Lion Server not reading Active Directory Groups reliably

Question

Level 1

59 points

Lion Server not reading Active Directory Groups reliably

I am trying to upgrade one of our XServes from Snow Leopard Server to Lion Server and am running into a strange issue with our Active Directory based users and Groups.

The current Snow Leopard Server serving files from a XSan volume is running fine, though we find a very long Lag time for Windows users to connect. Once a few users have connected the lag seems to go away, but it is still not nearly as fast as Mac users connecting or Windows connecting to a PC server.

So I have connected a second Xserve to the SAN and performed a clean install of Lion Server. Initially while it would find my Active Directory Groups it would not import any of the users, so obvioulsly no one could connect. In a last ditch effort I installed the beta of 10.7.4, which seemed to resolve the issue for a small group of test users. However as I expanded the test I found that some users would get a message that the were no resources available to them, or they didn't have the correct permissions. This is very strange as everyone is in the same group so should have the same permissions. As a test I took one of the user accounts and created a new share and gave him R/W permission to that share and suddenly all of the shares that he should have had permission to in the first place popped up.

The only thing that I can think of is that we have such a large Active Directory structure that the authentication is timing out or reaching some user limit and stops looking. (we have over 50,000 users and thousands of groups spread through multiple OUs in the AD structure)

The new Server.app in Lion looks nice, but it does not seem to have nearly the robustness of the previous Server Admin tools. For instance, I never needed or wanted to setup a "Golden Triangle" but with Lion it is required. Perviously I could search for AD users or groups and drag them from the search window to the share to assign permission, now even though I've imported the groups and users it needs to search the entire directory when assigning permissions - why can't it see the groups that are already there? Why can I run a dscl search and find a user or group instantly, but the Server.app hangs for 5 minutes and shows 0 results?

Has anyone found a way to make Lion Server work in an enterprise environment?

Posted on May 1, 2012 11:07 AM

Reply

Answer 1

all-mac

Level 1

0 points

May 4, 2012 6:44 AM in response to Jason Bracy

Server Admin Tools... like before. You need to update after install this version.

http://support.apple.com/kb/DL1419

Reply

Answer 2

Jason Bracy Author

Level 1

59 points

May 4, 2012 7:04 AM in response to all-mac

I'm using the latest version of Server Admin Tools (10.7.4 from ADC) However in 10.7 the Server Admin app no longer controls File Sharing. That is all done with the new dumbed down Server.app.

Reply

Answer 3

marbles1

Level 1

0 points

Jun 14, 2012 7:23 AM in response to Jason Bracy

Yesterday morning I bound a 10.7.4 server to our AD, and in the afternoon I eventually saw all the AD users, groups, etc show in Workgroup Manager. Now, with dscl, I can see all the AD user and group records, and with Workgroup Manager, I can search the groups, users, and computers, but with the Server.app, when trying to create new group of the type "Imported group from another directory", the searches returned nothing. Directory Utility can show all the AD information also. Our AD has thousands of user record, and so it is reasonable that it may take some time for the Mac server to get all the info. But from the add users or groups interface, I just could not get any search results. What could be wrong then?

Reply

Answer 4

furby

Level 1

39 points

Jun 14, 2012 8:47 AM in response to Jason Bracy

Jason Bracy wrote:

Has anyone found a way to make Lion Server work in an enterprise environment?

Haha, not yet. I feel like there's some some sort of conflict with it searching security/distribution groups and OU groups. When I import a group of users only one user seems to come in out of hundreds and oddly the one that is in the Users OU and not nested within another.

Reply