Help With Binding to 10.6.8 Server

Question

I am new to server and was hoping someone could help me with the following issue:
My Company has about 50 Macs (mostly 10.7) right now.  We have a 10.6.8 server that is running Open Directory as a OD Master.  Right now, they only authenticate to the server for AFP share access.  Every user here has a Workgroup account which is used for AFP only.  The machines are not bound to the server.  What I would like to do is bind the machines to the server and have the users authenticate to there already created user accounts.  I want to keep their home directories local and just have them authenticate to the server (using their already setup accounts used for AFP)  This would be for password management and manging preferences as well.  I was able to bind a test machine succesfully to the server but was unable to have it login/authenticate to the server using an already created server account from Workgroup Manager.  Any advice that would help me transition this would be greatly apprecaited.  What are my next steps for making this happen?   Thanks! 

Answer 1

This you will need to move or reset permissions for the user.  Here is the issue.
You have a local account, mboker on a machine.  This account is stored in dslocal and likely has a UID value of 502, as it was the second account created.  (This all assumes that your local admin account was the first one created and is UID 501).
mboker has a home folder located at /Users/mboker.  And this folder is owned by mboker, but the mboker from the local domain with a UID of 502.  This means that the first are owned by UID 502.
Ah, so now the wrinkle.  You have created a user named mboker on the server.  This user has a UID of 1027 (as an example), has a shortname of mboker and is defined as a mobile account who should have a local home folder called /Users/mboker
So now the problem.  When mboker (1027) logs into the machine, he paths into /Users/mboker owned by 502.  And thus you have no permissions to do anything.
Aha!  This is an easy fix.  So first, you need to make the machine forget about UID 502.  Now, the obvious way to do this is to use System Preferences >  Accounts and remove the local user.  But, you get a sheet that asked you how to handle the home folder data (DO NOT DELETE IT).  Now if you choose to keep the data, it renames the folder from /Users/mboker to /Users/mboker (Deleted User) - or something similar.  If you go this route you then need to change the name and reset permissions.  So I tend to do a shortcut.
By the way, if you are a novice at command line, make sure you have a backup of the user data.  While this is quick and efficient, if you make a mistake, there is no undo...
1:  Log in as the local admin
2:  Open Terminal
3:  Become root with
     sudo -s
4:  Navigate to the local attributes store by using:
     cd /var/db/dslocal/nodes/Default/users/
5:  Look at what is in this folder with:
     ls -l
6:  Near the bottom of the list you should see a file titled mboker.plist.  This is your account attributes file.  Likely this file is for the local account (user UID 502).  Remove this file from the directory system
     mv mboker.plist /Users/Shared/
moved it in there just in case... You can delete it later once you understand the process
7:  Restart directory services or just restart the computer.
8:  At login window, login as the local admin
9:  Reset ownership on the home folder by using this command
     sudo chown -R mboker /Users/mboker
Now, if you investigate before this step and looked at the mboker home folder, you will notice that it is owned by 502, not a user name.  That is because we made the machine forget about the local 502 user so it has no name to associate with the account.
10:  Log out of the admin account and log into the mobile account using Other initially.