Problem setting up Network User

Question

Level 1

9 points

Problem setting up Network User

I am running Mac OS X 10.5 Server with clients running 10.5 also. Currently, there are several users on the server, but in Workgroup Manager, their home directory is set to null. The users have local accounts on certain 10.5 clients which are linked to their accounts on the server. So when they log in to the client, they are authenticated against their account on the server, and various settings (Mail, iCal) are picked up from the server.

I now need to allow users to log in to any client machine without setting up a local account (and linking it to the server account) first. So I have gone through the procedures specified in the 'User Management v10.5' documentation, specifically the 'Administering Share Points' and 'Administering Home Folders -> Creating a Network Home Folder' sections. I have used the second set of procedures to create a network home folder for a single test user. I assume that this makes the test user a 'Network User', though how to create a 'Network User' is not explicitly specified anywhere.

The problem is that on a client machine (that does not have a local account for the test user), the test user's network account is not listed on the login screen (though the login settings indicate it should be), and I also cannot log in as the test user by clicking on 'Other...' and supplying the requisite credentials. I should note that the client Mac is 'attached' to the server (eg. through Directory Utility).

Can anyone provide advice as to what's going wrong? Is there some other (secret?!) step that is needed to create a Network User so that clients see the user and allow the user to login?

Many, many thanks,
Jolin

Posted on May 12, 2010 9:17 AM

Reply

Answer 1

May 13, 2010 2:42 AM in response to Jolin Warren

First:

The only way of "linking" a "local" account on a computer to a OpenDirectory account that I know of is to create the "network" account homefolder on the local/client machine HD when the user is logging in to the OD server for the first time. I belive the OD account home folder settings should be pointing to /Users/~

The client machine has to be bound to OD first and the account should preferably be setup as a mobile account (so the account can be used even if the computer isn't connected to the network - logins are cached locally).

Creating the "network" account homefolder on the local/client machine HD is the default for macs bound to an AD.

Second:

For a "true network home" folder residing only on a server volume/share, the OD account should use a share(point) setup in Server Admin for an automount AFP (or NFS) "User home folders" share.

Then in the OD the user should be setup to use the automatically created path (afp://<server FQDN>/<shared folder>) as it's homefolder path.

This is also the basis for a mobile account (homefolder is automatically copied from the server to the client machine when first enabled) that syncs with a true network home folder.

HTH

Reply

Answer 2

Jolin Warren Author

Level 1

9 points

May 13, 2010 4:54 AM in response to Leif Carlsson

Hi Leif,

Many thanks for your reply.

Leif Carlsson wrote:
The only way of "linking" a "local" account on a computer to a OpenDirectory account that I know of is to create the "network" account homefolder on the local/client machine HD when the user is logging in to the OD server for the first time.

Actually, it is possible to not have a network account or home folder, and link a local user to a user account on the server. When a client computer is bound to the OpenDirectory server, in the 'Accounts' preference pane of the client computer, there is a field called 'Server Account:' with a 'Set…' button. Clicking the 'Set…' button allows one to link the local account to the server account. Even though there is no home directory on the server, when the user logs in to the client Mac, the password and any managed preferences for that account are taken from the server account.

The client machine has to be bound to OD first and the account should preferably be setup as a mobile account (so the account can be used even if the computer isn't connected to the network - logins are cached locally).

I have bound the client machine to the OD server, but I have not yet set up the account as a mobile account. I plan to do this eventually, but wanted to get the 'basic' network user account working first.

For a "true network home" folder residing only on a server volume/share, the OD account should use a share(point) setup in Server Admin for an automount AFP (or NFS) "User home folders" share.

I have done this. The server has a sharepoint called 'Homes' which is set to automount over AFP, with the setting 'Use for: User home folders and group folders'. This seems to be working, because on the client Mac, the 'Homes' sharepoint automatically appears when browsing the available network volumes.

Then in the OD the user should be setup to use the automatically created path (afp://<server FQDN>/<shared folder>) as it's homefolder path.

I believe I've done this as well, using Workgroup Manager. When viewing the 'Basic' tab of the user, the 'Home:' is given as 'afp://<server FQDN>/Homes/jwarren'. That looks right to me, but I cannot login as the user 'jwarren' from the client Mac's login screen (Network Users are enabled on the client Mac). When I log in as a different user on the client Mac, I can browse the network, and the above afp path is automatically mounted.

Is there some other setting needed so that the client Mac will 'see' the network user I have set up? As I say, the autmount sharepoint is set up, and the user is set up in OpenDirectory (on the server) to have a home folder on the automount. But when I'm at the login screen on the client Mac, the network user does not appear in the list, and if I try to login by typing the username and password manually, the login window just shakes as it does when one enters the incorrect password.

Any further help much appreciated!

Reply

Answer 3

Jolin Warren Author

Level 1

9 points

May 13, 2010 6:57 AM in response to Jolin Warren

posted in the wrong place…

Reply

Answer 4

Jolin Warren Author

Level 1

9 points

May 13, 2010 6:57 AM in response to Jolin Warren

I found the solution to my problem and thought I'd post it here in case others have a similar issue...

The user (jwarren) which I had made into a Network User had their 'Login Shell' set to 'None' in the 'Advanced' tab of Workgroup Manager. The account was initially created using Server Preferences, and this is the default setting it creates. Changing the shell to something else (/bin/tcsh in my case) fixed everything. The user shows up as a Network User in login lists, and entering the password logs in.

It was an easy solution, but not documented anywhere. I realise that this might seem obvious in hindsight, but I think of the login shell as only being important for the Unix underpinnings (eg. using Terminal or ssh'ing in). I can understand now that a user needs a login shell even to log into the graphical interface.

Cheers,
Jolin

Reply

Answer 5

Jun 9, 2010 5:50 PM in response to Jolin Warren

Jolin Warren wrote:
Hi Leif,

Many thanks for your reply.

Leif Carlsson wrote:
The only way of "linking" a "local" account on a computer to a OpenDirectory account that I know of is to create the "network" account homefolder on the local/client machine HD when the user is logging in to the OD server for the first time.

Actually, it is possible to not have a network account or home folder, and link a local user to a user account on the server. When a client computer is bound to the OpenDirectory server, in the 'Accounts' preference pane of the client computer, there is a field called 'Server Account:' with a 'Set…' button. Clicking the 'Set…' button allows one to link the local account to the server account. Even though there is no home directory on the server, when the user logs in to the client Mac, the password and any managed preferences for that account are taken from the server account.

Can you tell me how you showed the "Server Account" option? I searched for hours and cannot find it. We are struggling with "linking" local users to OD users. Is it possible to get your contact for some help? Much apprecaite it.

Reply