Want OD authentication for logins, but need home folders stored locally

Question

Real quick...
How does one configure Open Directory to allow for users to login to their computers using a network/LDAP authentication, but have their home folders stored locally on their computers. I know how to do this when bound to AD, but can't figure it out using OS X's OD.
Would I set it up the server role to "Standalone Server"? Do the computers need to be bound to AD in order to create "mobile accounts? I don't want them to be able to move from computer to compouter, so I don't need synchronization, just to enforce password policies
Thanks!
T

Answer 1

Hi
@ Templeton
You may find this useful as this is what I have done before in the past. It’s worked for me. There may be other methods that can be used?
Create an admin account on the client computer and then create an account in the LDAP node in WGM with same name and password. If the account already exists on the client computer then all you need do is the latter. Don’t create a Home Folder as this will be created automatically later on. Launch Directory Access and bind to the server.
It seems to work better if the Server is running DHCP Services although it works OK using static. I have seen authentication problems where an AD Server is providing DHCP Services so bear that in mind – in theory it should work – as ever it depends on how well DNS Services are configured.
As soon as you bind the edu.mit.Kerberos file is created in /Library/Preferences. AS_REQ and ISSUE has done its business and as far as the server is concerned the client is intially authenticated. It will request further pre-authentication later on. You should see this feedback if you consult the kdc.log. If the client connects to the server to access a server based service using the normal methods he/she will receive the Kerberos login window prompt. The user name and Realm will already be filled in. Supply the password and you should then be presented with a list of shares you can access including the home folder. If you select the home folder it will mount on the local desktop and be automatically populated with the usual folders. Of course you don’t have to do this if you don’t want to. That’s it the client has its day ticket for the day and can use the local home folder as normal.
@ Mike
This can be a tricky thing to administer and keep track of, especially if local client account names and passwords don’t match what is on the Server. For 300 Users or more its a lot of work. I had a similar experience myself and as usual cursed myself for not anticipating this need when the server was first deployed. Perhaps Apple may build something into Leopard that can facilitate this need?
Tony