Q: Network users won't log in
-
by Grant Bennet-Alder,Aug 27, 2015 8:09 AM
Grant Bennet-Alder
Aug 27, 2015 8:09 AM
in response to limavadyhigh
Level 9
(61,073 points)
DesktopsFirst, you need to know about this potential problem:
OS X Server: Don't log in to the server with a network user's account - Apple Support
.
-
Aug 27, 2015 8:18 AMby limavadyhigh,Thanks Grant. The only user logged into the Server is the admin account. The issue I seem to have is network users logging into client machines. Some Macs accept the log in details, some don't, but all the important details (DNS etc) are the same. Network login is enabled in System prefs too, and there's a green light so it can see the Mac server OK.
-
by Grant Bennet-Alder,Aug 27, 2015 8:34 AM
Grant Bennet-Alder
Aug 27, 2015 8:34 AM
in response to limavadyhigh
Level 9
(61,073 points)
Desktops
Ok, try this:
From a Workstation Mac, run Network Utility.app (if not found in /Applications/Utilities look for it in /System/Library/CoreServices/Applications )
using the Lookup pane, enter YOUR fully-qualified server.mydomain.com name.
It should look up to a local IP address.
enter the local IP Address. it should look up to the fully-qualified 3-part domain-name
using xxxxx.local as the bona-fide name of your server will cause you no end of grief, because that ending is now more strongly reserved for Bonjour.
-
Aug 28, 2015 8:33 AMby limavadyhigh,Hi Grant, thanks for getting back to me. I've run Network Utilities and entered the info you suggested. The following appears:
Lookup has started…
mia.limavadyhighschool.private -> 10.63.200.2
Lookup has started…
10.63.200.2 -> mia.limavadyhighschool.private
I can't understand why it won't accept network users. There are no settings disabled within System Prefs or the Profiles I've created. From looking at my ethernet details the IP address (configured manually) is OK, it's pulling in the correct Subnet Mask, Router, DNS Server and Search Domain. Login Options also show the correct account server with a Green dot beside it, network users are also allowed to log in.
When typing in details at the login screen the password field just shakes, as if it's wrong (which it isn't). Something I noticed is "Network login unavailable" appears for a few seconds after booting up, then disappears. I read somewhere on the community that it was considered normal. Local users, saved on the machine, can log in fine. Would it be something wrong with OD?
When logging in as admin I can access the internet, browse share files/folders, it detects my Server connected TimeMachine backup drive etc.
Any suggestions?
-
by Grant Bennet-Alder,Aug 28, 2015 8:52 AM
Grant Bennet-Alder
Aug 28, 2015 8:52 AM
in response to limavadyhigh
Level 9
(61,073 points)
Desktops
The DNS for each Workstation's Network connection must reference the local DNS FIRST, so that you are sure that those references continue to resolve correctly.
The Server must be bound to itself ONLY with a numeric 127.0.0.1 IP address, and must also have a green light in Login Options pane of Users & Groups.
"Network login unavailable"
not a problem as long as it goes away promptly after login.
When Binding each workstation in Users & groups -- In Directory Utility, I seem to get better results on each workstation by specifying "OD Server" and the explicit fields, but it should still work with "From Server" and the defaults.
-
Sep 1, 2015 10:06 AMby lutraruud,I have the same issue. Somehow it seemed to be linked to the place of the home folders. I found that network user home folders shouldn't be in the "users" folder on the server, but in a separate root folder/share on the server disk. Home folders on another internal drive didn't work (I have a mac mini server with two drives).
Hope this helps you, although it should be possible to put home folders anywhere.
Ruud
-
by Grant Bennet-Alder,Sep 1, 2015 10:12 AM
Grant Bennet-Alder
Sep 1, 2015 10:12 AM
in response to limavadyhigh
Level 9
(61,073 points)
Desktops
I can't understand why it won't accept network users.
You can no longer use .private or .local as your fully-qualified domain name. It messes a lot of things up.
-
Sep 2, 2015 12:41 AMby limavadyhigh,Hi Grant, apologies for the late reply. The building was closed on Monday.
We have 2 DNS supplied to us by our network provider, allowing connection to proxy internet. I've set it up that the server (local) DNS is first, followed by the other two records. Server is bound to itself and has a green light in Login Options pane. As you said "Network login unavailable" does go away on most machines, it's stuck on a few - with a red dot - and after login to the admin account the server has stopped responding. Rebinding to the OD, without authentication, seems to solve the issue. Out of curiosity do you know why that would happen?
-
Sep 2, 2015 12:44 AMby limavadyhigh,Thanks Ruud, I'll check that out to see if it makes any difference. So you're suggesting set up Local Network Users with home folders in a share on the root of the drive? How would that work if I use PM to configure accounts are saved locally on the Macs and not synced? Essentially all I need to network user account to do is log in to a Mac and create an account without me having to manually add 100+ pupils.
-
Sep 2, 2015 8:24 AMby Grant Bennet-Alder,I have a Share Point for Local network users that is NOT on the boot Drive. I keep them on a Mirrored RAID pair that is backed up with Time Machine.
It works fine in the latest Server and always has as far back as 10.3 Leopard Server. (except Time Machine support is more recent).
It may be that for Sharing-only users (with no Server-based Home folder) your Share points need to be NOT on a Share Point marked with:
[√] Make available for Home Directories over: _{AFP, SMB }____
-
Sep 2, 2015 2:35 PMby lutraruud,I don't understand it either. It should be possible according to the specs. I have called Apple support, but they couldn't give me an answer yet. By the way: what do you mean by .local and .private are no longer valid? The server comes up with these names. What should I use instead?
Ruud
-
Sep 2, 2015 3:25 PMby Grant Bennet-Alder,The Sharing Control panel says you can connect to your computer_name by adding .local to it (because Bonjour treats it that way).
But that is Not a valid three part domain-name like server.example.com, and you should not be entering anything with .private or .local into your DNS. It WILL screw things up.
-
Sep 4, 2015 8:41 AMby lutraruud,I don't have experience with PM. It is difficult enough to do the straighforward things and get a stable situation. I might have misinterpreted your issue, so my comment may not be valid. For me it didn't work when I put the homefolders in a share on a drive that was not the drive with system on it. It worked only with a root share on the drive with the system folders on it.
-
Sep 4, 2015 8:44 AMby lutraruud,Hi Grant,
This is interesting. Do you refer to the input in the DNS service on the server? What would you recommend as valid? Actually I'm thinking of shutting down the DNS service and only use the IP address for the local network. I have some clients connecting with that and it seems to work, although I still have issues and the DNS service is on.
Ruud
