One Open Directory server for multiple businesses?

Hi all,
Is it possible to have one Mac OS X server seen by client computers through different domain names?
See, I have one server now, with name:
server01.it.lan
As we are managing three different companies, I'd like the users working for one particular company to see the server with that company's name:
server01.bizA.lan
or
server01.bizB.lan
...and so on.
And I'd want whatever service used by that user to have a path or address that refers to that name, even though it will point to the same server in the end...
After some reading, I have different avenues available which would each require quite some reading. So I'm turning to you to narrow the field of researches.
1. First of all, is this possible? I mean, not-too-complicated possible?
2. Where would you recommend I spend time learning?
- DNS aliases? AFP seems to go back to the primary name when I use an alias in Directory Access... (shows server01.it.lan/share instead of server01.bizA.lan/share)
- Network configuration duplicates, to have more than one IP address pointing to the same machine?
- Other ideas? I don't need/want a full walkthrough. Actually, I'd prefer to just have simple hints to direct my researches...
Thanks,
Fred

Hi Leandro,
For your requirement this document describes the TREX installation -
[TREX with Multiple Instances|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/78df2a46-0a01-0010-ef81-a6be60cc5cfd]
Hope this helps,
Reward points if helpful
Regards,
Shailesh Nagar

Similar Messages

Using Linux/Red Hat/Intel for Sun ONE/Java Directory Server

Anybody have any experience of this? We're looking to get off AIX, and Total Cost of Ownership for using Solaris/Sparc versus Linux/Intel is very similar.
The decider will be if no-one is using Linux as a platform for Sun ONE/Java Directory Server....
Any feedback would be appreciated....

We run Directory 5.1 in production on Solaris/Sparc, but I've tried it with sucess on Red Hat 7.2 on Intel. We have not been able to get it to work on Red Hat Enterprise 2.1 or 3.0. The main problem has been that the administration server fails on startup. Obvious the lack of support for the latest enterprise class Linux is a huge drawback. At this point I've decided to stay on Solaris/Sparc until Red Hat comes out with its own release of Netscape's Directory. When that happens we're going to evaluate whether to move the whole environment to Red Hat. The Sun and Netscape servers are almost identical in terms of features and performance, but having an open source version that can run on less expensive hardware would be a terrific win for us.

10.3.9 clients not working with 10.4.9 open directory server

I have a 10.4.9 server running open directory and managing about 20 10.4.9 clients. I am trying to have it manage our remaining 10.3.9 clients, but for whatever reason, I cannot seem to get the 10.3 clients to "attach" to the server.
I have the 10.3 clients set up in a computer list on the server, and in directory access I have it set to "get ldap mappings from server". At one point, it was suggested to me that I have the clients "get ldap mappings from open directory server". I tried this, and manually set the search base suffix. My search base suffix was "dc=example,dc=local". I even tried doing "cn=config,dc=example,dc=local" (where in both cases example.local was replaced with my real DNS name). Any suggestions on what else I could try to get this to work?

That's the odd thing though. I've done this with 10.4 no problem. Settings always worked. For some reason though, even though the clients are able to login using a network user, none of the preference settings sync.
For example - I always put a loginwindow message on as a sort of "test" to see if preferences are being set. If that works, then I rarely have a problem. No matter what I do, though, I cannot get the loginwindow message to display on the 10.3 clients. It works really well on 10.4, but not at all on 10.3. I've tried this on multiple 10.3 machines, as well, (and they're both based on different system images) but it still doesn't work. When I get back to work on Friday, I'll have to see if preferences will work for network users; that's the one thing I haven't tried.
Other than dumping the directoryaccess preferences, is there another preference setting that could be dumped on the client that may make it grab prefs from the server?

Changing the Name of an Open Directory Server while preserving users, etc.

Hi Everyone,
Not an emergency - but I have been wrestling with this dilemma for almost a year now.
The good news is nothing has to be done right away. But I will ultimately need a solution.
We have inherited a server system at a traditional elementary school from a previous IT person who was immature to say the least.
When he set up the server system, he named the open directory server something that, while innocuous is inappropriate for a school setting. I am sure he thought it was clever and cheeky at the time. But a few years later it is simply unprofessional. And we are being expected to ultimately be able to change it so something like "XXXdirectory.domainname.edu" The more it hangs around - the longer it looks like we did this and it makes us look unprofessional.
So here is my dilemma.
This is an OD Master with iCal and network homes attached to it. It also runs DNS.
I would like to set up a new server and name it "xxxdirectory.schooldomainname.edu"
Setting up the new server is easy and getting all the client machines to bind to it - no problem.
The problem is how to migrate all the users to the new server. It seems a restore wont work because if the new server is named differently, the restore will fail. I also can't do a server migration because the stupid name migrates to the new server.
My old server is 10.5.8 Server. The new one is 10.7.1 Server . But could be 10.6.8 Server if need be.
The main problem is how do I get all the accounts onto a new server with a new OD master name?
I don't mind command line stuff. So throw whatever you got at me.
Thanks in advance for your help everyone. Don't worry - I won't be a pain in the butt or argue. I just need some good solid guidance, even if it is a "Not possible" answer - at least I have something to tell the administration when they want to know why we can't change the OD Master name from mcnugget.schoolname.edu.
Please let me know if you need more details. I am happy to provide.
Thanks again.
Tony

If you don't mind resetting everybodies password then you can export the users and groups and wipe the server for a clean install or turn it into a standalone server then back into od master then import the users and groups.

Open directory server crashing every 30 days / clients unable to connect to calendar, contacts server

Hello everyone,
I am running an up to date Mavericks Server which serves exclusively as a calendar and contacts server for about two dozens devices. The server is reachable via DynDNS, however, the public IP hardly ever changes (only once or twice a year maybe). Tried setting the OS X DNS Server to serve "all clients" and "some clients".
For about 6 months (i.e. also under Mountain Lion), I am having a very strange problem. Roughly every 20-30 days, clients will not be able to connect to the server, instead getting a "wrong password" dialog. Restarting the open directory server will help for the next 30 days.
I have tried repairing the database as detailed here, however, the issue persists.
Any help would be highly appreciated!
I would have tried setting up a clean server installation, migrating calendars/contacts manually and re-adding all users by hand, however, I am not aware of an easy way to do so. The terminal command for calendar backup is broken under mavericks (might work with this workaround) and re-adding users manually would apparently involve correcting user UUIDs afterwards in order to match the migrated calendar data. Do you know of a better approach?
Thanks a lot!
DPSG-Scout

Hi Linc,
This looks the most relevant to me:
opendirectory.log
2014-03-11 11:13:09.460675 CET - 333.2628758.2628759 - Client: Python, UID: 93, EUID: 93, GID: 93, EGID: 93
2014-03-11 11:13:09.460675 CET - 333.2628758.2628759, Node: /Local/Default, Module: PlistFile - predicates with 'AND' are not supported
2014-03-11 12:09:00.296514 CET - State information (some requests have been active for extended period):
          Sessions: {
              28 -- opendirectoryd:
                          Session ID: 7BFBA6FE-A968-4399-A129-E3A5945E2A81
                          Refs: singleton
                          Type: Default
                          Target: localhost
          Nodes: {
              43 -- authd:
                          Node ID: 6D0E236D-6DBD-4E8C-BC01-B3F50C2C2D8E
                          Nodename: /LDAPv3/127.0.0.1
                          Session ID: <Default>
                          Refs: 1
                          Internal Use: X
an many more similar ones…
Thanks for your effort!

Application launches fail after wake up from sleep when switching from one open directory to another

I take my MacBook Pro back and forth from home to work. Open Directory is set up at both locations running on Snow Leopard server. These two locations are entirely separate domains and IP networks. The only thing that is the same is my username and password, which is the same in both locations.
If I put my machine to sleep in one location and move to the other location and wake it up, I can usually launch one application, then no other applications launch and the machine is pretty much frozen up except for mouse cursor movement. Using command-shift-escape and relaunching the finder doesn't help.
It is as if the launch daemon has been made inoperative. Apps just sit and bounce.
Should one be able to log in one one network with open directory. Close all applications, move to an entirely different network, and wake up from sleep and continue working? The login/password is identical on both open directory setups.
Both home and work are set up so the users can "travel" and the machines are not "bound" to the open directory server.
I've started using the "other" login box to login in which I think keeps the machine more independent of open directory and that seems to work better for moving between networks.
Any ideas and/or comment welcome.
(my DNS seems fine in both environments. running changeip gets "success" in both places)

After reading another post that popped up under "More Like This" after I posted this I may have found at least a temporary fix. Unplugging and reseating the MDP adapter in the MacPro didn't accomplish anything but unplugging/reseating the HDMI plug in the Viewsonic brought it back to life.
I guess I can live with this but it would be nice knowing that there's a more permanent fix for this.

Ubuntu Karmic authentication against Snow leopard open directory server

Hi,
I'm looking for help. I've tried to configure an installation of Karmic to authenticate against our office's open directory server running on an osx snow leopard server. Currently `getent password` show all users including those from the open directory server when running the command as both root and normal users. However authentication against the open directry users fails with the following messages in the /var/log/auth.log:-
Dec 7 22:42:05 [hostname] getent: nss_ldap: failed to bind to LDAP server ldap://server.domain.com: Invalid credentials
Dec 7 22:42:05 [hostname] getent: nss_ldap: could not search LDAP server - Server is unavailable
(I've changed the hostname and ldap url)
/etc/ldap.conf has:-
base dc=server,dc=domain,dc=com
ldap_version 3
rootbinddn cn=diradmin,dc=server,dc=domain,dc=com
bind_policy soft
pam_password md5
/etc/ldap.secret is set to the password of the diradmin user and has a permission mask of 600
/etc/pam.d/common-passwd :-
password sufficient pam_ldap.so md5
password required pam_unix.so nullok obscure md5
password optional pam_smbpass.so nullok use_authtok tryfirstpass missingok
/etc/pam.d/common-auth:-
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so usefirstpass
auth requisite pam_deny.so
auth required pam_permit.so
/etc/pam.d/common-account:-
account [success=2 newauthtokreqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so
/etc/pam.d/common-session
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
session optional pamckconnector.so nox11
Does anyone have any ideas where to go from here?
Message was edited by: zebardy

Hi
It's easy enough to 'connect' any version of OS X Server to any other version of OS X Server. Use the Join button in the Users & Groups Preferences Pane. Alternatively use the Directory Utility itself.
You seem to be misunderstanding what an Open Directory Master and Replica are? They are not what I think you think they are. They are not a 'back-up' of each other if you're providing more than the shared Directory Service.
An OD Replica maintains a read-only copy of the LDAP Database (Usernames, Passwords and Policies etc) that's stored on the OD Master and nothing more. If the Master was to go offline for any reason the Replica can be quickly promoted to a Master Role and continue to provide information for the shared directory. This assumes it has easy and quick access to the Volume storing networked home folders? The LDAP Database in that case would then become writable. Later on and whenever you've fixed the problem with the old Master it can quickly be demoted and made a Replica of the now new Master.
Although this is for 10.6 Server (it is nevertheless still applicable) everything you need to know about Master and Replica relationships is here:
http://manuals.info.apple.com/en_US/OpenDirAdmin_v10.6.pdf
Page 55 onwards.
From Page 64:
"The Open Directory master and its replicas must use the same version of Mac OS X Server. . ."
If your OD Master is also providing Mail, Calendar and Contact Services then none of these will be replicated. You will have to maintain a backup of these databases yourself using whatever method you deem fit for your needs.
HTH?
Tony

Wrong UID from open directory server

I have a problem with a mac OSX server
I have an open directory server A, that shares all users to every other server i have.
I then have 2 mac OSX servers B and C, that it set up to allow network users. I can easily login with a open directory user, on both servers, but I have a problem. on server B it says the users user id is 1050, which is correct. On server C it says that the same users user id is 1000, which is wrong. Both server set ups are identical, as far as I know. On the Open Directory server A the users id for the user is also 1050, in case that is relevant.
I have checked if server C has a local user with the same name, but htat is not the case.
Any idea what might have caused this problem?

bump

Open Directory server on two Private IP addresses - acting slow

We have an OS X Open Directory server that has two non-routable IP addresses.
Primary - 10.0.0.x (LAN) with 10.0.0.x gateway
Secondary - 172.16.0.x (SAN) with no gateway
When it is plugged in to both networks, Server Admin responds very slowly. If the server is just on the primary interface, Server Admin responds normally.
We also have a replica that is on the two private networks.
Primary - 10.0.0.x (LAN) with 10.0.0.x gateway
Secondary - 172.16.0.x (SAN) with no gateway
When we launch Server Admin on the replica, Server Admin says there's no server found at this address, even when it is looking for server.local, as opposed to server.domain.com.
Again, if you put this server on the primary 10. network, it works fine.
What's going on?

For anyone else interested, I eventually decided that a fully-qualified domain name seems to be necessary for some services, and that OS X Server doesn't seem to know exactly when that is the cause of problems, and the documentation doesn't really specify exactly what it is necessary for. So I had my organization set up a FQDN for the server, even though it's only meant to be used internally, and that seems to fix things.
Greg

How to promote my OSX10.6.8 replica server to Open Directory server

My Open Directory Server crash and i would like to promote my replica Server to Open Directory. can you tell me how to do this.

Hello Dave,
Check out the steps quoted below to promote your replica to the Open Directory master.
Provide Open Directory service
https://help.apple.com/advancedserveradmin/mac/3.1/#apdD1F7D8CA-CF07-40CE-B2D4-8 E3ACF4BCA40
Promote a replica to Open Directory master
If an Open Directory master fails and you can’t recover it from a backup, you can promote a replica to be a master. The new master (promoted replica) uses the directory and authentication databases of the replica.
Select Open Directory in the sidebar.
Click Servers.
Select a replica to promote, then choose Promote Replica to Master from the Action pop-up menu (looks like a gear).
Enter the directory administrator name and password.
If you archived Open Directory data with certificate authority keys, you can restore them by entering the Open Directory archive location or clicking choose to locate the archive.
Click Next.
Enter the user name and password for the replica that’s being promoted, then click Connect.
Regards,
-Norm G.

Is Open Directory required for Webmail??

Anyone know if I need to enable Open Directory (Tiger Server) in order to use webmail successfully? Currently I am trying to get it going with all users on the local directory but it's not working. Thanks for any help. Rob

Hi
Is Open Directory required for WebMail?
No.
The Web Service needs to be enabled. For that to work effectively DNS needs to be configured and running. Its not absolutely necessary but its better if it is. Obviously the Mail Service needs to be running as well as users having Mail enabled for them in WorkGroup Manager. Obviously you need to enable IMAP for desired users. Either POP and IMAP or IMAP only.
In the Web Service enable the WebMail option. Server Admin > Web > Settings > Sites. You need to enable the WebDAV Module as well. Its in the Modules section. That should be it.
If you want external access open port 16080 and allow public/external requests to the private/internal IP address of your mail server. Create an appropriate firewall rule if your router requires it.
Tony

Three new groups in Open Directory Server

I noticed that my Open Directory server has three new groups in WGM,OD Users, OD Administators and com.apple.limited_admin. Should I treat these as I treated the other groups by assigning them members and group folders? I also noticed that now I have a System Administrator and a Directory Adminstrator, does that sound right? Should I keep both? Thanks

Ok, thanks, I had forgoten the "show system records" trick.
For the guest user, I don't see it in dscl.
So I suppose it's not a user, just an "anonymous" authentication option in the sharing preferences.
It's a bit like "others" in the posix rights permissions : User, group, other. User and group are existing and named, other are not named, it's just anybody that is not the named user and not a member of the named group.
To keep things understandable, you should use an other name if you wish to configure a "guest user"
You can manage the "enable guest account" option from WGM if you select a computergroup, in the preferences pane / login / options.
Hope it helps
Nicolas

Generating Self Signed Certificate for iPlanet Directory Server for testing

Hi Experts,
I am unable to find how to generate self signed certificate for iPlanet Directory Server for testing purpose. Actually what i mean is i want to connect to the iPlanet LDAP Server with LDAPS:// rather than LDAP:// for Secured LDAP Authentication. For this purpose How to create a Dummy Certificate to enable iPlanet Directory Server SSL. I searched in google but no help. Please provide me the solution how to test it.
Thanks in Advance,
Kalyan

Here's one I did earlier.
Refers to Solaris 10
SSL Security
add a new certificate that lasts for ten years (120 months).
stop the instance:
dsadm stop <instance>
Remove DS from smf control:
dsadm disable-service <instance>
Change Certificate Database Password:
dsadm set-flags <instance> cert-pwd-prompt=on
     Choose the new certificate database password:
     Confirm the new certificate database password:
Certificate database password successfully updated.
Restart the instance from the dscc:
DSCC -> start <instance>
Now add a new Certificate which lasts for ten years (120 months; -v 120):
`cd <instance_path>`
`certutil -S -d . -P slapd- -s "CN=<FQDN_server_name>" �n testcert �v 120 -t T,, -x`
     Enter Password or Pin for "NSS Certificate DB":
Stop the Instance.
On the DSCC Security -> Certificates tab:
     select option to "Do not Prompt for Password"
Restart the instance.
On the Security -> General tab, select the new certificate to use for ssl encryption
Restart the instance
Stop the instance
Put DS back into smf control:
dsadm enable-service <instance>
Check the smf:
svcs -a | grep ds
# svcs -a|grep ds
disabled Aug_16 svc:/application/sun/ds:default
online Aug_16 svc:/application/sun/ds:ds--var-opt-SUNWdsee-dscc6-dcc-ads
online 17:04:28 svc:/application/sun/ds:ds--var-opt-SUNWdsee-dsins1

How to maintain One product cost collector for multiple materials and configuration setting

Hi experts,
my requirement is that i want to maintain one product cost collector for multiple materials ans also i want to know the configuration setting for the same.
I have used KKF6N but it is not working in my case. I went through KKF6M also but there i found multiple cost collectors.
please guide me in the same.
Thanks in advance.

Hi Shripad,
you cannot assign same Product cost collector to different material.
Because you creating cost collector for material combination of material /production version,material /Bom Routing.
so please create individual cost collector for every material.
if you have any query kindly revert back.
Please mark the answer as helpful if it is helpful to you.
Because march 5 onwards scn has stopped awarding points to liked content.
Starting now: No more points for likes on comments/replies
Thanks & Regards
Sandeep Kumar Praharaj

One instance of FCKeditor for multiple fields in a page

How to implement only one instance of FCKeditor (one set of buttons) for multiple textareas in a page?

Hello,
Is that possible with the normal FCK Editor?
I've never seen something like that on any website, but if you find such an example, I can have a look how it's done. If you see it somewhere working, we should be able to make it work in APEX as well.
Regards,
Dimitri
-- http://dgielis.blogspot.com/
-- http://www.apex-evangelists.com/
-- http://www.apexblogs.info/

One Open Directory server for multiple businesses?

Similar Messages

Maybe you are looking for