Directory server external commands

Jonathan,

I have been trying to solve this puzzle for a few days now with no luck.

I contacted Apple Enterprise support and made it to a senior advisor who said he would ask some of the engineers. At first they wanted me to create a support contract, but I countered that I just purchased Server 3.0 and this is an undocumented change.

We aren't asking for help on configruing OD to work with 3rd party products - I just need to know if the ExternalCommand functionality has been removed completely or has been migrated (again) to a different area.

I'll let you know if I come up with something in the meantime...

Ron

Jon

This is a no go. I dead ended with Enterprise Support when they wanted $695 to answer a yes or no question. Disappointed to say the least.

At this stage I'm looking at setting up a standalone LDAP server to sync with GADS and giving its users access to the OS X services we need. Not an ideal solution, but what can ya do?

This is a big deal and we need a work around. We have no way to sync Open Directory to Google at this point. I can't get the password SHA1 hash from LDAP so I can't use Google's own "Google Apps Directory Sync" and the externalcommand was the only way to send hashes to Google. Without this functionality I'm left with very few options. Has anyone been successful in figuring out a way to hook in an external password script?

Thanks

I agree. I'm extremely disappointed by the response I got from Apple Engineering. They acted as if no one in the world is using this ExternalCommand and they would have to really look into what happened to it in Server 3.0. I showed them various blog posts and reputable academic organizations that are using it to sync with Google Apps via GADS and they kept insisting it was a custom third party configuration which required a support contract.

I made it absolutely clear that I did not want their help in setting up or configuring or troubleshooting whatever I did with ExternalCommand, I just wanted to know where it went in 3.0.

I probably wasted 20 hours of work trying to return pre-3.0 fucntionality but no combination of settings or deep dives into the OD configs would work. I'm open to any suggestions at this point.

Anyone get any progress on this?

I had an idea to throw around that may be useless.

If someone knows that this wont work, let me know.

Can we head off /usr/sbin/PasswordService via its Launchctl plist and replace it with our script?

Inside our script, we could have something like

/usr/sbin/PasswordService -n | read password

...

....

or

/usr/sbin/PasswordService -n < /dev/stdin

read password

.....

....

I'll check the correct command piping(/redirecting?) the output to stdin and test and will reply here.

Any updates on this? I'm also facing the same issue.

Thanks