Showing Open Directory Groups on XP

Hello,
I want to add an open directory created group (of an open directory master) to a workstations Power Users group in XP.
I have:
Setup open directory as an open directory master.
Setup Samba as a PDC.
Kerberos and dns are setup correctly.
everything shows it's running fine.
added users, and then added groups in Workgroup Manager.
Added the SMBRID of 512 to one created group so it automatically maps to the Domain Admins.
That works great.
Can't figure out for the life of me how to get my groups I created to be selectable in XP so I can add them to the Power Users group. They just don't show up. Other groups that are in the local directory show up. Groups like _amavisd show up. So what is the key?
It would be great if someone somewhere knows the answer to this as I have been banging my head against the wall for two weeks now.
Thanks in advance to anyone who knows.....

Hello,
I'm answering my own post here. After a couple weeks of banging my head against the wall I found one solution in the forums, but it may not be easy to find so here is the solution for adding groups you have created in OD to the local power users group.
If you click add user in the user manager window (which pops up after double clicking users in the control panel) and then enter the group name, it can be the full name even with spaces, in the user field, and then put the domain in, and then add the user, select other for group and then pick power users, and finish/ok. Now if you reboot and go look at the groups under user settings advanced you will see that it has added that group to the power users, and is not listed under users.
Freaking weird that you can add this way, and that the groups still do not show when you do a search for them, but hey, it works. Hope this helps someone.

Similar Messages

Nested Open Directory Groups

I am receiving the message "Couldn't find group for user" when trying to log in using users that are nested members of a large group (Group 1<Group2<User, with Group 1 connected to a permission set). The same user can log in as soon as I add them directly to Group 1.
Am I missing something here? I assume that Final Cut Server can recognize inherited Open Directory group membership, no? I would very much appreciate help in this matter.

I believe that active directory has a user limitation of 1000 users when using it conjunction with linux/unix environments.
This excerpt was pulled out of an article (http://www.tkk.fi/cc/docs/kerberos/nss_ldap.html) pertaining to this issue:
"Active directory uses a method called "Incremental Retrieval of Multivalued Properties" which nss_ldap has no support for, at least not yet. Querying groups having more than 1000 members will return the first 1000 members, with the 'member' attribute changed to 'member;range=0-999'. This is not recognized by nss_ldap, so you will not see any members for that group. More information can be found in the (now expired) Internet Draft labeled Incremental Retrieval of Multivalued Attributes."
The article is a little out of date but it should still apply.
Hope thats what you're looking for and helps you out at all.

Open Directory groups not showing up in Windows

Hello,
we are using Open Directory on a Leopard 10.2 as a primary PDC for mac, linux and windows clients.
The Kerberos sign in works as expected, but we can not get any group created in the OD to be displayed (or selectable) from windows. All users show up, but no groups.
Anyone got an ides or the same problem?
Message was edited by: majs

Same problem here. On Windows client we see only domain users, no domain groups.
No solution yet.

How to set permissions IN Open Directory USING Open Directory groups?

Hi all,
Apologies if I've missed this but have been searching for two days trying to figure out how to delegate permissions within the OD to a number of different OD groups and i can't seem to find any way to do this either at the command line or with WGM.
Examples: an OD group containing those who will manage the full directory need to have permissions on all containers, child objects, and their attributes in the directory. For this one in particular I seem to be able to nest a group in the default Admin group, but this isn't really what i'm after. I need to create OD groups with the ability only to manipulate objects of class apple-computer and similarly, apple-user (really all inetOrgPerson objects). In a nutshell: how do i set permissions on specific attributes or object classes using OD groups?
thanks for any pointers...
-andrew

I think i just answered my own question: Open Directory is OpenLDAP. slapd is all i need.

10.7.5 client shows open directory server not responding

Hello,
I am just starting to learn to use OS X Server. I have created an Open Directory Master and want to connect my various Mac's around the home to. My iMac is currently running 10.7.5 client and have tried to add the server as a Network Account Server - re: below, but it shows it is not responding.
As I am a real novice, have I missed something and how do I get this to work?
Thanks,
Nick

You are likely having issues because you are not using DNS correctly. The name "CowShed.local" is a bonjour name. In order to properly use Open Directory you need DNS set up internally. The reason is that the Kerberos component of Open Directory is very dependent on DNS.
Generally, I would discourage the use of bogus top level domain. However, since you say this is for home use, you can likely get away with the use of one (mac.leedern.int, mac.leederm.private, etc). However, if you do, then you will not be able to use hosted services (mail, calendar, contacts, etc) transparently between the home and external networks (names will not route).
If you own a domain name, you can use it internally and setup your DNS on the server. Then distribute the servers's LAN IP address to all clients as the first DNS server. This way, all your client devices can resolve the server's host name while on the LAN.
Your journey starts at DNS.
R-
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

How to turn off Open Directory in OS X Server 10.8.2

I am configuring a MacPro with ML Server 10.8.2 for internal-only use. I have DNS working on it (with the annoyance that it goes out of its way to break wildcard host names, and it doesn't know how to properly create the zone files to allow a secondary DNS server to do reverse-name-lookups properly). I have only 2 users (admin and Time Machine), Time Machine is working for client Macs using the Time Machine user account, and File Sharing is working (using either account), sharing a RAID of internal drives an a pair of USB-attached external drives.
I briefly turned on Open Directory, just to see if I wanted or needed to go that route. I entered an Open Directory admin (diradmin) with a password. Looked around the options and decided I did NOT need to use Open Directory just to get the Time Machine stuff working, and I was right.
However, now the Server App shows Open Directory is "On." When I go to that tab, I get a message stating that there was an error reading the settings file for Open Directory services. I click it "Off" but it refuses to turn off. When I come back to the tab, I get a pop-up window with a message about an error reading the settings and the Off/On switch moves back to "On" and the green light never goes off next to Open Directory in the list of services.
I've rebooted the machine and after the reboot, sometimes, it appears as if I can add/delete/modify Users and Groups. Other times, after the reboot, the +/- buttons are greyed out and I cannot add/edit/modify Users and Groups. I have not yet tried to add/delete/modify users yet because I'm leery of trusting the server with this error message.
Can anyone help me to remove anything and everything related to Open Directory so that it is "off" as if I never ever turned it on? Or any suggestions on how to fix this short of a reinstall?
Can I download and install the Server app on a differnt machine and then just copy the Server app over to this machine? Will that zero out the Open Directory stuf that I'm trying to get rid of?
Thanks in advance.

I think I solved my problem by running the following command:
sudo slapconfig -destroyldapserver diradmin
diradmin is the name of the Open Directory admin account I created.
The Open Directory Service now appears "off" and no longer had the green dot next to it in the list of services.
Obviously, NOT a good solution to someone who was actively using Open Directory as this appears to have deleted all the data associated with Open Directory.
Users and Groups now allow me to add/delete/modify.
Sad to see an Apple product have such issues.

Problems with Active Directory Users showing as not found in Open Directory work group manager

I’m running a golden triangle setup with Open directory assigning group policy and authentication provide by active directory. In workgroup manager I can search through the AD and add users or computers to groups in OD workgroup manager. However when I save and refresh the users or computer appear as ‘not found’. Is there a reason for this?

Hi Zero
It's very reassuring to know im not the only one having issues with this..
Im on my second re install of the server.. I like you have no wish to do another clean install as everything else is connected and it seems like the answer is probably very simple.
So today im going to re- run the terminal commands as layed out in the online guides.
However i was kinda hoping someone would be able to supply us with an answer.
thanks
J

What is a mac client joined to a Open Directory server supposed to show?

... at login?
I mean, does it usually show a list of every open directory user, so that the user in front of the machine choose its corresponding profile, insert the password and goes straight away, just like with local users?
Or does it show a couple of blank fields with user name and password?
Either way, can you configure that to best suit your needs and taste?
Thank you.

I generally deliberately have very few local users on the client, and they're generally also marked as being hidden from the login displays. Most users are domain users. And I tend to use the user-n-password box setting on the clients, possibly with a banner message.
Preferences, LOGIN it says "These setting cannot be managed for users", the same with workgroup.
You need to manage this via the client computer or computer group entries, and not a per-user or user group entries. It's the computer and not the user that establishes these preferences. (It makes sense, once you grok the logic here. But that existing diagnostic message could more helpfully be phrased as how you can do this, rather than how you can't. As "Hey, admin-dude, go tweak this knob over in computers or computer groups, kthnxbye" or some such, and not as this "I'm sorry Dave, but I can't do that" message.

Make Open Directory Users/Groups Administrators on Mac clients

I have setup a OS X 10.8 server with Open Directory and have 2 mac os x mountain lion clients. I would like for the user accounts I have created in the Open Directory to have admin access to the 2 mac client machines. How can I do this? I am new to OS X server. Is there a Group Policy type equivalent like in Windows?

Ah! Thanks! No wonder I cannot do this...
Unfortunately, the printers are all USB shared printers connected to computers on the network. Is there anyway to preset these printers? They don't show up in the Print manage settings at all.

Open directory list not showing at startup, where do i start to look

If my suite of iMacs are not picking up the open directory list at startup and I know they have the correct details, what process should I go through to find the problem. The server all looks ok, but after recent changes made by our local authority the list no longer shows up.
The server is running 10.5
Could DNS be the problem for example. I have limited experience of setting up osx servers.
Regards Peter.

I presume you mean the login window is not listing the Open Directory user accounts? This actually is the normal default behaviour for the login window.
Is your login window showing just two boxes for the user name and password, or is it listing just local user accounts? If it is listing some user accounts is "Other" in that list?
When I used to run 10.5 Server, I used to create a Computer Group, add all my client computers to that group and set a managed preference for that group to force my client computers to show a full list of Open Directory accounts. You do this as follows -
Launch Workgroup Manager
Login to Workgroup Manager
If you don't already have a suitable one, create a new Computer group
If needed add all your client computers to this Computer group
Now with that Computer group still selected, click on the Preferences icon at the top of the Workgroup Manager window
Click on the Login choice on the left
You should now see at the top a set of radio buttons for Never, Once, or Always - choose Always
If you now look in the main part of the window you should see options for things like Style - List of users (which is what you want) and under that tick boxes for Show network users (which is also what you want)
When you have set things as desired, click on the Apply Now button in the bottom right
You will need to reboot the client computer to test this
Note: If you have a really large number of user accounts it might take a while to draw the list of accounts in the Login screen. I had about 70 and it was fairly fast.

Three new groups in Open Directory Server

I noticed that my Open Directory server has three new groups in WGM,OD Users, OD Administators and com.apple.limited_admin. Should I treat these as I treated the other groups by assigning them members and group folders? I also noticed that now I have a System Administrator and a Directory Adminstrator, does that sound right? Should I keep both? Thanks

Ok, thanks, I had forgoten the "show system records" trick.
For the guest user, I don't see it in dscl.
So I suppose it's not a user, just an "anonymous" authentication option in the sharing preferences.
It's a bit like "others" in the posix rights permissions : User, group, other. User and group are existing and named, other are not named, it's just anybody that is not the named user and not a member of the named group.
To keep things understandable, you should use an other name if you wish to configure a "guest user"
You can manage the "enable guest account" option from WGM if you select a computergroup, in the preferences pane / login / options.
Hope it helps
Nicolas

How can I enforce Parental Controls on a group of network users on an Open Directory client?

I have a Mac mini running OS X Server (Mountain Lion) and have a client family iMac that is a client of the Open Directory server. I have created network users for my kids and put them into a group and created Parental Control restrictions that apply to members of the group. However, the kids can log into the iMac with the same network accounts and no Parental Control policies are enforced on the iMac.
I'd like to restrict times and hours per day, as well as the obvious content/website restrictions. I'm not sure why the Parental Control policy isn't being enforced. While I'm not great at it, I do have a basic understanding/overview of knowledge on Windows Server administration, but OS X Server seems to be waaay different...
I have fiddled with the certificate, and I have told the client iMac to trust the certificate coming from my Open Directory server, but it doesn't seem to make much of a difference with the enforcement of the kids group's Parental Control policies.
Can anyone assist or offer any suggestions?

Related logs from the OD client iMac below:
2013-07-13 20:37:45 -0400 mdmclient[12003]: *** ERROR *** [Agent:501] Sending 'OTA-Phase2' request to server: https://server.local/devicemanagement/api/device/ota_service (<NSURLErrorDomain:-1001> The request timed out.
UserInfo: {
    NSErrorFailingURLKey = "https://server.local/devicemanagement/api/device/ota_service";
    NSErrorFailingURLStringKey = "https://server.local/devicemanagement/api/device/ota_service";
    NSLocalizedDescription = "The request timed out.";
    NSUnderlyingError = "Error Domain=kCFErrorDomainCFNetwork Code=-1001 \"The request timed out.\" UserInfo=0x7fef6a82b2b0 {NSErrorFailingURLStringKey=https://server.local/devicemanagement/api/device/ota_service, NSLocalizedDescription=The request timed out., NSErrorFailingURLKey=https://server.local/devicemanagement/api/device/ota_service}";
2013-07-13 20:37:45 -0400 mdmclient[12003]: *** ERROR *** [Agent:501] ProcessOTABootstrapProfileCore (<NSURLErrorDomain:-1001> The request timed out.
UserInfo: {
    NSErrorFailingURLKey = "https://server.local/devicemanagement/api/device/ota_service";
    NSErrorFailingURLStringKey = "https://server.local/devicemanagement/api/device/ota_service";
    NSLocalizedDescription = "The request timed out.";
    NSUnderlyingError = "Error Domain=kCFErrorDomainCFNetwork Code=-1001 \"The request timed out.\" UserInfo=0x7fef6a82b2b0 {NSErrorFailingURLStringKey=https://server.local/devicemanagement/api/device/ota_service, NSLocalizedDescription=The request timed out., NSErrorFailingURLKey=https://server.local/devicemanagement/api/device/ota_service}";
2013-07-13 20:37:45 -0400 System Preferences[11138]: *** ERROR *** [CPInstallerUI:501] Profile installation (Device Enrollment (com.apple.ota.server.local.bootstrap)) (<NSURLErrorDomain:-1001> The request timed out.
UserInfo: {
    NSErrorFailingURLKey = "https://server.local/devicemanagement/api/device/ota_service";
    NSErrorFailingURLStringKey = "https://server.local/devicemanagement/api/device/ota_service";
    NSLocalizedDescription = "The request timed out.";

Open Directory Printers still showing up even though Print services is off

Hi all,
Long time ago, back when Panther was king, we setup Print services on our Panther servers. It often jammed and now we turned off the Print service and deleted all the queues. But now, when adding printers to our client laptops running Leopard, the open directory printers are showing up under the Default icon and people are being misled to add these printers. Is there a way to remove these "ghost" printers?
- Mike

Hi Mike, no experience with Server. Does it have a Reset Printing Services or such? Like 10.4, 10.5?
http://support.apple.com/kb/HT1341?viewlocale=en_US

Directory Binding Script (Active and Open Directory) 10.7

Hi everyone
I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
#!/bin/sh
#Uncomment the following line to abort the script on errors
#trap exit ERR
## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
## Script written by Marc Horat, URZ Basel, 11.6.2010
## Updated: 12.08.2011
# With the use of the following sources as inspiration:
# http://www.howtomac.co.uk/?p=247
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
# Bombich's AD-Bind Script:
# This script binds to AD and configures advanced options of the AD plugin
# As this scripts contains a password, be sure to take appropriate security
# precautions
# A good way to run this script is to set it as a login hook on your master machine
# Because it only needs to be run once, the last thing this script does is to delete
# itself. If you have another login script that you typically run, include the
# script on your master machine, and indicate its path in the "newLoginScript"
# variable.
# If running this as a one-time login hook to bind to AD after imaging,
# be sure to enable auto-login (for any local user) before creating your master image
#################CONFIGURATION##########################
#OD
# These variables need to be configured for your env
odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
odPassword="YOURODPW" # Enter your OD admin password between the quotes
oddomain="YOURODDOMAIN" # FQDN of your OD domain
computerGroup="YOURNEWODCOMPGROUP" # Add appropriate computer group you want machines to be added to, case sensitive
oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
#AD
# Standard parameters
domain="YOURADDOMAIN"                              # fully qualified DNS name of Active Directory Domain
domainname="YOURADDOMAINNAME"                    #Name of the Domain as specified in the search paths
udn="YOURADADMIN"                              # username of a privileged network user
password="YOURADPW"                                                  # password of a privileged network user
ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN"                    # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
# Advanced options AD Plugin
alldomains="disable"                              # 'enable' or 'disable' automatic multi-domain authentication
localhome="disable"                              # 'enable' or 'disable' force home directory to local drive
protocol="smb"                                        # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
mobile="enable"                              # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="enable"                    # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="enable"                              # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash"                    # e.g., /bin/bash or "none"
preferred="-preferred $domain"          # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
packetsign="allow"                              # allow | disable | require
packetencrypt="allow"                    # allow | disable | require
passinterval="14"                              # number of days
namespace="domain"                              # forest | domain
# Login hook setting -- specify the path to a login hook that you want to run instead of this script
newLoginHook=""                    # e.g., "/Library/Management/login.sh"
################################# End of configuration
############ Begin of Script
# Host-specific parameters
# computerid should be set dynamically, this value must be machine-specific
# This value may be restricted to 19 characters! The only error you'll receive upon entering
# an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
#computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
#computerid=`hostname | sed 's/.unibas.ch//'`
#computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
#computerid=`/usr/sbin/scutil --get LocalHostName`
computerid=`scutil --get ComputerName`
adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
# These variables probably don't need to be changed
# Determing if any directory binding exists
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
          check4OD=${check4ODtmp//[[:space:]]/}
          echo "Found LDAP: "$check4ODtmp
          check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
          check4ODacct=${check4ODaccttmp//[[:space:]]/}
          echo "Found LDAP-Computer-Account: "$check4ODacct
else
          check4OD=""
          check4ODacct=""
          echo "No bound LDAP Server found"
fi
if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
          check4ODgroupMembership=$check4ODgroupMembershiptmp
          echo "LDAP Group Membership in Group: "$oldComputerGroup
else
          check4ODgroupMembership=""
          echo "No LDAP Group Membership defined or not bound to a server"
fi
if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
then
          check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//' | sed 's/=//'`
          check4AD=${check4ADtmp//[[:space:]]/}
          echo "Found AD: "$check4AD
          check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
          check4ADacct=${check4ADaccttmp//[[:space:]]/}
          echo "Found AD-Account: "$check4ADacct
else
          check4AD=""
          check4ADacct=""
          echo "No AD-Account found"
fi
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
#Time Sync
#Restart ntpdate
StartService ()
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
          CheckForNetwork
if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
          touch /var/run/NetworkTime.StartupItem
          echo "Starting network time synchronization"
# Synchronize our clock to the network‚Äôs time,
# then fire off ntpd to keep the clock in sync.
          ntpdate -bvs
          ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
echo ""
echo ""
sleep 5
#### Removing any existing directory bindings
#Clear OD Computer Account and delete entry from Computer group
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "This computer is bound to the following Open Directory Services:"
          dscl localhost -list /LDAPv3
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /LDAP
          sleep 5
          if [ "${check4ODacct}" == "${computerid}" ]
          then
                    echo "This machine already has a computer account on $oddomain."
                    # Set the GUID
                    GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
                    echo "Found GUID: "$GUID
                    if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
                    then
                              echo "Removing entry from group $oldComputerGroup"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
                    fi
                    echo "Removing Computer entry $computerid in OD"
                    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
          fi
          #List existing Directories
          echo "Removing OD-Binding to "$check4OD
          dsconfigldap -r "$check4OD"
          echo "Removing Search Path entries"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          sleep 5
else
          echo "No LDAP or OD Binding present.";
fi
echo ""
# Check a second time in order to delete any remaining LDAP-Bindings
echo "Scanning for further LDAP servers"
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "Found:"
          dscl localhost -list /LDAPv3
          echo "Removing OD-Binding to "$check4ODtmp
          dsconfigldap -r "$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          sleep 5
else
          echo "No further LDAP or OD Binding present."
fi
echo ""
echo ""
#Remove the Active Directory binding
if [ "$check4AD" != "" ]
then
          echo "This computer is bound to the following Active Directory Services:"
          dscl localhost -list "/Active Directory"
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /Active
          sleep 5
          echo "Removing any existing AD-Binding to "$check4AD
    dsconfigad -f -remove -username "$udn" -password "$password"
    echo "Removing Search Path entries"
          if [ "$preferred" != "-nopreferred" ]
          then
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
          fi
          dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
          dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
#remove search path entries from 10.6
    if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
    then
        dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
        dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
    fi
          sleep 5
else
          echo "No Active Directory Binding present."
fi
echo ""
#Remove Existing Directory Services Config
echo "Removing existing DS Config"
if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
then
          rm -R /Library/Preferences/edu.mit.Kerberos
fi
if [ -d "/etc/krb5.keytab" ]
then
          rm -R /etc/krb5.keytab
fi
# Clean up the DirectoryService configuration files
rm -Rfv /Library/Preferences/DirectoryService/*
#OD
echo ""
echo ""
echo "Binding to OD-Damin "$oddomain
sleep 5
dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
echo "Killing opendirectoryd"
killall opendirectoryd
sleep 5
echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
# Add computer to ComputerList and ComputerGroup
if [ $computerGroup != "" ]
then
          echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
fi
echo "Finished OD Binding."
sleep 5 # Give DS a chance to catch up
echo ""
echo ""
echo "Performing the AD Binding"
#AD
# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
#Use the existing AD-Computername or generate a new one
computeridtmp="default"
if [ "$check4ADacct" == "" ]
then
          LEN=$(echo ${#adcomputerid})
          if [ $LEN -lt 15 ]; then
                  echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
                  computeridtmp=$adcomputerid
          else
                  echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
                    echo "Removing any -"
                  computeridtmp=${adcomputerid//-/}
                              LEN=$(echo ${#computeridtmp})
                              if [ $LEN -lt 15 ]; then
                                        echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
                              else
                                        echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
                                        computeridtmp=${computeridtmp:(-15)}
                              fi
                  echo "Cropped Computername to "$computeridtmp
          fi
else
    computeridtmp=${check4ADacct//$/}
    echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
fi
echo ""
# Bind to AD
echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
echo ""
echo "Setting the Advanced AD Plugin options"
# Configure advanced AD plugin options
if [ "$admingroups" = "" ]
then
          dsconfigad -nogroups
else
          dsconfigad -groups "$admingroups"
fi
dsconfigad -alldomains "$alldomains"
dsconfigad -localhome "$localhome"
dsconfigad -protocol "$protocol"
dsconfigad -mobile "$mobile"
dsconfigad -mobileconfirm "$mobileconfirm"
dsconfigad -useuncpath "$useuncpath"
dsconfigad -shell "$user_shell"
dsconfigad "$preferred"
dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
dsconfigad -namespace "$namespace"
sleep 5
echo ""
echo ""
# Add the OD & AD node to the search path
if [ "$alldomains" = "enable" ]
then
          csp="/Active Directory/$domainname/All Domains"
else
          csp="/Active Directory/$domainname"
fi
echo "Finished AD Binding."
echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
echo "Adding OD.."
dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
echo "Adding AD.."
#Adding all Domains first to improve reliability under 10.7
if [ "$alldomains" != "enable" ]
then
    cspadall="/Active Directory/$domainname/All Domains"
    dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
    dscl /Search -append / CSPSearchPath "$cspadall"
fi
dscl /Search/Contacts -append / CSPSearchPath "$csp"
dscl /Search -append / CSPSearchPath "$csp"
echo "Finished Updating Search Paths."
echo ""
echo ""
# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall opendirectoryd
# Destroy the login hook (or change it)
if [ "${newLoginHook}" == "" ]
then
          defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
else
          defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
fi
sleep 5
# Customizing the login-Window
#defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
#defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
#defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
# This works in a pinch if the above code does not
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
#plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
#killall opendirectoryd
# Disable autologin
defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
srm /etc/kcpassword
echo ""
echo ""
echo ""
echo "Now bound to OD Domain:"
dscl localhost -list /LDAPv3
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
echo "Now bound to AD Domain:"
dscl localhost -list "/Active Directory"
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
exit 0                    ## Success
exit 1                    ## Failure
Any inputs, questions and improvement suggestions are, of course, most welcome!
Cheers
See

Hi everyone
I'm reposting this in the right thread. I've written a Directory Binding Script for 10.6 and ported it now to 10.7 as among the things that have changed in the upgraded version is a refurbished directory binding enviroment.
The original thread can be found here: https://discussions.apple.com/thread/3090068. The script is applicable for clients as well and simplifies the binding process considerably.
Be aware that the reformatted script here contains some faulty line breaks. So you'll have to correct them in a proper text editor.
#!/bin/sh
#Uncomment the following line to abort the script on errors
#trap exit ERR
## Script to automate OD and AD Binding of Mac OS X 10.7 Servers
## Script written by Marc Horat, URZ Basel, 11.6.2010
## Updated: 12.08.2011
# With the use of the following sources as inspiration:
# http://www.howtomac.co.uk/?p=247
#Created by Ross Hamilton
#Clock restart / Remove existing settings
#Join to Open Directory and Active Directory
# Bombich's AD-Bind Script:
# This script binds to AD and configures advanced options of the AD plugin
# As this scripts contains a password, be sure to take appropriate security
# precautions
# A good way to run this script is to set it as a login hook on your master machine
# Because it only needs to be run once, the last thing this script does is to delete
# itself. If you have another login script that you typically run, include the
# script on your master machine, and indicate its path in the "newLoginScript"
# variable.
# If running this as a one-time login hook to bind to AD after imaging,
# be sure to enable auto-login (for any local user) before creating your master image
#################CONFIGURATION##########################
#OD
# These variables need to be configured for your env
odAdmin="YOURODADMIN" #enter your OD admin name between the quotes
odPassword="YOURODPW" # Enter your OD admin password between the quotes
oddomain="YOURODDOMAIN" # FQDN of your OD domain
computerGroup="YOURNEWODCOMPGROUP" # Add appropriate computer group you want machines to be added to, case sensitive
oldComputerGroup="YOUROLDODCOMPGROUP" # If the Computer is in a Group already
#AD
# Standard parameters
domain="YOURADDOMAIN"                              # fully qualified DNS name of Active Directory Domain
domainname="YOURADDOMAINNAME"                    #Name of the Domain as specified in the search paths
udn="YOURADADMIN"                              # username of a privileged network user
password="YOURADPW"                                                  # password of a privileged network user
ou="OU=YOUR,OU=OU,OU=URZ,OU=IN,DC=YOUR,DC=AD,DC=DOMAIN"                    # Distinguished name of container for the computer E.G. OU=Macs,OU=Computers,DC=AD,DC=DOMAIN,DC=CH
# Advanced options AD Plugin
alldomains="disable"                              # 'enable' or 'disable' automatic multi-domain authentication
localhome="disable"                              # 'enable' or 'disable' force home directory to local drive
protocol="smb"                                        # 'afp', 'smb' or 'nfs' (since 10.7) change how home is mounted from server
mobile="enable"                              # 'enable' or 'disable' mobile account support for offline logon
mobileconfirm="enable"                    # 'enable' or 'disable' warn the user that a mobile acct will be created
useuncpath="enable"                              # 'enable' or 'disable' use AD SMBHome attribute to determine the home dir
user_shell="/bin/bash"                    # e.g., /bin/bash or "none"
preferred="-preferred $domain"          # Use the specified server for all Directory lookups and authentication
# (e.g. "-nopreferred" or "-preferred ad.server.edu")
admingroups="$domainname\YOURADADMINGROUP" # These comma-separated AD groups may administer the machine (e.g. "" or "APPLE\macadmins")
packetsign="allow"                              # allow | disable | require
packetencrypt="allow"                    # allow | disable | require
passinterval="14"                              # number of days
namespace="domain"                              # forest | domain
# Login hook setting -- specify the path to a login hook that you want to run instead of this script
newLoginHook=""                    # e.g., "/Library/Management/login.sh"
################################# End of configuration
############ Begin of Script
# Host-specific parameters
# computerid should be set dynamically, this value must be machine-specific
# This value may be restricted to 19 characters! The only error you'll receive upon entering
# an invalid computer id is to the effect of not having appropriate privileges to perform the requested operation
#computerid=`/sbin/ifconfig en0 | awk '/ether/ { gsub(":", ""); print $2 }'` # MAC Address
#computerid=`hostname | sed 's/.unibas.ch//'`
#computerid=`/usr/sbin/scutil --get LocalHostName | cut -c 1-19` # Assure that this will produce unique names!
#computerid=`/usr/sbin/scutil --get LocalHostName`
computerid=`scutil --get ComputerName`
adcomputerid=`echo "$computerid" | tr [:lower:] [:upper:]`
# These variables probably don't need to be changed
# Determing if any directory binding exists
nicAddress=`ifconfig en0 | grep ether | awk '{print $2}'`
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODtmp=`dscl localhost -list /LDAPv3 | grep -n 1 | sed 's/1://' | sed 's/2://'`
          check4OD=${check4ODtmp//[[:space:]]/}
          echo "Found LDAP: "$check4ODtmp
          check4ODaccttmp=`dscl /LDAPv3/"$check4OD" -read Computers/"$computerid" RealName | cut -c 11-`
          check4ODacct=${check4ODaccttmp//[[:space:]]/}
          echo "Found LDAP-Computer-Account: "$check4ODacct
else
          check4OD=""
          check4ODacct=""
          echo "No bound LDAP Server found"
fi
if [ $oldComputerGroup != "" ] && dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          check4ODgroupMembershiptmp=`dscl /LDAPv3/"$check4OD" -read ComputerGroups/"$oldComputerGroup" | grep "$computerid"`
          check4ODgroupMembership=$check4ODgroupMembershiptmp
          echo "LDAP Group Membership in Group: "$oldComputerGroup
else
          check4ODgroupMembership=""
          echo "No LDAP Group Membership defined or not bound to a server"
fi
if dscl localhost -list "/Active Directory" | grep $domainname > /dev/null
then
          check4ADtmp=`dsconfigad -show | grep "Active Directory Domain" | sed 's/Active Directory Domain//' | sed 's/=//'`
          check4AD=${check4ADtmp//[[:space:]]/}
          echo "Found AD: "$check4AD
          check4ADaccttmp=`dsconfigad -show | grep "Computer Account" | sed 's/Computer Account//' | sed 's/=//'`
          check4ADacct=${check4ADaccttmp//[[:space:]]/}
          echo "Found AD-Account: "$check4ADacct
else
          check4AD=""
          check4ADacct=""
          echo "No AD-Account found"
fi
osversionlong=`sw_vers -productVersion`
osvers=${osversionlong:3:1}
#Time Sync
#Restart ntpdate
StartService ()
if [ "${TIMESYNC:=-YES-}" = "-YES-" ] && ! GetPID ntpd > /dev/null; then
          CheckForNetwork
if [ -f /var/run/NetworkTime.StartupItem -o "${NETWORKUP}" = "-NO-" ]; then exit; fi
          touch /var/run/NetworkTime.StartupItem
          echo "Starting network time synchronization"
# Synchronize our clock to the network‚Äôs time,
# then fire off ntpd to keep the clock in sync.
          ntpdate -bvs
          ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
fi
echo ""
echo ""
sleep 5
#### Removing any existing directory bindings
#Clear OD Computer Account and delete entry from Computer group
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "This computer is bound to the following Open Directory Services:"
          dscl localhost -list /LDAPv3
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /LDAP
          sleep 5
          if [ "${check4ODacct}" == "${computerid}" ]
          then
                    echo "This machine already has a computer account on $oddomain."
                    # Set the GUID
                    GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
                    echo "Found GUID: "$GUID
                    if [ "$oldComputerGroup" != "" ] && [ "$check4ODgroupMembership" != "" ]
                    then
                              echo "Removing entry from group $oldComputerGroup"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembership "${computerid}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerGroups/"$oldComputerGroup" GroupMembers "${GUID}"
                              dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /ComputerLists/"$oldComputerGroup" Computers "${computerid}"
                    fi
                    echo "Removing Computer entry $computerid in OD"
                    dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$check4OD" -delete /Computers/"${computerid}"
          fi
          #List existing Directories
          echo "Removing OD-Binding to "$check4OD
          dsconfigldap -r "$check4OD"
          echo "Removing Search Path entries"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4OD"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4OD"
          sleep 5
else
          echo "No LDAP or OD Binding present.";
fi
echo ""
# Check a second time in order to delete any remaining LDAP-Bindings
echo "Scanning for further LDAP servers"
if dscl localhost -list /LDAPv3 | grep . > /dev/null
then
          echo "Found:"
          dscl localhost -list /LDAPv3
          echo "Removing OD-Binding to "$check4ODtmp
          dsconfigldap -r "$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          dscl /Search -delete / CSPSearchPath /LDAPv3/"$check4ODtmp"
          sleep 5
else
          echo "No further LDAP or OD Binding present."
fi
echo ""
echo ""
#Remove the Active Directory binding
if [ "$check4AD" != "" ]
then
          echo "This computer is bound to the following Active Directory Services:"
          dscl localhost -list "/Active Directory"
          echo "With the Search Path entries:"
          dscl /Search -read / CSPSearchPath | grep /Active
          sleep 5
          echo "Removing any existing AD-Binding to "$check4AD
    dsconfigad -f -remove -username "$udn" -password "$password"
    echo "Removing Search Path entries"
          if [ "$preferred" != "-nopreferred" ]
          then
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search/Contacts -delete / CSPSearchPath /Active Directory/"$domainname"
                    dscl /Search -delete / CSPSearchPath /Active Directory/"$domainname"
          fi
          dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
          dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/All Domains"
#remove search path entries from 10.6
    if dscl /Search -read / CSPSearchPath | grep /Active > /dev/null
    then
        dscl /Search -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
        dscl /Search/Contacts -delete / CSPSearchPath "/Active Directory/$domainname/$domain"
    fi
          sleep 5
else
          echo "No Active Directory Binding present."
fi
echo ""
#Remove Existing Directory Services Config
echo "Removing existing DS Config"
if [ -d "/Library/Preferences/edu.mit.Kerberos" ]
then
          rm -R /Library/Preferences/edu.mit.Kerberos
fi
if [ -d "/etc/krb5.keytab" ]
then
          rm -R /etc/krb5.keytab
fi
# Clean up the DirectoryService configuration files
rm -Rfv /Library/Preferences/DirectoryService/*
#OD
echo ""
echo ""
echo "Binding to OD-Damin "$oddomain
sleep 5
dsconfigldap -v -a "$oddomain" -n "$oddomain" -c "$computerid"
echo "Killing opendirectoryd"
killall opendirectoryd
sleep 5
echo "Adding computer account $computerid to /LDAPv3/${oddomain} on $oddomain"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -create /Computers/"$computerid" ENetAddress "$nicAddress"
dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /Computers/"$computerid" RealName "$computerid"
# Set the GUID
GUID="$(dscl /LDAPv3/$oddomain -read /Computers/${computerid} GeneratedUID | awk '{ print $2 }')"
# Add computer to ComputerList and ComputerGroup
if [ $computerGroup != "" ]
then
          echo "Adding computer $computerid to OD group $computerGroup on $oddomain"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerLists/"$computerGroup" apple-computers "$computerid"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" apple-group-memberguid "${GUID}"
          dscl -u "${odAdmin}" -P "${odPassword}" /LDAPv3/"$oddomain" -merge /ComputerGroups/"$computerGroup" memberUid "$computerid"
fi
echo "Finished OD Binding."
sleep 5 # Give DS a chance to catch up
echo ""
echo ""
echo "Performing the AD Binding"
#AD
# Activate the AD plugin
defaults write /Library/Preferences/DirectoryService/DirectoryService "Active Directory" "Active"
plutil -convert xml1 /Library/Preferences/DirectoryService/DirectoryService.plist
#Use the existing AD-Computername or generate a new one
computeridtmp="default"
if [ "$check4ADacct" == "" ]
then
          LEN=$(echo ${#adcomputerid})
          if [ $LEN -lt 15 ]; then
                  echo "ComputerID "$adcomputerid " has 15 characters or less and is therefore suitable for AD-Binding. It is $adcomputerid"
                  computeridtmp=$adcomputerid
          else
                  echo "ComputerID "$adcomputerid " has 16 or more characters and needs to be modified for AD-Binding."
                    echo "Removing any -"
                  computeridtmp=${adcomputerid//-/}
                              LEN=$(echo ${#computeridtmp})
                              if [ $LEN -lt 15 ]; then
                                        echo "ComputerID "$computeridtmp" has now 15 characters or less and is therefore suitable for AD-Binding."
                              else
                                        echo "Only using the last 15 characters of the Computer name to be able to bind to AD."
                                        computeridtmp=${computeridtmp:(-15)}
                              fi
                  echo "Cropped Computername to "$computeridtmp
          fi
else
    computeridtmp=${check4ADacct//$/}
    echo "Found existing AD Account previously, attempting to recreate in the OU: "$computeridtmp
fi
echo ""
# Bind to AD
echo "Binding to AD-Domain "$domain" with computerid "$computeridtmp
dsconfigad -f -add "$domain" -username "$udn" -password "$password" -ou "$ou" -computer "$computeridtmp"
echo ""
echo "Setting the Advanced AD Plugin options"
# Configure advanced AD plugin options
if [ "$admingroups" = "" ]
then
          dsconfigad -nogroups
else
          dsconfigad -groups "$admingroups"
fi
dsconfigad -alldomains "$alldomains"
dsconfigad -localhome "$localhome"
dsconfigad -protocol "$protocol"
dsconfigad -mobile "$mobile"
dsconfigad -mobileconfirm "$mobileconfirm"
dsconfigad -useuncpath "$useuncpath"
dsconfigad -shell "$user_shell"
dsconfigad "$preferred"
dsconfigad -packetsign "$packetsign" -packetencrypt "$packetencrypt" -passinterval "$passinterval"
dsconfigad -namespace "$namespace"
sleep 5
echo ""
echo ""
# Add the OD & AD node to the search path
if [ "$alldomains" = "enable" ]
then
          csp="/Active Directory/$domainname/All Domains"
else
          csp="/Active Directory/$domainname"
fi
echo "Finished AD Binding."
echo "Adding Domain /LDAPv3/"$oddomain" and "$csp" to Search Path"
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search/Contacts -create / SearchPolicy CSPSearchPath
echo "Adding OD.."
dscl /Search -append / CSPSearchPath /LDAPv3/"$oddomain"
dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/"$oddomain"
echo "Adding AD.."
#Adding all Domains first to improve reliability under 10.7
if [ "$alldomains" != "enable" ]
then
    cspadall="/Active Directory/$domainname/All Domains"
    dscl /Search/Contacts -append / CSPSearchPath "$cspadall"
    dscl /Search -append / CSPSearchPath "$cspadall"
fi
dscl /Search/Contacts -append / CSPSearchPath "$csp"
dscl /Search -append / CSPSearchPath "$csp"
echo "Finished Updating Search Paths."
echo ""
echo ""
# Restart DirectoryService (necessary to reload AD plugin activation settings)
killall opendirectoryd
# Destroy the login hook (or change it)
if [ "${newLoginHook}" == "" ]
then
          defaults delete /var/root/Library/Preferences/com.apple.loginwindow LoginHook
else
          defaults write /var/root/Library/Preferences/com.apple.loginwindow LoginHook $newLoginHook
fi
sleep 5
# Customizing the login-Window
#defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo DSStatus
#defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool TRUE
#defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool TRUE
# This works in a pinch if the above code does not
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Node Custom Path Array" -array "/Active Directory/All Domains"
#defaults write /Library/Preferences/DirectoryService/SearchNodeConfig "Search Policy" -int 3
#plutil -convert xml1 /Library/Preferences/DirectoryService/SearchNodeConfig.plist
#killall opendirectoryd
# Disable autologin
defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
srm /etc/kcpassword
echo ""
echo ""
echo ""
echo "Now bound to OD Domain:"
dscl localhost -list /LDAPv3
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /LDAP
echo "Now bound to AD Domain:"
dscl localhost -list "/Active Directory"
echo "With Search Path entries:"
dscl /Search -read / CSPSearchPath | grep /Active
exit 0                    ## Success
exit 1                    ## Failure
Any inputs, questions and improvement suggestions are, of course, most welcome!
Cheers
See

Ubuntu Karmic authentication against Snow leopard open directory server

Hi,
I'm looking for help. I've tried to configure an installation of Karmic to authenticate against our office's open directory server running on an osx snow leopard server. Currently `getent password` show all users including those from the open directory server when running the command as both root and normal users. However authentication against the open directry users fails with the following messages in the /var/log/auth.log:-
Dec 7 22:42:05 [hostname] getent: nss_ldap: failed to bind to LDAP server ldap://server.domain.com: Invalid credentials
Dec 7 22:42:05 [hostname] getent: nss_ldap: could not search LDAP server - Server is unavailable
(I've changed the hostname and ldap url)
/etc/ldap.conf has:-
base dc=server,dc=domain,dc=com
ldap_version 3
rootbinddn cn=diradmin,dc=server,dc=domain,dc=com
bind_policy soft
pam_password md5
/etc/ldap.secret is set to the password of the diradmin user and has a permission mask of 600
/etc/pam.d/common-passwd :-
password sufficient pam_ldap.so md5
password required pam_unix.so nullok obscure md5
password optional pam_smbpass.so nullok use_authtok tryfirstpass missingok
/etc/pam.d/common-auth:-
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so usefirstpass
auth requisite pam_deny.so
auth required pam_permit.so
/etc/pam.d/common-account:-
account [success=2 newauthtokreqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
account requisite pam_deny.so
account required pam_permit.so
/etc/pam.d/common-session
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
session optional pamckconnector.so nox11
Does anyone have any ideas where to go from here?
Message was edited by: zebardy

Hi
It's easy enough to 'connect' any version of OS X Server to any other version of OS X Server. Use the Join button in the Users & Groups Preferences Pane. Alternatively use the Directory Utility itself.
You seem to be misunderstanding what an Open Directory Master and Replica are? They are not what I think you think they are. They are not a 'back-up' of each other if you're providing more than the shared Directory Service.
An OD Replica maintains a read-only copy of the LDAP Database (Usernames, Passwords and Policies etc) that's stored on the OD Master and nothing more. If the Master was to go offline for any reason the Replica can be quickly promoted to a Master Role and continue to provide information for the shared directory. This assumes it has easy and quick access to the Volume storing networked home folders? The LDAP Database in that case would then become writable. Later on and whenever you've fixed the problem with the old Master it can quickly be demoted and made a Replica of the now new Master.
Although this is for 10.6 Server (it is nevertheless still applicable) everything you need to know about Master and Replica relationships is here:
http://manuals.info.apple.com/en_US/OpenDirAdmin_v10.6.pdf
Page 55 onwards.
From Page 64:
"The Open Directory master and its replicas must use the same version of Mac OS X Server. . ."
If your OD Master is also providing Mail, Calendar and Contact Services then none of these will be replicated. You will have to maintain a backup of these databases yourself using whatever method you deem fit for your needs.
HTH?
Tony

Showing Open Directory Groups on XP

Similar Messages

Maybe you are looking for