Populating Users With Open Directory Archive

I have a New 10.8.2 Lion server that I would like to bring all the 10.7.5 users over. what is the best way to do this. It seems that the 10.7.5 arcive is not compatable with 10.8.2. Any ideas would be great. I can't upgrade the 10.7.5 system becuase its an an old system.

Didn't find a way to edit my post above.
UPDATE:
Trying to log in with Thunderbird showed differently in the IMAP log. It's user disabled instead.
imap-login: Info: Disconnected (user disabled): user=<username>, method=CRAM-MD5, rip=192.168.8.101, lip=192.168.8.99, TLS
How do I 'enable' this user?

Similar Messages

How to create email users with open directory?

I'm trying to used a mac mini as a mail server for my domains. It works well for SMTP server/gateway for multiple locally networked systems running Lion, Mountain Lion and Maverick. The server is running Mavericks 10.9.2 server 3.1.1.
I need to add email users to it, so I tried Open Directory. I added a user with an email address with a domain listed in the mail server's domains. Then used the server app to give the user permission to use the mail service and selected to have the mail be saved on the server.
However, even though I set the mail server to accept any authentication method, I couldn't log in to get mail (via IMAP) from any email client on my computer. I tried Mail and Sparrow.
The IMAP log on the server says 'Disconnected (auth process communication failure)'. I tried everything that I could from the server app and the workgroup manager app. When using 'Mail.app', the IMAP log shows an empty user name. Trying with Sparrow shows the user name in the log, but still fails.
I restricted authentication to Open Directory, but that didn't help either. Tried with Secure Connection and without.
Am I missing something? Is there anything that I need to do to make the server accept IMAP connections? The mail service is running and handling SMTP.
The domain has an MX record pointing the server's domain name.
All the services are secured with a self signed certificate.
Doing a CLI check with 'sudo serveradmin fullstatus mail' results in the following:
[snip]
mail:protocolsArray:_array_index:0:status = "ON"
mail:protocolsArray:_array_index:0:kind = "INCOMING"
mail:protocolsArray:_array_index:0:protocol = "IMAP"
mail:protocolsArray:_array_index:0:state = "RUNNING"
mail:protocolsArray:_array_index:0:service = "MailAccess"
mail:protocolsArray:_array_index:0:error = ""
[snip]

Didn't find a way to edit my post above.
UPDATE:
Trying to log in with Thunderbird showed differently in the IMAP log. It's user disabled instead.
imap-login: Info: Disconnected (user disabled): user=<username>, method=CRAM-MD5, rip=192.168.8.101, lip=192.168.8.99, TLS
How do I 'enable' this user?

Strange login problem with Open Directory

Hi,
I created a web tool that calls dscl to create users in Open Directory from a bound web server.
Most of the accounts work fine. A couple do not. The particular account in question could login to machines in one computer group, but not on others, using the login window. But it could login on the command-line via su.
Now here's the kicker. I deleted the user completely and re-created the user account with the same login name, and assigned it to the same groups as other new accounts that work fine. The problem persists.
The only thing I've found that indicates a problem is the following from the ldap log:
Sep 17 10:36:14 poseidon slapd[61]: Entry (uid=<username changed>,cn=users,dc=<redacted>,dc=<redacted>,dc=<redacted>): object class 'posixAccount' requires attribute 'homeDirectory'
(note the redactions and username were put in by me...paranoia etc)
I used 'Inspector' in Workgroup Manager and verified that the account does in fact have the required homeDirectory attribute, and the account is not unlike other accounts that work fine, save the username and unique ID.
I hope this provides enough info for someone to give some guidance...this is certainly a strange problem.
Thanks ahead of time!
-Matt

Hi,
I created a web tool that calls dscl to create users in Open Directory from a bound web server.
Most of the accounts work fine. A couple do not. The particular account in question could login to machines in one computer group, but not on others, using the login window. But it could login on the command-line via su.
Now here's the kicker. I deleted the user completely and re-created the user account with the same login name, and assigned it to the same groups as other new accounts that work fine. The problem persists.
The only thing I've found that indicates a problem is the following from the ldap log:
Sep 17 10:36:14 poseidon slapd[61]: Entry (uid=<username changed>,cn=users,dc=<redacted>,dc=<redacted>,dc=<redacted>): object class 'posixAccount' requires attribute 'homeDirectory'
(note the redactions and username were put in by me...paranoia etc)
I used 'Inspector' in Workgroup Manager and verified that the account does in fact have the required homeDirectory attribute, and the account is not unlike other accounts that work fine, save the username and unique ID.
I hope this provides enough info for someone to give some guidance...this is certainly a strange problem.
Thanks ahead of time!
-Matt

SSH user, via Open Directory, can't SUDO...

On three of my Xserves I have SSH access restricted to a handful of users and these users are Open Directory-based users. Aside from the fact that these users don't have a home directory on the servers they connect to (as they're not local users to those machines), I'm having an issue where, when they try and run a command via SUDO, they get an error stating they are not in the sudoers file and thus can't complete the command.
I'm wondering if anyone has a solution for this? Should I not be using OD-based users for SSH?
Thanks,
Kristin.

Sure, you can use OD-based users and sudo.
Maybe add your users to the domain's Administrators group, which, by default, would grant sudo on the member machines. Careful, though, as that's the _domain_ administration group. If you need to restrict access so they can't make domain admin level changes but so they can do just about anything on your member servers and workstations, you could just create a new sudo group, maybe called "sudo-admins" then append an appropriate line to the sudoers files on all of your machines... maybe a line that reads:
%sudo-admins ALL=(ALL) ALL
(standard warning about using caution while editing sudoers goes here -- be careful)

OXS server 3 with mavericks, it will not load up the assistant with open directory and will not allow me to use old open directory it was not a clean install just upgrade. any help or advise appreciated as i really need the server.

OXS server 3 with mavericks, it will not load up the assistant with open directory and will not allow me to use old opeopen directory and will not allow me to use old open directory it was not a clean install just upgrade. any help or advise appreciated as i really need the server.

I wonder if the disk being referred to is actually your iPod which is not plugged in. Maybe something has stuck thinking the iPod should be there.
Try completely removing all the iTunes related programs according to this method.
http://support.apple.com/kb/HT1923
Restart you PC and see if startup improves.
If it doesn't improve you need to consider the possibility that there is something else going on.
If The problem goes away, hopefully a fresh install will be OK.

IChat not working with Open Directory users

I have a Mac Mini running Snow Leopard Server 10.6.1. It provides services like Address Book, iCal, iChat, Mobile Access, MySQL, Web, SMB, Push, etc... I named the server 'Alpha' with the hostname 'alpha.markhadjar.com'
I use DynDNS to help update my dynamic IP address with my ISP. They host my domain markhadjar.com. I created an 'A' record for markhadjar.com using my current IP. The DynDNS software client sends my current dynamic IP address and updates the record. I also created an alias for 'www'.
Airport Extreme port forwards the correct ports to the requested server providing those services.
All my users are listed in the Open Directory. My trouble is I can't seem to get iChat to work for the OD users. I get a connection error.
The jabber account i'm using is the [email protected] I use the server 'ichat.markhadjar.com' with port 5222 without SSL as I do not have a SSL certificate.
In the ichat settings of Server Admin, I specified ichat.markhadjar.com as the server name. I also created an alias in DynDNS for ichat.markhadjar.com - not sure if that was needed.
I cannot connect using iChat to the server. I even changed the server in the iChat preferences (client side) to just markhadjar.com with no luck.
Any help is greatly appreciated!
Thanks.

Mark, you mention that this server 'alpha' is running many things including Mobile Access Server. Do you also run Open Directory on the server? I am trying to figure out if Open Directory is required to be running on the server that runs Mobile Access for it to work in authenticating users and granting them appropriate access. I am hoping it is not required, because I'm having problems getting it to replicate from the Master OD server. It would be easier if it doesn't need to run OD at all. But then if it doesn't run OD, what do I need to do to "bind" it to the other internal origin server? I have read all the MObile Access doc's 50 times, and this is not clear to me. Just wondering how you are using Mobile Access. thanks man!

DNS Server Having Intermittent Issues with Open Directory

I work for a school and we're undertaking the large task of moving from Xserves running 10.6.8 to Mac Minis running 10.9. I have a lot of experience with OS X Server (I held ACSA up until they ditched it, and ACTC through the current OS) but I've hit a fairly large snag in configuring our DNS server. We currently run DNS via an AD server that is being retired at the end of the summer, so this is the first time our DNS will be Mac-based. That said, our network is ridiculously simple as we are a very small school. For the most part it's a flat network using the same IP range for our wired and wireless internal clients (we do have a vlan for guests but that's through Aerohive). I configured the DNS by hand, recreating the entries in our AD server (there were only about a dozen) and then adding in things that should have been there in the first place (e.g. printers and some other devices with static IPs that I'd like FQDNs for). Everything seemed to be working fine...until trying to log into Open Directory accounts.
For some background, the DNS server running 10.9 was the first server we upgraded and it was a completely clean install. We run DHCP on another Mac Server currently running 10.6.8 and it does have the proper OD server listed. All DNS entries for the OD server match our current DNS server. The issue is that it's taking some users 5-6 tries to log in with their network accounts. The errors they receive range from the login window shaking to it stating the user cannot log in at this time. This seems to be worse on client machines running 10.9. but it's appearing on machines running 10.6.8-10.9.3.
In my troubleshooting, I found that if I log in as a local user to one of those machines and do a dig for the OD server the results vary, this is where it gets weird. For example, if I dig ourodserver.ourdomain.org it will sometimes return host not found or it will sometimes resolve. If I ping the same thing it will sometimes work (even after stating it cannot resolve the host) and it will sometimes fail. If I then try a dig for the .local (e.g. ourodserver.local) it also yields the same varied results. However, on every machine that I've tested if I then open a Finder window and navigate to the server via the "Shared" menu and connect I have no trouble connecting and then magically my digs and pings in terminal work. If I revert DNS back to point to our old Windows server the issue goes away. I have meticulously combed through that server many many times now and am not seeing any missed entries. Any idea what could be causing this?

You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.
The primary DNS server used by the server must be 127.0.0.1 (that is, itself) unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.

Managed users with Active Directory?

Hi guys
I was wondering if any of you can help me out. I'm looking to get a OS X Server 10.4 to act as a managed user server, with all the pros of Open Directory (ie Finder restrictions etc) and user home directories on the Xserve's HD, but to authenticate through a Windows 2003 Active Directory Server.
I have been reading a number of sites and there seams to be two ways to do it.
1) Bind the Xserve and the client Macs to the Active Directory and then on the PC server specify the home folders as a share point on the Xserve. Ie \\Xserve\Users\Tom
This way the Xserve is basically a file server.
2) And I'm cutting this story short because I've only briefly read this one. But you can set the Xserve as an Open Directory master, some how import the users and then remove the directory master roll.
I really need to be able to have the usernames and passwords live from the Windows Server due to passwords being changed every 30 days blah blah blah so I guess point 2 is out of the question.
To be honest a yay or nay to the above would be a good start, could obviously save a lot of wasted time, but if anyone can recommend me a website or a pdf that will walk me through it.
I've managed to get my laptop to authenticate to AD but cant get the home directories to work. Every time I log in with a user account it creates it locally on my HD. I do not have "Force local home directory" checked. I guess I need to configure LDAP to the AD server as well? I gave it a go an managed to get Address Book pulling users and emails from the AD sever. I then preformed a lookupd lookup on a user bob and found that the home directory was set to /Users/bob even though on my AD server I've set it to \\Xserve\Users\bob is this something I'm doing wrong with LDAP? If thats all it is I'll be able to get point 1 above working and it will all be good.
I hope I've made this clear enough for someone to be able to help me.
Thanks in advance for any help you might be able to give me.
Tom
1.25GHz PowerBook G4 Mac OS X (10.4.4)

With an OD master you could manage your clients at the group and computer list level.
So when you setup the user's profile in AD, you mapped a network drive and provided the UNC path \\Xserver\Users\bob. You did bind the OD Master with the name Xserve? Also, by default it will use smb to connect, which you can change to afp instead in the AD plugin. smb will not create the home folder for you. You could try to create the home folder yourself in advance. (sudo createhomedir -a may do the trick)
For troubleshooting purposes, you could create a share on the AD server and adjust the user's profile to point to it instead of the OD Master. Try and login and see what you get.

Configure DNS on Snow Leopard for private NAT with Open Directory

I am needing to set up DNS on Snow Leopard server 10.6.4 for use with Snow Leopard clients only. On the server, I have two IPs, one public connections outside the network, and one private within the NAT range. DNS was not originally set up on the server, but Open Directory was (sort of). I've demoted the server from OD master to stand alone, but still can't get this to work.
This server is only for setting up and using Open Directory + NetInstall services inside the network. In effect, it isn't serving web pages and isn't registered with our upstream DNS. What I am assigned to do is get Open Directory to set up user profiles and network shares and home directories. So, what I need is this -
a basic DNS config I can do in Server Admin that will set up DNS to resolve to the local server NAT IP for Open Directory purposes;
and provide DNS for outside the OS X server for the specified Snow Leopard clients.
DHCP is running (but the clients were configured with static IPs in the NAT range). This serves as the DHCP server for the entire network (Windows + Mac clients that aren't in the static NAT range).

Thanks for your replies. I realize I'm not making clear the way this network is configured . Also, the only services running on the Snow Leopard server are (at this time):
dhcpd - in the 10.136.31.x range;
dns - same as before;
planned to add are:
Open Directory (for network logins)
Software update;
Web (only on the 10.136.31.x Ethernet);
mySQL (localhost only - for moodle);
NAT is not set up on the Snow Leopard server itself. We have an outside router, a Cisco 2811. This router provides routing for both the public IP range, and the NAT range is configured in this router. The forwarding dns is located in LR and Fayetteville. So what I need is dns on Snow Leopard to forward outside queries to the state DNS servers, and resolve the local NAT IP only for Open Directory and a set of Snow Leopard clients.
Is this going to be possible?

Migrating NIS users to Open Directory

Was wondering if anyone has any experience with migrating NIS users over to Open Directory? I have setup an Open Directory server (10.6) and am looking to move about 150 users from my NIS server to it.
I can move the users/GIDs easy enough but want to move passwords also so the move it transparent to the users.
Any ideas?
Thanks!

The answer appears to be that as long as your local pre-existing account password matches your domain account, then once the machine is bound, shared servers managed by Active Directory are automatically authenticated. No migration necessary. Only issues I came across had to do with old keychain entries that needed to be removed.
Hope someone out there can learn from my confusion.

IPad with Open Directory

I am looking at using iPads in our school. Does anyone know how/if they interact with an Open Directory server? Would they be able to access all their files with their user name and password through a Cisco network?

I am a Tech Supervisor for a small school district.
I'm very excited about the potential for the i-Pad to be used in a school environment.
However, it's my understanding that the iPad (just like my beloved iPhone) can't be placed on an active directory.
If only... the iPad could be a presentation device (meaning it'll hook into a projector). I bought the VGA dongle thinking I could show the iPad's screen to a large audience (the way Steve Jobs did when he introduced the product)... But alas, that only works with Keynote and some video apps. A huge missed opportunity here.
And the guy who sold me the iPad said I could use my iDisk as storage for the device. Cool..just save to idisk, access from my Mac... Alas, that's not doable...
And we really need it to print to our networked copiers...but that's not happening either.
I absolutely love the iPad...the future it portends is very bright.
BUT presently it's an infuriating miss as far as my educational environment is concerned.
OH, and the really odd thing is that education customers as of last Thursday still had not had their ipads shipped... (why mistreat education customers?) Sadly, I cancelled my order of 6 iPads.
Just seems Apple does not see the tremendous potential the iPad has for teachers... That could be a very lucrative market...

Windows users and open directory

Since Server for 10.7 I've found I've had to create Windows users as local users rather than local network users to give them access to shares via SMB. Is this correct, or am I missing something? I was aware that you can't bind a Windows PC to Open Directory, but can it not authenticate at all through OD?
thanks

If I understand your question, then you are looking for a tool like Centrify. This will put all management on one platform.

"Send to Color" Not Working in managed clients with Open Directory

Hello,
Previously, i try to do this from a local user, with finished sequence, initiated the "send to color" command from the pop up menu, named the project, graded the footage and output the results.
However when i log with a network managed client when I click, "send to color", the dialog box comes up to name the Color project, which I do, but then when I click past that, nothing happens. Color does not open, nothing seems to be exported or "sent". Any ideas?

Same issue here. Trashed prefs, no effect

Using Xcode 4 with Open Directory Users

We have a lab of iMacs (10.7.2) with Xcode 4.2 that are bound to an OD server (10.6.8).
At the moment only a local admin user can build and run an iOS project in Xcode.
I already changed the Primary Group for the OD users to Group ID: 204 (_developer) which resolved some issues but OD Users still can't run an iOS project in the iOS Simulator.
Does anyone have a working solution?

9 months later, XCode 4.4 is out and we still have the above mentioned issue.
Is no one else using XCode with OD users?

Migrating an Open Directory Archive from 10.6.8 to 10.8.5 on new hardware.

Hi all,
We have an old 10.6.8 server running OD and WGM. Lots of users, groups, settings and so on. We want to migrate the entire directory to a new 10.8.5 server and continue to run with WGM for now. Does anyone have a successful method for this? Note that the old server must retain its current IP. We're thinking something along the lines of:
1) Make OD archive on current 10.6.8 server.
2) Shut down server temporarily.
3) Set IP of new 10.8.5 server to match 10.6.8 server and import OD archive.
4) Change ip of new server accordingly and run changeip script.
5) Turn 10.6.8 server back on.
6) Gradually migrate clients to new server.
7) Gradually migrate to Profile Manager.
Has anyone else managed this without too many problems? If there were problems, what were they and how did you resolve them?
Thanks,

What we've actually found since posting this is a whole load of other problems and bugs (some have been officially acknowledged now) with server 10.7/10.8/10.9. I think the changeip script is now defunct too. The migration itself actually worked ok a couple of times for us but we've now got 10.8 and 10.9 servers with directory issues all over the place regardless - even ones that were built from scratch and not migrated...

Populating Users With Open Directory Archive

Similar Messages

Maybe you are looking for