Populate users from Active Directory to Open Directory

Question

Level 1

8 points

Populate users from Active Directory to Open Directory

We have the (Dual Directory) setup as illustrated in the figure:

Active Directory to handle the authentication
Open Directory Master to handle the OS X settings

The employee macbook is connected to the Open Directory service successfully.

If I create a "Local Network Account" on the Open Directory server, I can successfully get info about that user by typing "id <username-defined-in-open-directory>" in the Terminal window on the employee MacBook. Success this far.

On the OS X Server, we have bound it to the Active Directory domain.

If I on the OS X Server's Terminal window type "id <username-in-active-directory>", I successfully get AD info on that user. Also success.

On the OS X Server (in the Server App), we create a group (type of Local Network Group) to hold all Active Directory users that have a MacBook.

I put my own Active Directory user into that group for testing purposes.

Now I expected to be able to lookup Active Directory user information from the employee MacBook, relayed through the Open Directory server.

But if I enter "id <username-in-active-directory>" in the Terminal window I get "no such user" error message.

What did I miss?

Posted on Oct 21, 2015 5:55 AM

Reply

Answer 1

stianv Author

Level 1

8 points

Oct 21, 2015 5:58 AM in response to stianv

I upload a better version of the picture here:

Reply

Answer 2

stianv Author

Level 1

8 points

Oct 21, 2015 6:05 AM in response to stianv

Ah, I see that I posted to the wrong group. Should have been "OS X Server".

I am not authorized to move it to "OS X Server".

Reply

Answer 3

Oct 21, 2015 12:25 PM in response to stianv

Trying to understand your post appears you have user macbook in both Open Directory and Active Directory?

Is the employee macbook a user existing in Active Directory?

Have you bound a mac client workstation (not the server and don't log in on the server with an AD user's account) to Active Directory?

If yes to both then launching terminal on that mac and issuing "id" will give you that users credentials as they exist in Active Directory.

Reply

Answer 4

stianv Author

Level 1

8 points

Oct 21, 2015 12:42 PM in response to Antonio Rocco

Hi Antonio,

Answer to your questions:

1. The employee on the Macbook is an existing user in Active Directory.

2. The Macbook is not (not yet) a registered Computer in Active Directory. And it is not bound to AD. Under Preferences-->Users&Groups-->Login Options, I only have the Open Directory registered as a Network Account Server, not AD.

Reply

Answer 5

Oct 21, 2015 12:53 PM in response to stianv

You register the Macbook when you bind it to AD. It places itself in the default computers OU. You can move it afterwards if you wish.

What I'm confused about is why you're getting an Open Directory response to your id request? Unless the employee is a local user on that MacBook as well as on AD? If that's the case then trying to log in with the same credentials (username and password) will never work as the local user will always log in first.

Remove the local user account and make sure the employee logs in with a networked account aka roaming profile. You can choose to be cache the profile locally (best for performance depending on what the employee does in terms of work etc) or be a true networked one, ie: one that is mounted over the network. Ideally your network would need to be gigabit or better for this to work well.

Reply

Answer 6

stianv Author

Level 1

8 points

Oct 21, 2015 2:04 PM in response to Antonio Rocco

Thanks again for your reply.

(A little background about the company so you get the picture: for years, the few, but now quickly increasing, OS X users, "have been on their own". IT helps them purchase the computers, but the users are on their own after that. IT is only concerned with Windows images and PCs. So the OS X users are creating local administrator accounts, not integrated with AD, not having home folders or printer access. Most OS X users have a corporate Windows VM on their OS X they fire up if they need SharePoint, printer or other corporate stuff. It's time to put an end to that. But we must try to do it smoothly - the users must keep their local admin rights and freedom.

We shall implement an Mobile Device Management (MDM) solution to push the Open Directory profile to the MacBooks.

I picture that in the login window, the existing OS X users, after MDM enrollment, will get the grey "Other" icon on the right, inviting them to login with their AD credentials.

And here "the new story starts", where they have access to corporate resources like printers, home folders, SharePoint and all the stuff they need, without use of the corporate Windows in the VM.

They might need to move their stuff from their previous local account to their new account.)

First one question: does the machine querying AD, has to be registered as a Computer in AD to retrieve response from AD?

In that case: if we register the name of the Macs in AD beforehand (or under MDM enrollment), will the registered AD user be able to authenticate from the registered Computer(Macbook) afterwards?

What we did to get OD response with the "id" command: We pushed an Open Directory/LDAP profile to the Macbook via MDM. That is how we bound the machine to Open Directory. But we did not log on to the Macbook with the Open Directory credentials, only with the existing local account. But since it was bound to OD via the MDM profile, and we did the "id" command for a "Local Network Account" registered on that OD, we got a response.

That said, we have also tried to go to the login window, and the grey "Other" icon appears to the right of the local users registered.

Scenario A: We entered the OD registered user ID (different from the locally registered IDs on the Macbook) - and we got a successful login.

Scenario B: We entered an AD registered user ID, but the login was unsuccessful. Maybe because the Computer name is not registered in AD?

I shall try to get the Macbook we are testing with, registered into Computers in AD.

Reply

Answer 7

Oct 21, 2015 4:43 PM in response to stianv

Thanks for the further information.

Answer to your first question: yes. For your second question and if by MDM enrolment you mean bind your macs to AD: yes.

However, in the environment you've described with your Mac users as local admins there's not much point in installing profiles or doing anything else as they can remove profiles, bindings and anything else at any time, whenever they like and there's nothing you can do to stop them other than taking their computers away from them.

I understand the desire to integrate but not the methods and process you've decided to implement. They're wide open for abuse and practically impossible to police. If it was me I would remove their local admin status, bind the Macs to AD and ditch OS X server. For what you've described you don't need it as it would never work.

Just my opinion but I can't imagine the organisation you work for approach their PC estate and its users in the same way. If you want true integration then the Mac estate should not be treated differently.

Reply

Answer 8

stianv Author

Level 1

8 points

Nov 10, 2015 10:30 PM in response to stianv

Hi,

Antonio is correct. My setup as described, won't work.

I misunderstood the setup. I thought OD could be a relay between the clients and AD.

In a setup where we shall utilize features delivered from OS X server, we must set it up as is described under "the golden triangle". And in a triangle, each node is connected to two others. So the OS X client must be bound both to the OD server and to the AD server.

When I configured the AD directory server (in addition to the existing OD), things started to fall in place: access to home folder, printers and such, delivered from AD.

And Antonio, you are right: I do not really need the OD server since I configure the OS X clients from AirWatch.

Reply