Troubles with DHCP-supplied LDAP servers

Question

Hello,
this feature does'nt work at all in my environment....
I've a openldap server (RFC 2307) and a couple of macs (newest leopard) which are working quite nice together for a while now.
It's a closed Network and want to get rid of the following commands, which I have to enter on each new mac:
sudo dsconfigldap -x -e -v -s -a ldap.mydomain.de -n "MYLDAP"
sudo dscl -q localhost -create /Search SearchPolicy dsAttrTypeStandard:CSPSearchPath
sudo dscl -q localhost -merge /Search CSPSearchPath /LDAPv3/ldap.mydomain.de
Instead i want to use the possibility to transmit the needed ldap-data using DHCP.
Therefore I've added the following lines to my dhcpd.conf-Server
option ldap-server code 95 = text;
option ldap-server “ldaps://ldap.mydomain.de:636/dc=mydomain,dc=de”;
Booting a mac I've got the following results:
bo-dhcp-228:~ sysadm$ ipconfig getpacket en1
op = BOOTREPLY
htype = 1
flags = 0
hlen = 6
hops = 0
xid = 276885973
secs = 0
ciaddr = 10.0.0.228
yiaddr = 10.0.0.228
siaddr = 10.0.0.78
giaddr = 0.0.0.0
chaddr = 0:1c:b3:b0:e2:d5
sname =
file =
options:
Options count is 9
dhcpmessagetype (uint8): ACK 0x5
server_identifier (ip): 10.0.0.78
lease_time (uint32): 0x5a0
subnet_mask (ip): 255.255.255.0
router (ip_mult): {10.0.0.1}
domainnameserver (ip_mult): {10.0.0.9}
domain_name (string): mydomain.de
ldap_url (string): ldaps://ldap.mydomain.de:636/dc=mydomain,dc=de
end (none):
So far so good.
But the ldap-server never got used.
dscl localhost list /LDAPv3 on the mac-client shows emtpy results, and
on the wire there is absolutely no traffic to ldap.mydomain.de.
In fact the mac-client completely
ignores the dhcp-provided settings. Of course I've enabled the
Setting "Add DHCP-supplied LDAP servers to automatic search policies" on
the client.
I've tried to trace the problem on the client-side by doing
sudo ipconfig setverbose 1
touch /Library/Preferences/DirectoryService/.DSLogAtStart
and looking into /Library/Logs/DirectoryService/DirectoryService.debug.log , /var/log/system.log
and /var/log/com.apple.IPConfiguration.bootp but there is no hint why the client is not using the published ldap-settings.
It must be some problem on the mac-side.
Can anybody give a hint howto solve this problem?
Thanks
Christian

Answer 1

I have not tried to set this up using the command line (as you described), but have in the past done it using "Server Manager" (on the server) and "Directory Access" on a Mac OS X 10.4.x client.
When I did this I found that Macs after booting would not show a list of network login acocunts (as they should have) and typically trying to login using 'other' would fail. Also typically after a minute or two (and several attempts) it usually did work. AppleCare's suggested workaround at the time was to not use DHCP to advertise the OpenDirectory but to instead manually define it on the clients (using Directory Access).
My belief as to why it did not work is that when a Mac boots, it enables its network interface, asks the DHCP server for an address (and the LDAP details) and then in theory should continue to boot and connect to the LDAP server. However I believe that the timing of these events is such that the Mac goes past the LDAP stage before it has finished the DHCP stage and as a result does not have the LDAP information in time. By manually defining the LDAP (OpenDirectory) server in Directory Access it is already known in advance and you avoid this problem.
I have seen nothing to suggest that Leopard is any different in this area (although my recollection is that Panther - Mac OS X 10.3) did not have this problem.
So I use a manually defined entry on all our computers, and I have incorporated this in to the standard disk image I use to build all the new computers.