Creating User Acct's in Open Directory from External Source

Question

Hello,
I am trying to find a way to automate the creation of user accounts in OpenDirectory. I have a MS SQL database that has the usernames and passwords in it now, and I'm looking to export those out of there and have an automatic way to create matching accounts in the OpenDirectory service on OSX Server.
Gary

Answer 1

It's unfortunate that there's no better way to do this. We're using ssh with a pre-shared key to our Open Directory server to run a script which runs dsimport to create the accounts on the Open Directory.
This works fine for importing/creating accounts, but it doesn't help us change passwords that we are pushing down to Open Directory from our metadirectory solution.
Here's the python we use to generate the dsimport entries:
dsimport_base = '0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 11 dsAttrTypeStandard:RecordName dsAttrTypeStandard:GeneratedUID dsAttrTypeStandard:AuthMethod dsAttrTypeStandard:Password dsAttrTypeStandard:UniqueID dsAttrTypeStan\
dard:PrimaryGroupID dsAttrTypeStandard:RealName dsAttrTypeStandard:UserShell dsAttrTypeStandard:HomeDirectory dsAttrTypeStandard:EMailAddress dsAttrTypeNative:postOfficeBox'
dsimport_entry = '%s:%s:dsAuthMethodStandard\\:dsAuthClearText:%s:%s:%s:%s:%s:%s:%s:Ganymede managed [%s]'
params = (obj.Username,
obj.Global_UID,
obj.Password.plaintext,
obj.UID,
self.getPrimaryGID(obj),
obj.Full_Name,
obj.Login_Shell,
'/Users/' + obj.Username,
obj.Username + '@arlut.utexas.edu',
obj._oid)
new_entry = dsimport_base + '\n' + dsimport_entry % tuple([str(value).replace(':', '\\:') for value in params]) + '\n' # not handling signature aliases yet
and here's the Perl that is run on the far end of the ssh pipeline which
reads the list of 'new_entry' lines generated by our Python:
#!/usr/bin/perl
# This script receives files on STDIN and runs dsimport on them.
# Jonathan Abbey
# 22 October 2009
use File::Temp qw/ tempfile tempdir /;
$adminuser = 'diradmin';
$adminpass = 'seekret';
($fh, $filename) = tempfile();
@users = ();
while () {
if (/^([^0][^:]+):/) {
push(@users, $1);
print $_;
print $fh $_;
close($fh);
system('/usr/bin/dsimport', '-g', $filename, '/LDAPv3/127.0.0.1', 'O', '-u', $adminuser, '-p', $adminpass, '-v');
unlink($filename);
foreach $user (@users) {
system('/usr/bin/pwpolicy', '-a', $adminuser, '-p', $adminpass, '-u', $user, '-setpolicy', 'canModifyPasswordforSelf=0');
We've been trying to use kadmin to change passwords, but it seems flaky, with occasional 'policy reject' complaints breaking the sync.