Network user accounts - what is a good path going forward?

Our network and use is almost exactly as you describe including FileMaker. We have a dozen users and need them to be able to log into any of our client machines across two separate locations. We are on High Sierra for both the server and clients because we still need Messages.app and Server.app to use and host the Jabber server. We were using Network Home Directories and had all of the problems the John refers to continually cropping up. Management of problems became a nearly daily bother.

Our solution was to copy the userhome of all of the users to each of the client machines and to set the userhome location as "local" in Server.app. Using this method, the server still authenticates the user but all details are stored on the client machine as of the time of the copy. This way none of the existing users need to reset or re-enter settings. The most notable drawbacks are that the content of the userhomes will gradually diverge over time and that any changes to services will need to be updated on all of the clients. Secondarily, new users will need to add their settings on several machines or the admin will need to move copies of the newly set up userhome to the other client machines. We placed folders in a file-share for each user to have a centralized place to put their files since the userhome was no longer centralized. This method also allows for multiple users to be logged into a client concurrently since the userhomes are all local to the client machine.

While it has not been as convenient as a properly working Network Home Directory system, we have had no functionality issues since making the change and the maintenance problem has totally disappeared. The biggest issue has been our staff trying to remember not to leave files on their Desktop or in Downloads if they wanted access from another machine at another time.

-Erich

Apple over years gradually made using Network Home Directories less and less practical. Realistically there are so many problems that even if hypothetically it is still possible with Mojave the likely pain is simply to great.

One major area (amongst many issues) is that when Apple introduced iCloud Keychain syncing they also introduced the 'local items' keychain. This resides in a folder with a name that matches the unique UUID number of the Mac when this gets created. Therefore when you login on a different Mac it is not valid for that other Mac and hence you cannot access that keychain. This keychain is used for all Apple's programs i.e. Mail, Calendar, Contacts and Safari. Apple also switched more and more things to using SQLite databases instead of plist files and SQLite does not like accessing its database files on a network share and often will corrupt these files. Guess what the 'local items' keychain is - an SQLite database!

With regards to FileMaker a possible workaround would be to use the web-browser client to FileMaker. This would let you upgrade the FileMaker server but use an older Mac and let it access FileMaker via a web-browser.

Another approach to consider but which will require some work is to use a 'Terminal Server' style approach. You would have client Macs very stripped down - maybe even only using Guest logins and then run a Terminal Server connection to a Mac server and run their main environment from that. This way they could login from any Mac and access the same Terminal Server.

There would be two possible approaches for doing the Terminal Server approach -

1. If you use Screen Sharing from a client Mac to the server you can have more than one person connect at the same time using different logins and each person sees a different window.
2. There is some software specifically aimed at doing this, see https://www.aquaconnect.net/ and https://www.nuords.com/products/nuords-ts/ check the details of this thoroughly, it maybe that one or both may not be compatible with the latest versions of macOS

Note: Some applications do not allow being run more than once e.g. by the multiple logins listed above. However I would expect most would. A workaround would be to make duplicate copies perhaps in users home directories e.g. ~/Applications

@Eric Wetzel

Your approach could be considered to be half way between a 'mobile account' and a 'portable home directory account'. For those unaware Portable Home Directories were officially discontinued with MacOS Sierra.

A mobile account syncs credentials to a directory server but not the home directory, and a portable home directory account synced both the credentials and home directory contents. It is presumed Apple discontinued PHDs due to never being able to make the syncing process reliable.

In theory you could use an alternative tool to do the syncing, e.g. ChronoSync - https://www.econtechnologies.com/chronosync/overview.html however this will still leave the issue of the dreaded 'local items' keychain raising its ugly head. It maybe that by adding a script to the ChronoSync setup you could automate the renaming of the local items keychain folder. The script could lookup the UUID of the Mac during the syncing.