Previous 1 2 Next 24 Replies Latest reply: Oct 3, 2012 2:22 PM by robfromupland
Alfista_SK Level 1 Level 1 (0 points)

I have an Active directory server (win 2003) where I have stored all users. To this system I have binded mac server (Lion 10.7.4) with Open directory for mac clients, witch are stored on AD server too. I have bind the client macs to the mac OD server, to use all advanteges of this server, but when I will to login in login window on client mac I becomme only shaking. When i connect for sharing or directly on mac server all is working.

 

I have tested to change the the home directory from AD server to OD server over sharing but without change.

I try to augment users, without change too and Iwas unable to change the home directry.

When I bind directly client system to the AD server all is working...

 

Can anybody help me what should I do, that I can log from client sytem to OD server and that the OD server stores the home directoryfor the users with will connect from client macs?


Mac OS X (10.7.4)
  • Thanzig Level 1 Level 1 (0 points)

    Are you saying that you can properly bind the Mac's to AD but the home directory is not mounting?

  • Mike Vos Level 1 Level 1 (15 points)

    Did you try to import the users from the AD to your OD so they authenticate via your OD?

  • Alfista_SK Level 1 Level 1 (0 points)

    Yes (but only via system preferences/users, other wasn't working), I have bounded the servers, but have problems with it. When I use users maked on OD all is working properly, bud when I will use the AD user over OD server, there are the problems.

    The mounting problem was only when I on AD server set the home folder via sharing to OD server and client log, that to mount the home folder he must give the password again but there was only shaking like on normal seted system.

    I read if I use augmented user, I can change the home directory and some other parameters and all is OK, but on Lion can't I (don't know, there are not the posibilities like in a Snow Leopard) to change the parameters in augmented users. So I have only the shaking by loging on client mac.

    I don't know where is the real problem, I'm new in this and I need to solve this problem. I set the system like in apples trainig videos and other manuals, I do all what was written but all was made for Snow leopard and in Lion is it others.

     

    No I don't import users I only to try to augment it, so that they are stored on AD server and only security is managed there and all others is managed vis OD server.

    Is than needed after import to have binded the servers? How can I import it and what happens if they are on both servers or what I need to do so that where later no conflicts and admin have the easest way to create and manage all servers.

     

    Thanks guys for help.

  • Mike Vos Level 1 Level 1 (15 points)

    Bind the Mac's to your AD aswell.

    This allows you to log in via AD and create a local user.

    Binding the Lion Server also lets you assign permissions to AFP shares and other services for AD users.

  • Alfista_SK Level 1 Level 1 (0 points)

    Thanks, I have this tested, but i need accounts stored on server.

     

    How can I import users and what happens if they are on both servers or what I need to do so that where later no conflicts and admin have the easest way to create and manage all servers.

     

    The augmenting is good way, but I don't know why they won't work. I thing all is in the home foldes ...

     

    I found that the home folders for augmented users are stored in "/var/empty" ... this is bad and can't change it ...

  • Mike Vos Level 1 Level 1 (15 points)

    Have you tried adding the AD users to a local (OD) group?

    This won't import the users, but gives them the option to login and use services..

  • Alfista_SK Level 1 Level 1 (0 points)

    Yes I have it, but no change.

    From my tests and lookups, I think that, there is a problem with home folder. OD server is wrong interpreting the AD home folder, or can't change the AD's home folder to his. I try to change it manualy but with no change.

  • Mike Vos Level 1 Level 1 (15 points)

    This might be helpful for you. Found this somewhere else on this forum.

     

    Setting up a new Lion OS X Server

    1. Change the Shared name
      1. apple >> System Preferences >> Sharing
      2. enter a name like: server-mac
    2. Give a Static Address
      1. apple >> System Preferences >> Network
    3. Download Lion OS X Server app from the app store (not through itunes)
    4. Download Server Admin Tools for Lion (this can be found via google)
    5. install both and run apple >> Software Update

    Binding

    1. apple >> System Preferences >> Users & Groups
      1. Unlock the padlock
      2. Click Open Login Options
      3. Click Join
      4. Click Directory Utility
        1. Double click Active Directory
        2. for domain, enter: DOMAIN.LOCAL
        3. Click the triangle next to Show Advanced Options
          1. Click User Experience
            1. Check mark symbolCreate mobile account at login
              1. Remove: require confirmation box
            2. Remove: Use UNC path box
            3. Check mark symbol Default user shell: /bin/bash
          2. Click Administrative
            1. Check mark symbol Prefer this domain server: ADserver.domain.local
            2. Check mark symbol Allow administration by (leave defaults)
            3. Remove: Allow authentication from any domain in the forest
          3. Click ok

    Create Open Directory Masteropen Server Admin

    1. Connect to server-mac.local (or enter the static address)
      1. Highlight the local server and click Settings
      2. Click Services
        1. Check mark symbolOpen Directory
        2. Click Open Directory under server-mac.local (or static address)
        3. Click General
        4. Under Role, click Change
        5. Select Remain connected and setup as Open Directory Master
        6. Create user called: Diradmin

    Changing Login Options

    1. apple >> System Preferences >> Users & Groups
    2. Click Login Options
    3. Under: Display login window as, select Name and password radio button
    4. Check mark symbolAllow network users to log in at login window
      1. Select: Options
      2. Select: Only these network users radio button
      3. Click +
      4. Under Network Users:
        1. select those who you want to be able to log into this server

    Adjust the Date and Time

    1. Click the time in the upper right corner
      1. Click Open Date & Time Preferences...
      2. Click Date & Time tab
      3. Check mark symbol Set date and time automatically: ntpserver.domain.local

     

    Add a Mac Client to the  Open Directory

     

    1. Go to System Preferences >> Users & Groups
      1. Unlock the padlock
      2. Click Login Options
      3. Click Join
        1. Type in the ip address of the mac server
        2. Press ok
        3. It will tell you "This server provides SSL certificates.  Do you want to trust the certificates....  Choose Trust.
        4. Server does not provide a secure SSL connection.  Do you want to continue?   Choose Continue
      4. Should be done!!  Woot!!

    Decide who can get onto the box.2.  Go to System Preferences >> Users & Groups

    1. Unlock the padlock
    2. Click Login Options / Options / Choose "Only these network users:"  Then choose the individuals from the open directory that you want to allow access to.

     

    Binding a Client Mac to Active Directory and Open Directory

    1. apple >> System Preferences >> Users & Groups
      1. Unlock the padlock
      2. Click Login Options
      3. Click Join
        1. Enter in the Mac server name or ip address
        2. dont enter any credentials if asked (bind anonymously)
        3. Press ok
      4. Click Join
        1. Double click Active Directory
        2. for domain, enter: DOMAIN.LOCAL
        3. Click the triangle next to Show Advanced Options
          1. Click User Experience
            1. Check mark symbolCreate mobile account at login
              1. Remove: require confirmation box
            2. Remove: Use UNC path box
            3. Check mark symbol Default user shell: /bin/bash
          2. Click Administrative
            1. Check mark symbol Prefer this domain server: adserver.domain.local
            2. Check mark symbol Allow administration by (leave defaults)
            3. Remove: Allow authentication from any domain in the forest
          3. Click ok
  • Mike Vos Level 1 Level 1 (15 points)

    Also, have you set the mac clients to prefer the AD?

  • Alfista_SK Level 1 Level 1 (0 points)

    Thanks, I have done everithing is here written, without the time. I don't have time server, so i'm synchronised from apple server.

    Only one thing I have others. My clien mac is bound to teh OD server and not to the AD server. When I bind to teh AD server all is working corectly but I have only local home folders. I try to bound to both sesvers and the result was the same like with binding on AD server.

    I need the OD server to manage the Mac client's, so I have a question. If I bind client to both system, can I manage the clients from OD server? And how I will have the network accounts?

  • Alfista_SK Level 1 Level 1 (0 points)

    You mean in Directory Utility -> Search (both)?

  • Mike Vos Level 1 Level 1 (15 points)

    Exactly.

    Within Directory Utility there is a checkbox that says to force local user home folders. Uncheck that.

    Also in Directory Utility under the tab 'Search policy'. Make sure your AD is first in line (so the top one).

    This makes sure that authentication goes to your AD first.

  • Alfista_SK Level 1 Level 1 (0 points)

    I have unchecked but I have only the the home folders localy ... :-(

     

    On server I have it, but on client not, but when I bind AD server too I don't have the login problems, I log but only with home folder ("force local user home folders" uncheked) ...

     

    Now it's the same like when I have only AD server bound. Is there any diferences when I have both server binded?

     

    And it's needed to have cheked the mobile folder? I don't need it.

  • Mike Vos Level 1 Level 1 (15 points)

    If you bind both servers, your Mac is able to use both servers services.

     

    So if I understand correctly, binding the AD to your Mac, allows you to log in, but uses a local home folder?

     

    Try renaming the home folder to 'username_old' and see what happens when logging in.

Previous 1 2 Next