangle (bind the Open Directory to an Active Directory), but almost all of the articles are from 2012 and below.
This is possible now?
Thank you.

Hi mbellido,
Are you trying to bind a Windows 8 client to Open Directory (OS X 10.8)?
Thanks
Dan

How do I unbind a local user from an Open Directory user?

I have a couple MacBook Pros running Leopard that successfully bound a local account to a corresponding Open Directory account using Directory Utility.
I had to re-install Leopard Server (using Standard configuration) and re-create Open Directory accounts. Now these laptops are unable to bind to the new Open Directory accounts. They receive an error that the Open Directory user ID and password provided is incorrect. In addition the local user can no longer reset or change their password. I'm thinking this is because their local accounts are still bound to the old Open Directory accounts that no longer exist. Is there are way to unbind a local account in Leopard that has been bound to an Open Directory account via the Directory Utility.

What account are you using to bind the machine? When binding you must authenticate using the OD admin login which is usually setup as diradmin or as the current client you are logged into the machine with, but this client needs to exist on the OD server.

Using iChat Server with Windows clients in an integrated Active Directory/Open Directory environment

A co-worker (Super Brent) and I were working on using iChat as an internal IM server after having used Openfire for a couple days. The reason for switching was basically that we had a Mac Mini Server that was available so we decided to take this on.
First problem: Knowing whether or not Kerberos was needed for AD/OD integration. We spent a ton of time on this, not knowing a huge amount about AD and with our server administrator on courses, we just kept poking at it and removed Kerberos.
For the AD/OD integration, we first bound the Mac Mini to our Active Directory server. We shut off LDAPv3 support as we only wanted to use the AD functionality. Additionally, we ensured that the search policy in Directory Utility only used Active Directory. Then we created an Open Directory master in the Open Directory service. We enabled a self-signed certificate and trusted it locally. After creating the iChat service, ensure that you use the self-signed SSL Certificate and set authentication to Standard. (no kerberos).
Second problem: Once this was complete, we started to test clients out. We were unable to successfully login using our AD credentials using Spark IM and Pandium IM. After trying nearly 100 different variations of server configs, we decided to try a new client. I installed Miranda IM on my Windows XP machine and tried a few different setups. It turned out that the magic potion was to make sure that the "resource" field was set to "Home" and use SSL for encryption. This resource setting was the deal breaker for the other IM clients as many of them such as Spark and Pandium do not have this as a login option.
We ended up using Pidgin IM as the Windows client of choice as it did have the resource variable and it's interface was the best suited for our environment and users.
I hope this helps someone out there as we spent days looking all over the internet trying to figure this out.
Cheers,
Frenchy and Super Brent

Hi,
iChat Server is not something that I know a great deal about.
I tend to point people to the OS X Server Communities and to look out for posts by Tim Harris.
Thanks for taking the time to post this.
9:58 PM Friday; February 10, 2012
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
 iMac 2.5Ghz 5i 2011 (Lion 10.7.3)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
"Limit the Logs to the Bits above Binary Images."  No, Seriously

10.3.9 clients not working with 10.4.9 open directory server

I have a 10.4.9 server running open directory and managing about 20 10.4.9 clients. I am trying to have it manage our remaining 10.3.9 clients, but for whatever reason, I cannot seem to get the 10.3 clients to "attach" to the server.
I have the 10.3 clients set up in a computer list on the server, and in directory access I have it set to "get ldap mappings from server". At one point, it was suggested to me that I have the clients "get ldap mappings from open directory server". I tried this, and manually set the search base suffix. My search base suffix was "dc=example,dc=local". I even tried doing "cn=config,dc=example,dc=local" (where in both cases example.local was replaced with my real DNS name). Any suggestions on what else I could try to get this to work?

That's the odd thing though. I've done this with 10.4 no problem. Settings always worked. For some reason though, even though the clients are able to login using a network user, none of the preference settings sync.
For example - I always put a loginwindow message on as a sort of "test" to see if preferences are being set. If that works, then I rarely have a problem. No matter what I do, though, I cannot get the loginwindow message to display on the 10.3 clients. It works really well on 10.4, but not at all on 10.3. I've tried this on multiple 10.3 machines, as well, (and they're both based on different system images) but it still doesn't work. When I get back to work on Friday, I'll have to see if preferences will work for network users; that's the one thing I haven't tried.
Other than dumping the directoryaccess preferences, is there another preference setting that could be dumped on the client that may make it grab prefs from the server?

Open Directory or LDAP Problem with 10.5 Client and 10.4 Server

Yesterday, the client-server setup we've been using successfully FOR YEARS decided not to work on a v10.5.8 MacBook Pro client. Did not do anything to the v10.5 client recently (other than to boot it up). Not sure if any software was updated on the server recently (where do I check for this?). Curiously, a v10.4.11 client running on a Mac Pro (tower) continues to work fine/as though nothing's changed. It appears as though the only difference is v10.4 client (working) vs. v10.5 client (not working).
Here is what IS working:
1) Network Home Directories on dedicated drive partition of Mac running OS X Server v10.4.11. AFP, DNS, and Open Directory are all up and running (normally, I think) as shown in Server Admin application.
2) Mac Pro (tower) client running v10.4.11 binds to and authenticates at v10.4.11 server. Any valid user can access their home directory on the server seamlessly when logging in at this v10.4.11 client Mac.
3) That same v10.4.11 client Mac also contains a LOCAL admin user with its home directory on the local hard drive. That LOCAL admin account is used to update software on a per machine basis (and preclude users from adding unauthorized software, needing to use a specific machine, etc.).
Here is what IS NOT working:
4) On a MacBook Pro client running v10.5.8, the LOCAL admin account looses access to the partition containing its local home directory. The drive partition literally disappears. The only "solution" I've been able to find (and it's not truly a solution) is to turn off the Open Directory/LDAP binding (using the Directory Utility application). With binding turned off, the LOCAL admin user has no problem accessing their home directory on the local hard drive partition. Turn binding on again (using Directory Utility application), and the LOCAL admin user can no longer see its local home directory.
Again, binding is necessary to allow regular users to use the v10.5 MacBook Pro with Network Home Directories (as in items 1-3 above). Binding should be turned on for this reason. However, with binding on, the LOCAL admin user cannot manage the computer because the local partition containing the admin home directory disappears/is inaccessible. Turn binding off, and the partition containing the admin home directory reappears.
Perhaps there's something in the sever logs that will help. I don't really know how to read these, so if your help involves the logs, please refer to them explicitly (e.g., "in Server Admin, go to Open Directory->Logs->LDAP log" or similar).
Any help greatly appreceated.

Nope. Never used sso_util.
I try to use Apple's GUI server management tools unless absolutely necessary/at the end of my rope (i.e., last step before re-install etc.). I figure there's just too many things going on under the hood: using the command line may fix one setting, but not re-configure the two or three others that Apple NEEDS in order to have the whole thing working in harmony. Unless you really know what's going on with all the configuration files, it's best to let the GUI manage the settings.
In my particular circumstance, I've now got ALL Leopard clients, one Leopard v10.5 server, and one Tiger v10.4 server. Everything is working fine now, but it was not a simple matter getting the Tiger v10.4 server re-integrated into the otherwise ALL Leopard environment. OD/Kerberos is on the Leopard v10.5 server. Home directories are still on the Tiger v10.4 server.
Two keys to getting THIS/MY set-up working:
1) Tiger v10.4 server needs to have Open Directory set to "Connected to a Directory System" and has to be joined to the Kerberos realm that was set-up on the Leopard v10.5 server (use Server Admin to do all of this).
2) Sharepoint on Tiger v10.4 server has to have SOME, but NOT ALL checkboxes for guest access enables/checked. See:
http://discussions.apple.com/message.jspa?messageID=10903468#10903468
Number 2 immediately above is contrary to what Apple manual for User Management reads, but this is what worked for me/my set up, after pulling my hair out following the manual's instructions to the letter and not getting the thing to work!

Binding imaged clients to Open Directory?

Similar Messages

Maybe you are looking for