Newbie - Setup Xserve with Mac Os X 10.6 for small group

Question

I already have infrastructure with DNS, DHCP, file storage etc.... I have a small group of users that will use Macs with OS 10.6 and a new Xserve. I only wnt them to autthenticte to OD on Xserve and thats it. And so I can see logs og their logins.. I will use Apple Remote Desktop but I guess will use it on another MaC not on server.
My background Novell Shop and MS mix, with Linux/Unix. I do Zenworks stuff.. So my question... Ho do I use the xserve only for OD authenticatin I ran through the install worksheet and setup my OD. And I have a MAC workstation im testing. I try to login on thta MAc to my OD server with an account I created on Xserve in Workgroup Manager. But when I login on MAC i see my full name then login window shakes and goes back to login window. I created another user account on server and created that account on MAC locally. I can login but I see no record on xserve password logs. When I login with network account that does not have local account on MAC and get the shaky window I see log on Xserver Password log and see authenticaiton.
On mac I setup to join the OD xserve and tahts it. What am I missing??

Answer 1

But I have another question. If there is a user locally on the MAC workstation and they try to login as th enewtork user, same shortname, it doesnt login with network password only local password. I set password on Network to that one on Local. they login but no hit to password service server log? We only want to use the server to Authenticate OD users and thats it. So can you have local user synch up to network? Or am i only stuck with network users and setting as you described?
This is the function of the Search Path. When binding to external domains, OS X will follow a search path defined in Directory Utility. However, DSLocal is always searched first, followed by BSD flat files, then external directories (AD, OD, LDAP, etc). DSLocal is ALWAYS first. This can not be changed. What this means is that if you have a user on the workstation named Bob Smith with a short name of bsmith and a password of letmein and a UID of 502 AND you create a user in the external directory named Bob Smith with a shortname of bsmith and password of hereiam and a UID of 1026, you will never reach the external directory during login. This is because the shortname bsmith will be hit in the DSLocal domain first as it is always the first directory encountered.
The way around this for systems that you are migrating is to delete the user's account plist and the chown the entire home folder. Now, this assumes that a local admin exists at account 501 already. If this is the case, then the bmsith account attributes (/var/db/dslocal/nodes/Default/users/bsmith.plist) file can be removed from the machine, effectively "deleting" the account without altering the user's data (/Users/bsmith). Then, if the machine is bound to the domain, all that is required in a chown of the /Users/bsmith folder so the UID value of the external directory account is set (1026).
And again, there seems to be some confusion about OS X and home folder types. Apple supports a lot. They are:
Local account with local home: This is the most common. Take machine out of box and create account. For IT, the local initial admin is this type of account. The user exists in the local domain and the home folder is in /Users.
Mobile (domain) account with cached attributes with local home: This requires are directory domain like AD or OD. For the AD plugin, this is default behavior. For OD it is very common. The machine is bound to a domain and on initial login, the user's account attributes are cached to the machine for offline use. This will create a "permanent" account in System Prefs and the user can use his or her domain credentials when offline. As an added feature using MCX, you can add home folder sync on top of this style.
Mobile (domain) account without cached attributes and network home: This is common in schools and training rooms. The workstations are always on the network so there is no need to cache the account nor do you want to litter the machines with local homes. A net home server is established and then users can freely move from machine to machine. On login, an automount share must be available to the workstation and the user uses domain credentials to access the network home. All data is stored in the central network location allowing for ultimate mobility of user.
Now there are also external homes (homes on external drives), guest accounts and more. But the three above are the most common.
Hope this helps all following the thread.