I made some progress in the command-line, but it still doesn't work right. Using Workgroup Manager, I found a user account in the LDAP directory called testuser and exported it to a file. I made a preset in Workgroup Manager for login shell, default group, etc and called it presetLDAP. Then
dsimport [path/to/file...] /LDAPv3/127.0.0.1 I --startid 1025 --groupid 20 --outputfile ./Server_Import_Log.plist --userpreset presetLDAP --username diradmin
Now testuser appears in Server.app, and I can give it permission to various services, but it can't actually login. I've tried AFP, SSH, and wiki, and I always get an invalid password error. My goal is for the password to come from LDAP of course. Apple documentation says imported directory users should have the symbol
, while local directory users have the symbol 
. My freshly-imported testuser has the latter symbol, which is a bad sign. Also, according to this great book, when exporting users from Workgroup Manager,
"User passwords are never exported, so anytime you export and then later import users from a file, you will need to set their passwords after you import the users. "
This seems to be correct, because if I reset testuser's password, it can login correctly. But this defeats the purpose of using LDAP, which is for users to use a global password for all servers. There's something different about dsimport and the Server.app import process. I do notice the following in Console, when trying to import a user through Server.app. It's very strange how similar those arguments are to those of dsimport, but they're not quite the same. I still want to find the command-line version of whatever Server.app is doing.
5/5/12 8:53:36.919 PM Server: about to launch import tool. theArgs is: (
"/Users/Shared/testuserexportfile",
"/LDAPv3/127.0.0.1",
I,
"-s",
1025,
"-r",
20,
"-v",
"--outputfile",
"/tmp/Server_Import_Log.plist"
)
By the way, it seems like my preset was ignored completely by dsimport; I probably don't know the right format for this option.
