Changing Domain of Open Directory

Might be trying to fix too many things at a go here, so I do apologise if it seems messy.
Currently :
On an Xserve with OD that has yet to be kerberised. Getting errors such as being unable to delete users/computers with WGM. (Users deletion resolved with changing crypt).
Would like to shift Current OD onto another server with different domain. Are the following steps the correct steps to take ?
1. Archive current OD
2. Demote to standalone
3. Promote to Master
4. Change LDAP settings
5. Restore from Archive made earlier (this results in the changing of search base?)
On a similar note is changing the domain of a current server as simple as execute changeip :
e.g.
changeip 10.0.1.10 10.0.1.10 server.example.school.nz server.example.com
and the steps mentioned above ?

I changed my domain from XSERVE to XSERVER using changeip, but have since discovered if your Server is an OD Master (like mine is), the search base DOES NOT change (it's still XSERVE not XSERVER). I'm now getting hundreds of errors logged, all relating to kerberos.
To get the search base to change, you need to export all your user accounts, demote the server to a standalone, change the search base to the correct one, then promote the server back to an OD Master, re-import your user accounts and it should be fixed. I am going to do this on Friday, so if it goes wrong I have a weekend to put it back how it was...
One downside to this approach is all users will have their passwords reset. Not an issue if there are only 20 users (like I have), more of a problem if you have hundreds of users.
Hope this helps!

Similar Messages

  • Migrate existing users from local domains to Open Directory.

    Here is the environment I'm working with:
    Small local environment (8-10) users. Everyone is on their own laptop, everyone is authenticating to their local directories. Network files are stored on a server, with everyone using a single shared user ID to authenticate and access the files.
    I have just installed a Xserve, and it is now serving DNS, DHCP, NTP, WWW. I want to setup Open Directory in Master mode, create user IDs for everyone, and then assign permissions to the shared files area.
    The one part that I'm not sure how to approach is the local laptops. If user "John Doe" has a local ID "jdoe" that he has been using on his local laptop, how does he migrate over to being "jdoe" in the OD domain, while reatining his "local" home directory and files? The problem I think I'll have is that when I create "jdoe" on the domain, he will have a UID of (say) 10001, but his local UID is 501 (as is the UID of all the other employees since they are all the first user on each of their respective laptops.) so when he logs back into his laptop after it has been attached to the OD domain, I assume that the laptop will see "jdoe" from the OD domain as a new user and create a new home for him (with the UID:10001), so now John cannot see any of his old files and such.
    Also, as a side question: I've worked with Windows ID before, and I know once you join a windows computer to a domain and then login to it, it creates a new user and caches the authentication info, so that when the laptop is not connected to the corporate network, the user can still login and work. Does Open Directory do the same on the laptops?
    Thanks for any help.

    Retaining password is a manual process of asking the user what his or her password is and then creating it in OD.
    As for migration of account, it is rather simple, provided the short name of the user remains consistent across directory systems. For example, if you have a user named Joe User and his short name is juser with a home folder in /Users/juser. And you create the same account in OD. You can do these few short actions.
    1: Bind system to the domain
    2: From the Admin account, and using Terminal from root, navigate to /var/db/dslocal/nodes/Default/users and find the plist file for the user (in our example, juser.plist).
    3: Delete the file using rm
    4: Restart the machine or restart Open Directory
    5: Log in as the admin user and change ownership of the users home folder. Recall that when the user is in the local domain, the UID was likely 502, 503, etc (you do have a standard local admin at 501 right?) Now that the user is in OD, the UID will be 4 digits, something like 1027. So understanding that user attributes and user data are independent, you now have a folder in /Users titled juser and owned by uid 50x. You need to make it owned by juser from the OD domain. User this:
    sudo chown -R juser /Users/juser
    6: Log out of the admin account
    7: Log in as the user after choosing Other at login window.
    Assuming you have your OD account set up properly, you will likely be asked to confirm the caching of the users credentials. This will path you right back into the user's home folder and all will be right with the world.
    This is simple and quick. If the shortnames are different, throw an mv into the mix to rename the home folder to match the domain shortname. If you have no local admin, then you will need to reset DSLocal and start again.

  • Unable to make changes in WGM/Open Directory

    Hi,
    About a week ago our users were unable to authnticate to out wiki services. After doing a little digging it turns out the OD Master had dumped it binding. I rebound it 127.0.0.1 and now I get this error whenever I attempt an action that woud require admin privileges: I'm
    "Open Directory This action failed because you are not authorized to perform the operation"
    I don't know where to go in the logs to find a path to a solution. I suspect that archiving the OD, demoting, remoting and restoring might solve things. The big scary thing there is; will all my users calendars and other Collaboration resources be there when I get done? Coul dit be as simple as moving the edi.mit.Kerberos file out of the way and scrubbing and rebinding with Directory utility?
    Thanks for your thoughts

    I did check the search paths, and the search base and the server is in both. Binding is done with diradmin. Connection to the directory with any user including root gives the same result. Rebooting has no effect.
    Last night I demoted and remoted and restored from an archive I made yesterday. The issue persists. BUT I restored from an archive I had from about 6 weeks ago and the problem disappears.
    So I have a functioning LDAP directory now and users are able to authenticate and access their stuff.
    Now I have two almost identical archies one with the fault one without. I would really like to find the actual fault and examine it. Does anyone have a suggestion about where I might begin and what the fault might look like?
    Thanks!

  • Authentication Delays / Slow Authentication for Open Directory Users

    I'm experiencing delays when authenticating Open Directory users and it absolutely has me at my wit's end.
    The problem is quite simple: any time an Open Directory user authenticates his password there is a delay of at least 5-10 seconds. This goes for clients that are bound to the directory server and also authenticating locally on the server. Here are some examples:
    * On the server, there is a several second delay on the Login Window screen when trying to log in using an Open Directory account. Logging in as a local user is instantaneous.
    * In Workgroup manager, authenticating as the Directory Administrator takes several seconds.
    * On a remote computer, sharing the screen using an Open Directory user take several seconds and again, a local user is instantaneous. Screen sharing takes particularly long and often temporarily shows a sheet saying it has lost the connection with the server while authenticating.
    * Connecting with AFP takes several seconds when using an Open Directory login
    * On a client computer, unlocking the screen after sleep or screen saver takes several seconds for Open Directory users
    * Connecting with SSH does NOT exhibit the behavior
    In addition to all of this, I've seen periodic random unexplainable freezes for several seconds on client computers that are bound to the directory even when logged in as a local user account (and with no other users logged in.) For example, launching applications often results in a freeze. After unbinding the computer from the directory the problem goes away entirely.
    The history of the problem:
    Used Tiger Server for over a year = no problems
    Clean install of Leopard Server 10.5.0 back in October = no problems
    Update to Leopard Server 10.5.1 = no problems
    Then, all of the sudden one day several weeks back I started having problems. The server had been up for a few weeks. I didn't install any updates. I didn't change any configuration. Literally the only thing that I had done recently was unplug the Apple Cinema Display and keyboard+mouse that was connected to the server. Then I started having problems so I plugged the display, keyboard and mouse back in to troubleshoot it. I cleared the directory services caches on my server and clients and rebooted the Airport Base Station that's serving as my router and eventually the problem went away. I wish I could tell you which of those things resolved the problem but I have no idea. It was fine for a couple more weeks (and incidentally I once again unplugged the display, keyboard and mouse from the server). Then last week I started having problems again and this time no amount of rebooting, cache clearing, rebinding, troubleshooting using information in these forums or anything else will fix the problem. I only mention the display/keyboard/mouse thing because it's literally the only thing I changed around the time the problems started happening. I truly don't think it has anything to do with it.
    So in desperation I backed up and did a clean install today. Here's the process I used:
    0. Erase the disk
    1. Install Leopard Server 10.5.0 from the install DVD
    2. In the setup assistant, use the Advanced Configuration option but I didn't enable any services. Set up network settings and host name of myserver.mydomain.private.
    3. Reboot
    4. Use Software Update to update to 10.5.1 and Security Update 2007-009 v1.1
    5. Reboot
    6. Configure DNS (see below for detailed configuration)
    7. Reboot
    8. Change role to Open Directory Master
    9. Reboot
    ... and the problem is still there. Simply logging into the server GUI with the Directory Administrator account has the delay. Authenticating in Workgroup Manager has the delay. I haven't even bothered to set up AFP or any other users yet. I'm truly at my wit's end and I'm ready to chuck the server out the window.
    I've done a lot of googling and searching of these forums looking for answers. All of the responses seem to point to a problem with DNS or with the Kerberos realm. I believe all of my setup is correct. Here it is:
    == Basic Configuration ==
    OS: Mac OS X Server 10.5.1 (9B18) with Security Update 2007-009 v.1.1
    Services Enabled:
    DNS
    Open Directory
    (All other services are not yet enabled)
    == DNS Setup ==
    Primary Zone: mydomain.private.
    Allows zone transfer: no
    Nameservers: ns.mydomain.private.
    myserver (Machine) 10.0.22.201
    ns (Alias) myserver.mydomain.private.
    Reverse Zone: 22.0.10.in-addr.arpa.
    10.0.22.201 (Reverse Mapping) myserver.mydomain.private.
    Accept recursive queries from the following networks:
    localnets
    Forwarder IP Addresses:
    208.67.222.222
    208.67.220.220
    == Open Directory Setup ==
    Role: Open Directory Master
    LDAP Search Base: dc=myserver,dc=mydomain,dc=private
    Kerberos Realm: myserver.mydomain.private
    == Network Configuration ==
    Configure: Manually
    IP Address: 10.0.22.201
    Subnet Mask: 255.255.255.0
    Router: 10.0.22.1
    DNS Server: 127.0.0.1
    Search Domains: mydomain.private
    == Other Stuff ==
    Using 'changeip -checkhostname' verifies that the hostname and DNS hostname are both myserver.mydomain.private.
    I set the realm to myserver.mydomain.private (though the default was myserver.local) based on the advice of another poster to this forum. Kerberos.app reveals something interesting: the kdc and admin servers are both myserver.local and the domains are .local and local. I tried changing all instances of 'local' to 'mydomain.private' to see if that would solve the problem. No luck.
    I verified on a client that 'host myserver' and 'host 10.0.22.201' return proper DNS and reverse DNS resolutions.
    Hopefully one of the gurus out there will be able to help me out.
    Thanks,
    jeff

    I gathered together some log information for when I try to authenticate user 'diradmin' in Workgroup Manager. You can see from the log messages that this authentication took 4 seconds. There's an interesting error message in slapd.log (see below) but it doesn't say what it's looking for in the keytab that it's not finding. Grr! I've provided a listing of the principles in my keytab. I haven't monkeyed around with it at all -- this is just what resulted from promoting the server to an Open Directory Master.
    == kdc.log ==
    Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): handling authdata
    Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): handling authdata
    Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): .. .. ok
    Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): .. .. ok
    Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for krbtgt/[email protected]
    Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for krbtgt/[email protected]
    Dec 30 18:21:52 myserver.mydomain.private krb5kdc[79](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for ldap/[email protected]
    Dec 30 18:21:52 myserver.mydomain.private krb5kdc[79](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for ldap/[email protected]
    == slapd.log ==
    Dec 30 18:21:48 myserver slapd[36]: <= bdbsubstringcandidates: (authAuthority) index_param failed (18)
    Dec 30 18:21:52 myserver slapd[36]: SASL [conn=20] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No principal in keytab matches desired name)
    == sudo klist -k ==
    Keytab name: FILE:/etc/krb5.keytab
    KVNO Principal
    3 afpserver/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4 D0DDB570D64ED88C5D06A78A34B7167C
    3 afpserver/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4 D0DDB570D64ED88C5D06A78A34B7167C
    3 afpserver/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4 D0DDB570D64ED88C5D06A78A34B7167C
    3 cifs/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB 570D64ED88C5D06A78A34B7167C
    3 cifs/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB 570D64ED88C5D06A78A34B7167C
    3 cifs/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB 570D64ED88C5D06A78A34B7167C
    3 vnc/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB5 70D64ED88C5D06A78A34B7167C
    3 vnc/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB5 70D64ED88C5D06A78A34B7167C
    3 vnc/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB5 70D64ED88C5D06A78A34B7167C
    3 cifs/[email protected]
    3 cifs/[email protected]
    3 cifs/[email protected]
    3 ldap/[email protected]
    3 ldap/[email protected]
    3 ldap/[email protected]
    3 xgrid/[email protected]
    3 xgrid/[email protected]
    3 xgrid/[email protected]
    3 vpn/[email protected]
    3 vpn/[email protected]
    3 vpn/[email protected]
    3 ipp/[email protected]
    3 ipp/[email protected]
    3 ipp/[email protected]
    3 xmpp/[email protected]
    3 xmpp/[email protected]
    3 xmpp/[email protected]
    3 XMPP/[email protected]
    3 XMPP/[email protected]
    3 XMPP/[email protected]
    3 host/[email protected]
    3 host/[email protected]
    3 host/[email protected]
    3 smtp/[email protected]
    3 smtp/[email protected]
    3 smtp/[email protected]
    3 nfs/[email protected]
    3 nfs/[email protected]
    3 nfs/[email protected]
    3 http/[email protected]
    3 http/[email protected]
    3 http/[email protected]
    3 HTTP/[email protected]
    3 HTTP/[email protected]
    3 HTTP/[email protected]
    3 pop/[email protected]
    3 pop/[email protected]
    3 pop/[email protected]
    3 imap/[email protected]
    3 imap/[email protected]
    3 imap/[email protected]
    3 ftp/[email protected]
    3 ftp/[email protected]
    3 ftp/[email protected]
    3 afpserver/[email protected]
    3 afpserver/[email protected]
    3 afpserver/[email protected]

  • Initial setup and Open Directory problem

    Hi,
    I'm new to the MAC OS X server system and trying to get one up and running on a G5.
    Unfortunately I can’t get the configuration up and running, and I have the feeling it already goes wrong during the initial setup. I was hoping you guys could help me out.
    The purpose of the server is providing network user accounts (DNS + Open Dir.) and providing sharepoints.
    I go trough following steps while installing from scratch:
    - Install MAC OS X and run the Server install package from the OS X Server DVD (as you know, OSX Server is'n installing directly on G5)
    - Choose keyboard layout, enter license and create an account "admin"
    - Define static IP "192.168.1.1", add this IP as the first in the list of DNS Servers, add "company.local" in the search domain
    - Install as a standalone server (so I can configure dns & other network services after basic setup)
    - Check "network time server" (so time will be synced for Kerberos)
    - Proceed, install and reboot
    OSX Server seems to be installed fine and I can login with "admin". Next step I take is configuring DNS.
    - create a zone "companyname.local.", use my IP as server address (192.168.1.1) and use "server" as the server name.
    - add a machine record for DNS-testing (called "gateway", with the IP of "192.168.1.254")
    Start the DNS service and reboot
    - perform an nslookup with a second MAC with 192.168.1.1 as the nameserver and verify that DNS is resolving correctly.
    DNS seems to be working fine, now I would like to get the Open Directory service to work:
    - change "Standalone" to "Open directory master" in the server configuration panel
    - provide a password for the directory admin
    - use "SERVER.COMPANYNAME.LOCAL" as kerberos realm, and "dc=server,dc=companyname,dc=local" as the search base
    - Save & start the service and perform a reboot to be sure all the new settings are in use
    Unfortunately after this install open directory doesn't seem to work fine and also Kerberos doesn't start.
    Concerning Kerberos: I get following output in the "Slapconfig log" Open Directory log file:
    Starting LDAP server (slapd)
    command: /usr/bin/ldapadd -c -x -D uid=root,cn=users,dc=maggie,dc=interesourcegroup,dc=local -w **
    Hostname server.companyname.local is from Rendezvous
    Skipping Kerberos configuration
    Sorry to bother you with the entire walkthrough of the installation, but I have the feeling that I'm missing something while performing the basic install or DNS setup .. ?
    Regards,
    Seppe
    G5 Mac OS X (10.4.6) /

    We currently have a static IP and a public dns hosted
    by MediaTemple, so I think I can create a subdomain
    on MediaTemple and link it to our fixed IP address
    ("private.companyname.com" >> static ip) instead of
    using dydns.. ?
    Of course.
    I suppose I can then use "private.companyname.com" as
    the zone name on my G5 server and use
    "server.private.companyname.com" for my local DNS?
    Sounds reasonable.
    If using this DNS, what will be the Kerberos REALM
    and Search Base? And do I still need to specify
    private.companyname.com as the Search Base in the
    Network Settings of the clients and server?
    Well, REALM and LDAP Search Base can set to whatever you like. On the other hand I've seen tools contacting kerberos servers break when the REALM is not part of the kerberos server fqdn.
    So I'd stick with the usual recomandations and set kerberos REALM to your domain name (if there is no other kerberos server alread running and using this).
    For the LDAP search domain I'd also follow the road of using domain name space as search base.
    When dns will finally be setup properly, these setting will be autopopulated for you in the GUI. So test, test, test you dns with
    host $ip and host $fqdn and then go on promoting "Standalone Server" to "Open Directory Master".
    HTH
    -Ralph

  • Configure Open Directory using CLI

    We have a Leopard Server in Advanced Mode.
    If you have a fresh install of Leopard Server with nothing configured, is there a way to configure Open Directory to be an Open Directory Master completely using CLI utilities?
    Wasn't able to find anything in Apple's PDFs

    I agree with Dal78 Apple using a base DN of servername.example.com rather than just example.com is illogical. In fact originally they did seem to use just example.com as the format but in recent years now use server.example.com as the format. When I first encountered this change it was still possible to overridge the use of servername.example.com and force it to use just example.com as the format. In more recent times I have decided to leave things the way Apple do it.
    I don't know if there is an official answer as to why, but a possible guess is that you can now have multiple Open Directory servers for a single domain. This is the 'Locales' option in Server.app. It maybe that including the servername makes it possible/easier to implement this.
    I also agree Strontium90 do not use a .local root domain for Open Directory. In theory there are hacks to (sort of) get this to work, but Apple engineers will typically run screaming for the woods when they encounter this.
    PS. Briefly Apple also did the same illogical thing with DNS zones, whereby the zone name for a domain was servername.example.com instead of example.com this at least they have stopped doing.

  • How to configure Open Directory base DN

    Hi,
    I have been using OpenLDAP on a Synology NAS drive, but this has some serious shortcomings with Mac clients (eg. roaming profiles simply doesn't work).
    So I have bought a MacMini which among other things will replace my existing LDAP server with Open Directory.
    As a dry run, I enabled the Open Directory and went through the simple set up and I had a basic system up in no time.  However I have come up against an annoying issue with the base DN used by Open Directory and I hope someone will be able to help me.
    My existing LDAP has a base DN that looks like this: dc=myorg, dc=local
    So when users log in, they can use a username which conforms to the following format: [email protected]
    The problem is that Open Directory likes to set the base DN to: dc=macservername, dc=myorg, dc=local
    meaning that a fully qualified user account name now becomes: [email protected]
    This seems bonkers to me.  For example, what would happen if I introduce a second Mac server into the mix and failover to it - the servername element of the DN becomes redundant or if it changes, I need to communicate with all users.
    I must be missing something obvious - but there doesn't seem to be much in the way of configuration that I can see through the Server application.
    So, my question is, how can I configure my base dn without the servername so that my existing username context remains the same?
    Many thanks - I look forward to any responses.

    I agree with Dal78 Apple using a base DN of servername.example.com rather than just example.com is illogical. In fact originally they did seem to use just example.com as the format but in recent years now use server.example.com as the format. When I first encountered this change it was still possible to overridge the use of servername.example.com and force it to use just example.com as the format. In more recent times I have decided to leave things the way Apple do it.
    I don't know if there is an official answer as to why, but a possible guess is that you can now have multiple Open Directory servers for a single domain. This is the 'Locales' option in Server.app. It maybe that including the servername makes it possible/easier to implement this.
    I also agree Strontium90 do not use a .local root domain for Open Directory. In theory there are hacks to (sort of) get this to work, but Apple engineers will typically run screaming for the woods when they encounter this.
    PS. Briefly Apple also did the same illogical thing with DNS zones, whereby the zone name for a domain was servername.example.com instead of example.com this at least they have stopped doing.

  • Open directory Server admin APP, crashes

    HI all.
    ON my 10.7.2 lion server for some reason my server admin app keeps crashing under the Open
    directory Section...
    Here are the screen shots..

    Also I cant make any changes under the Open Directory in server Admin...
    Everything is greyed OUT...

  • Can't create new open directory user

    hi.
    If I use the workgroupmanager to create a new user it automatically creates one with a "crypt" password.
    first it is shown as open directory, but then if I re-load, it says "crypt" password.
    If I try to change it to open directory the system tells me that I am not authorized to do so.
    it does not matter if I try the workgroupmanager locally or via my macbook remotely.
    if I create them via the server preferences it works fine.
    since I am a newbie here, maybe I am doing something wrong... ideas? please.
    thanks.
    martindavid

    Check out this tread, you are not alone but there doesn't seem to be a single solution...
    http://discussions.info.apple.com/thread.jspa?threadID=2262981
    I had this code and MY solution came from the fact that I had turned OFF DNS because I couldn't see that "I" was using it. turning it back on and ensuring that it was correctly configured solved it for me!

  • Public Domain Open Directory Help

    We are trying to bind network computers to our OS X Server (3.1.2) open directory and it works correctly when we type in server.local (it also automatically fills in server.local). However, we are looking to be able to bind computers when they aren't in the local network and use a full public domain. When we try to bind to the public domain, it gives us the error,
    "Connection failed to the directory server.
    (2100)"
    Any help would be appreciated.

    Many Open Directory problems can be resolved by taking the following steps. Test after each one, and back up all data before making any changes.
    1. The OD master must have a static IP address on the local network, not a dynamic address.
    2. You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.
    3. The primary DNS server used by the server must be 127.0.0.1 (that is, itself) unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.
    4. Follow these instructions to rebuild the Kerberos configuration on the master.
    5. If you use authenticated binding, check the validity of the master's certificate. The common name must match the hostname and domain name. Deselecting and then reselecting the certificate in Server.app has been reported to have an effect in some cases.
    6. Unbind and then rebind the clients in the Users & Groups preference pane. Use the fully-qualified domain name of the master.
    7. Reboot the master and the clients.
    8. Don't log in to the server with a network user's account.
    9. As a last resort, export all OD users. In the Open Directory pane of Server, delete the OD server. Then recreate it and import the users. Ensure that the UID's are in the 1001+ range.

  • Open Directory users prompted to change password after 10.8 to 10.9 server upgrade

    I just upgraded our 10.8.5 server to 10.9.3. I also upgraded Server.app to the most recent version (3.1.2). I made a complete backup first as a precaution.
    Existing non-admin users are being prompted to change their password when logging in. I've narrowed the problem down to a checkbox in the "Global Password Policy" settings in Server.app, specifically this checkbox: "Passwords must: be reset on first user login". I had that box checked in 10.8 so that new users would be prompted to create a password the first time they logged into a bound computer. It worked great and I'd like to continue using this feature in 10.9.
    If I uncheck this box in Server.app in 10.9.3, existing users can log in just fine with their existing passwords. If I re-check the box, non-admin users are suddenly prompted to change their password when logging in, even though they've logged in countless times in the past.
    Here are some things I've tried:
    * stopping and restarting the Open Directory service in Server.app
    * restarting the server
    * disabling and re-enabling an existing user account
    * inspecting user records in Directory Utility for any peculiar attributes
    * I used the mkpassdb -dump command to verify that the correct "last login time" is present for a particular user, but I'm not enough of an Open Directory expert to know if this is the attribute that the Global Password Policy relies on.
    Does anyone have any other ideas or suggestions?

    UPDATE: It looks like this issue applies to new (post-upgrade) accounts, too, suggesting that this has nothing to do with the upgrade process. Can anyone confirm this behavior? It's easy to test:
    1) Make sure the "Passwords must: be reset on first user login" box is unchecked.
    2) Create a new user in Open Directory.
    3) Log in once. No problem.
    4) Now check the "Passwords must: be reset on first user login" box.
    5) Try to log in again. Were you prompted to change your password? Logically, you shouldn't have been prompted, but users on my server are being prompted.

  • Changing the Name of an Open Directory Server while preserving users, etc.

    Hi Everyone,
    Not an emergency - but I have been wrestling with this dilemma for almost a year now.
    The good news is nothing has to be done right away. But I will ultimately need a solution.
    We have inherited a server system at a traditional elementary school from a previous IT person who was immature to say the least.
    When he set up the server system, he named the open directory server something that, while innocuous is inappropriate for a school setting.  I am sure he thought it was clever and cheeky at the time. But a few years later it is simply unprofessional. And we are being expected to ultimately be able to change it so something like "XXXdirectory.domainname.edu" The more it hangs around - the longer it looks like we did this and it makes us look unprofessional.
    So here is my dilemma. 
    This is an OD Master with iCal and network homes attached to it. It also runs DNS.
    I would like to set up a new server and name it "xxxdirectory.schooldomainname.edu"
    Setting up the new server is easy and getting all the client machines to bind to it - no problem.
    The problem is how to migrate all the users to the new server.  It seems a restore wont work because if the new server is named differently, the restore will fail. I also can't do a server migration because the stupid name migrates to the new server.
    My old server is 10.5.8 Server.  The new one is 10.7.1 Server . But could be 10.6.8 Server if need be. 
    The main problem is how do I get all the accounts onto a new server with a new OD master name?
    I don't mind command line stuff. So throw whatever you got at me.
    Thanks in advance for your help everyone.  Don't worry - I won't be a pain in the butt or argue.  I just need some good solid guidance, even if it is a "Not possible" answer - at least I have something to tell the administration when they want to know why we can't change the OD Master name from mcnugget.schoolname.edu.
    Please let me know if you need more details.  I am happy to provide.
    Thanks again.
    Tony

    If you don't mind resetting everybodies password then you can export the users and groups and wipe the server for a clean install or turn it into a standalone server then back into od master  then import the users and groups.

  • Sims 2 - Crashes when iMac part of an open directory domain

    Having a weird issue with running the The Sim 2 on my Kids machines.
    Some background, we have an Aluminum intel iMac and am intel Mac Min both running Leopard 10.5.6 which are connected to an old G4 DP800 running Leopard Server 10.5.6. When I installed the Sims 2 on the iMac or the Mac Mini it crashes almost immediately when you try to run it. Got onto Aspyr, went back and forward with them and they couldn't replicate the issues.
    Eventually I tried installing a fresh copy of Leopard 10.5.6 on an external USB drive and booting off that. It worked.
    Now for the fun part. Having been able to run the Sims 2 successfully from this vanilla usb install of 10.5.6, I then tried adding this back into the Open Directory domain, still running form the USB drive, all I did was add the machine back into the open directory domain, I didn't reboot, I didn't log out and back in again all I did was open directory utility, added the machine to the open directory domain and then re-ran The Sims 2, and you guessed it, it was crashing again.
    Just in case I did anything wrong, I repeated the whole process, and found this is repeatable, as soon as I the machine back into the open directory, then Sims 2 crashes.
    The attitude from Aspyr when I related all of this to then was that I had a "non standard" setup.
    It's a real pain having to keep a vanilla 10.5.6 install and having to re-boot each time to run this game, does anyone have any ideas or suggestions on this?
    TIA
    Dave

    So I finally got it to work.
    The Mavericks set up DNS assistant seems to add your local domain into the FQDN so you end up getting 'macsvr.domain.domain.com'
    I uninstalled server, removed the /Library/Server folder also Server.app and two files in /Library/Preferences. Serverd.plist and servermgrd.plist.
    I restarted server and let it do a first run, I set up my host name asking to set up DNS.
    I then went into DNS, deactivated it and edited the domain. I then added NS and machine records, reverse lookups and finally made sure the FQDN was in the correct zone. I repeated this for the intended replica and created my OD replica on first run.
    Check everything is good by using terminal, using the cmd: nslookup <ip address> for both master and replica, then: nslookup <FQDN> then: host <ip address>
    This should resolve both OD master and OD replica IP and hostname
    Hope this helps anyone else stuck on the set up. 

  • How to repair Open Directory Master after Changing Hostname

    Summary:
    How to repair Open Directory after Changing your Server's Hostname (see separate post)
    Problem:
    I had to change our server's hostname from a private hostname (server.name.private) to a public hostname (name.dyndns.org).
    Procedure:
    1. Precautions:
    Since I was anticipating major dramas I tested the change of hostname on a clone ( I used Super Duper, and I very strongly advise everybody to heed this warning because a change of hostname will corrupt your server services, in particular Open Directory)
    Second, I exported the network users from Server Admin and copied the archive to the Drop Folder of the server's local account (because the network accounts will be unavailable after demoting the OD Master.)
    2. Change hostname and demote OD Master
    a) I re-booted the server from the clone
    b) I changed the hostname in Server App and I noticed that the Open Directory Password and the Kerberos database were still stuck with the old hostname.
    c)  I then demoted to a standalone directory (Server Admin) and I tried to promote the server to an OD Master using the Server App (Manage Network Accounts). Server App always returned an error saying I should check my network settings.
    3. List of 'fixes'
    I tried the following fixes to no avail (which does not mean that you can skip them)
    a) I checked the DNS entries, forward and reverse were working fine (sudo checkip -changehostname)
    b) Checked with Lookup in Network Utility, all was fine
    c) I deleted all system certificates (Keychain) which showed the name of the previous hostname
    ( N.B. you need not delete email certificate and private/public keys)
    d) I tried to assign a new static IP in Networking Preferences (had no visible result)
    e) I re-booted from the working drive and I re-paired permissions on the clone; I ran disk repairs.
    Despite all this I could not re-create an OD Master.
    I then looked for this dubious folder /var/root/Library/Application Support/Certificate Authority.
    I could not find this folder when using the Finder's Go To Folder, nor did "Easy Find" see this folder.
    I was about to give up when I read the posts on this page and I entered the Terminal commands
    sudo rm -R /var/root/Library/Application\ Support/Certificate\ Authority/
    I had not much hope when I set about to re-create the OD Master from the Server App.
    But lo and behold !!! I did not trust my eyes when Server App claimed that the OD Master had been successfully created. And indeed, Server admin showed a running OD Master, LDAP, Kerberos and Password Server all running again !
    Final touch: re-import the user accounts.
    Epilogue:
    I woud not have been able to fix this issue had not so many others shared their experience and the working solution.
    (Refer : https://discussions.apple.com/thread/3219325?start=0&tstart=0 )
    Thank you all !
    Let's hope that Apple will fix this annoying issue in the next server update.
    Regards,
    Twistan

    Hi Rhyan,
    Please try clearing the security cache
    http://www.sharepointanalysthq.com/2014/05/active-directory-groups-and-sharepoint-security/
    https://sergeluca.wordpress.com/2013/07/06/sharepoint-2013-use-ag-groups-yes-butdont-forget-the-security-token-caching-logontokencacheexpirationwindow-and-windowstokenlifetime/
    http://webactivedirectory.com/active-directory/windows-active-directory-cached-user-credentials/
    Please remember to click 'Mark as Answer' on the answer if it helps you

  • When i integrate Mac client to the domain open directory, he don't ask me account DirAdmin, Why ?

    When i integrate Mac client to the domain open directory, he don't ask me account DirAdmin, Why ?
    I don't want all people can integrate mac client to the open directoy without authentification
    I want he ask me account diradmin for integrate client mac os x to the domain open directory of Lion Server
    I have made a magic triangle
    Thanks

    Malik-O wrote:
    When i integrate Mac client to the domain open directory, he don't ask me account DirAdmin, Why ?
    I don't want all people can integrate mac client to the open directoy without authentification
    1 ) I want he ask me account diradmin for integrate client mac os x to the domain open directory of Lion Server
    Authentication (with open directory admin username & password) is off by default. In Mountain Lion there is no longer a GUI to manage that and some of the other binding options. In Lion, I think you could use Server Admin (or was it Workgroup Manager) -- I can't remember, but there were little checkboxes.
    To make authentication mandatory in Mountain Lion, you can use this on the Server:
    sudo slapconfig -setmacosxodpolicy -binding required
    Use the following to check the binding policies:
    slapconfig -getmacosxodpolicy
    You might want to check the slapconfig man page, you'll find some of the other options that were in Server Admin in Lion, e.g. disable cleartext, block man-in-middle, etc.
    Edit, I just saw you're still using Lion Server, not Mountain Lion. I'm pretty sure the above commands will work on Lion Server as well.

Maybe you are looking for