Possible AD/OD integration

Question

Level 1

11 points

Possible AD/OD integration

Is it possible to bind Open Directory to Active Directory and have Windows user accounts in AD and Mac user Accounts in OD?

Mac OS X (10.5)

Posted on Oct 4, 2009 6:21 PM

Reply

Answer 1

Andbrowny

Level 4

1,614 points

Oct 4, 2009 6:34 PM in response to pknz4

Hi PKNZ,You can quite easily bind OS X Server to an Active Directory Domain and share resources and users but I'm not sure why you would want to segregate the users, doesn't that defeat the purpose?
Maybe if you describe what you want to achieve you may get further.

I have seen dual directory systems set up and users exist in one or both directories, but usually it is not pretty either to set up or to admin.

BTW Welcome to discussions.

Cheers

Reply

Answer 2

pknz4 Author

Level 1

11 points

Oct 4, 2009 6:58 PM in response to Andbrowny

Thanks for the welcome.

All users exist in Open Directory, the Windows users in Open Directory are duplicated into Active Directory so they can access Windows servers on AD and Mac servers on OD. (AD and OD are not bound).

I would like to bind Open Directory to Active Directory so that the Windows users only exist in Active Directory (no duplication) and can access the Mac servers on Open Directory.

Message was edited by: PKNZ

Reply

Answer 3

Andbrowny

Level 4

1,614 points

Oct 4, 2009 7:09 PM in response to pknz4

Hmm, seems more like you're looking at a cross realm trust setup rather than binding the domains.
Last line of this article says "Clients should choose the Open Directory realm at the Windows login screen, and log in with their Open Directory password. The tgt from the Open Directory Realm will allow them to access resources in the Active Directory domain." Is that what you're looking at?

Then again I could have missed the boat completely....

Cheers

Reply

Answer 4

Oct 5, 2009 9:35 AM in response to pknz4

You should be able to bind OD to AD and set up a Magic Triangle (dual directory). Apple outlines the different integration options, this being one of them, in their "Best Practices: Integrating Mac OS X with Active Directory" (last updated April 2009):

http://www.apple.com/business/resources/

Don

Reply

Answer 5

Andbrowny

Level 4

1,614 points

Oct 5, 2009 1:21 PM in response to don montalvo

Hi Don, the Magic Triangle (dual directory) setup you are referring to is usually used to manage OSX machines and groups through the OD and have all the user info from AD, except augmented records. If I'm not mistaken, the OP is wanting OD/OSX users and Windows/AD users stored in the respective directories/domains without having the windows users in OD.

Cheers

Reply

Answer 6

pknz4 Author

Level 1

11 points

Oct 5, 2009 1:21 PM in response to don montalvo

I read through Apple's +Best Practices: Integrating Mac OS X with Active Directory+

The 'magic triangle' they suggest mentions that

"Another solution is to configure a secondary LDAP directory using Mac OS X Server and Apple’s Open Directory. In this scenario, clients still use AD for user authentication, while Open Directory supplies managed preferences only."

I would like for the Mac users to only exist in Open Directory and the Windows users to only exist in Active Directory, but as they are bound, the Windows users in Active Directory filter down into the bound Open Directory.

Reply

Answer 7

Oct 5, 2009 2:17 PM in response to Andbrowny

Yes, my apologies, I misunderstood the OP.

Don

Reply