ICal server with alternate LDAP

Question

Hi,
In the (very, very brief) documentation for iCal Server, it says:
To run iCal service, you need:
User names and passwords stored in a Mac OS X version 10.5 Open Directory system,
an Active Directory system (using the Active Directory plug-in for Mac OS X version
10.5 Open Directory), or an OpenLDAP directory with schema to support iCal service
Now, this sounds great. However, everywhere I look it says no, you need to have Open Directory, and not only that, but you have to have Open Directory on a Leopard Server.
What is the deal with this? We have an OD on a 10.4 server. That server is not getting upgraded - it is just not going to happen. My network administrator is ripping his hair out for days now trying to get LDAP data migrated to the 10.5 server with absolutely no success - most users do not transfer over directly, and doing the "export from Workgroup Manager" method completely destroys our users' records (attributes dropped, all inactive users become active!) It's a disaster!
If this thing supports any LDAP server with the right schema, why can't we just get an idea of what that schema would be and add it to our 10.4 Open Directory? OpenLDAP is OpenLDAP isn't it? I really understand what the issue is here, but either the documentation is flat out lying or there's some secret that no one's decided to actually write down yet. Which is it?

Answer 1

Well, schema modifications were exactly what I had in mind. I went of instructions in the ical source and that seemed to go pretty well - I can now start iCal services and get a clean log file out of it. I'm not saying it's working 100% yet (can grant users access to create calendars but they get an error "No Calendar Home Error" when they do - in the logs it seems to complain about not authenticating properly). I'm still pretty confident this can be done, it just seems that any of the automatic tools in Server Admin are pretty much worthless to us - so we have to learn how to emulate what it would be doing were it functional. We've even managed to get the wiki server up and running to - again, it just takes some patience to get things moving right. Once we do have a complete setup, I'll post the instructions somewhere. I'm sorry, but It's crap that this can't work - they just choose not to tell us how or provide any relevant patches. Upgrading an LDAP schema is not impossible. Used to have to do it once in a while back in the day before there was anything like Active Directory.
We would gladly just move the directory to 10.5 but it just does not seem to be possible without redoing all the information manually - as you have suggested. Now, that would be all well and good if we were a tiny little workgroup but we're talking about a whole company with hundreds of users here. It would be a major support nightmare for them all to lose their passwords or worse, for 2/3 of the accounts to disappear, which is the scenario with any of the automatic migration methods. Manual entry is technically possible but it would take quite a long time and it would also require reconfiguring many computers which aren't located anywhere near us anymore. The transportation and overtime costs alone are staggering. This is not the ease of use that Apple so heavily promotes for themselves. Upgrading the server to 10.5 would most surely knock out a lot of custom services that are running on the 10.4 server (things like ruby on rails that were set up manually - and are tied into so many other things that would take months to get tested and moved).
Really, I just think Apple needs to step up here and make their products interoperate better. How can it be so impossible to move users from an older server *of their making* to a newer one - they didn't consider this at all while developing the new version, that people may want to ... you know, expand to multiple servers? They didn't even consider that people might have an old, but perfectly functional, 10.4 server that they might want to keep around? It just doesn't make sense to me. Sadly, I feel in the Windows world this would have gone a lot better - I don't remember having nearly as many issues interoperating with Windows NT and Windows 2000 servers - at least, not with transferring accounts. Also, upgrading and migrating Tiger clients to Leopard is not nearly so impossible - in fact, it's remarkably simple. Granted the level of complexity is far greater, but I should think they'd be able to handle it - otherwise I think we should investigate more stable and long-term oriented server architechtures.