I've Done it! Whoop!

Question

Hey everyone,
I've been having a little battle with integrating OD and AD and spent much time reading through pdf's, looking through afp584.com and of course these lovely forums. Finally I have done it and would like to share with you all just incase you are in the dark as I once was and found it difficult to get started.
Just to set the scene as it were, I am using this setup in a college environment where students will use both Mac and Windows client machines to access their work anywhere in the building so they are using mobile home directories. The AD server is for controlling the Windows workstations through Group Policy and handling user management and authentication. The OD Server (an xServe) is for storing home folder directories and providing Time Machine backups for staff laptops (as all staff use apple laptops) since they are much quicker, run a better file system an oh did I mention, THEY ROCK!
(Can you tell I'm a reformed Windows Admin?)
This is my rough step by step guide to setting the whole thing up:
1. Setup your AD server, (mine is a win2k3 AD domain called mydomain.private. It was originally mydomain.local but this caused some difficulties with OS X so I had to delete my domain and start again!)
2. I created 2 test users (I am using this in a college environment so one test student (we will call student!) and a test teacher (we will call teacher!)). I then created 2 groups students and teachers and added them to each group!
3. I then set up my xServe running OS X Server 10.5.1 (upgrade to 10.5.4, this has helped no end!). I set the server up in advanced mode. I then went to Server Admin and gave my xServe the following services:
AFP - Gives the apple clients access to their home directories
SMB - Gives the windows clients access to their home directories
Open Directory - Handles authentication through Kerberos-SSO to authorize users to access their home folders
4. I made the xServe a stand alone OD server. Then used Directory Utility to bind it to the AD server (/Applications/Utilities/Directory Utility.app).
5. I then went back to Server Admin and to the Open Directory settings, and joined it to he Kerberos Realm. Click the "Join Realm" button, choose your domain from the drop down list "mydomain.private" and authenticate as a local admin. However, no confirmation was given to say I had joined the realm the dialogue box just disappeared?
run this command in the terminal:
sudo klist -ke
and see your server listed three times per service it is providing, it will look like something like this:
afpserver/[email protected] (ArfFour with HMAC/md5)
afpserver/[email protected] (DES cbc mode with CRC-32)
afpserver/[email protected] (DES cbc mode with RSA-MD5)
Also I ran another terminal command to confirm the kerberos-sso integration was working to make sure user details were being passed from the AD server to the OD server to authenticate users to use their home folders:
dsconfigad -enable sso
That may need a "sudo" first? Now you are “Kerberised' between the OD and AD server you can promote your stand alone OD server to an OD Master! Wu-hay! Here you will have to make a Directory Administrator user (usually diradmin short name) which is separate to your Local Administrator account.
6. Next I went into Workgroup Manager (authenticate as local admin) and connected to the local directory system, /LDAPv3/127.0.0.1 (now authenticate as diradmin). If the local LDAP directory isn't already in the list of available directories as mine wasn't, just click the globe icon and select other from the drop down list, then in the pop-up window chose LDAPv3 > 127.0.0.1 and click OK. Use the padlock on the right hand side of the workgroup manager to authenticate.
Once authenticated and working on the correct directory system (the local LDAP directory), I created two groups, "student imports" and "teacher imports" and guess what? When I went to add members, I selected the "/Active Directory/All Domains/" directory system, and added my user "student" to the "student imports" group and the other user "teacher" to the "teacher imports" group!
7. Now go back to Server Admin, select the SMB option and go to the settings tab at the top. My server is set as a "Domain Member" and all the fields have been auto populated with the computer name, domain name and realm so we can see everything is coming together. I wont talk about the security settings those are different for everyone, you may want gust access you may not? You may want to turn off NTLM and Lan Manager and keep just NTML 2 & Kerberos on if you are using Windows XP and above workstations; or not if you have Windows 98/2000 work stations? Again this is the same for the AFP service. I have guest access turned off, and authentication set to Kerberos only because its nice and secure and most importantly, cross-platform! If at this point in time you don't know anything about kerberos drop me a line and I will send you an excellent little 10 minute movie which explains what it is and how it works.
8. Share Points! Here we go!
Under Server Admin, select your server in the left hand pane, and choose File Sharing from the top. Again I don't want to go into what Share Points are and how to set them up, that is fairly easy and well documented. So, I created two share points, you guessed it:
Students
Teachers
These are both sharing over smb and afp so teachers and students can logon to either a Mac or Windows client to get their work. POSIX permissions are:
Local Admin Read & Write < Owner
Student Imports Read & Write < Group
Others None <Other
This handles things for the Mac clients just fine. Just add one ACL for "Student Imports" for the windows clients (mine is set to “Full Control” for testing purposes then I slowly step it down as I get things set up). This is all the same for the teachers also just using the Teacher Imports group instead. Since these are home folder mounts "Enable Automount" has to be enabled. Also with the protocol options that's up to you, I have turned off all guest access, and only have afp and smb sharing turned on.
Now all you need to do is bind a test Mac and Windows machine to the domain to test your setup. With the windows machine its dead simple, just bind to the AD server and authenticate as an AD Admin account or any account that has "Domain Joining" privileges. With the Mac client, use Directory Utility to bind your Mac to the AD SERVER FIRST!!! Then the OD second. The order is important here. Read "Leveraging Active Directory on MAC OS X", it's a pdf document. As I write this the current version is 2.0, its great! It also has a generous amount of links and references to other resources at the end so after reading it and everything it references you can't go wrong! I had a previous version, 1.1 I think, which I lost, and I think it was written by Bombich? So I don't know who did version 2.0 it doesn't say but well worth a read!
Test logging in as student from you mac, save something to the home folder. Then log in as the student user on the windows machine check your mapped network drive (H:) and make sure the saved something is there, edit it for example if it were a text document. And make another. Log back in on the mac again. Make sure the file changes have been saved and you can see them, and you can see and edit the new file. This will confirm there aren't any cross-platform and share point permission issues.
N.B. I have used workgroup manager to set users home directories on the xServe. Open WGM and authenticate to the AD Directory. Select your user and set their home folder to the appropriate share point, an example would be:
smb://myXserve.mydoamin.private/students/student
Under active directory this will show up in the user account as a mapped network drive (assigned the letter H: by default). I have used group policy management console to make "My Documents" a shortcut/redirect to the users H: drive when they log on!
When things start going wrong, fire up the Console app on the OS X server, Console is your friend! I can not lie, it can only point you in the right direction by showing what's wrong! Also these forums are great and just google google google!
I hope this has helped some how. Feel free to ask about something I have written, I will answer the best I can but I am new to Mac Administration. I only have one other server that is a 10.4.11 server running as a OD Master on its own.
Search the forums, google everything, check afp548.com, bombich.com etc. Get all the apple server administration pdfs. The information for this is out there, its just scattered around and needs piecing together for your particular requirements.
Thanks to everyone that help me, I can't mention you all, it was over many 'a forum post to which many people have replied. If you have ever replied to a post I have started, thanks!
r00tb00t

Answer 1

You could have used it as an overlay and just need to map out the colors for the three states
http://dvdstepbystep.com/newmap.php
Or layers (not as reliable)
http://dvdstepbystep.com/layersover.php