Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: PAM questions. HELP!

On Tuesday, December 3, 2002, at 02:05 PM, Stephen Brandon wrote:
I assure you, ftpd on my MacOSX Server is NOT accepting names and passwords
via authentication in LDAP, despite being set up to authenticate via
Directory Setup. I see from my LDAP logs that some info is requested, but a
BIND does not appear to be attempted (as it would have to - I have not mapped
the password attribute, and it has been removed).

All my client machines which also point to this same server via
DirectorySetup are very happy to log in at the console.

Part of the problem, actually, may be that the LDAPv3 plugin makes only a
single connection to the server, and if that breaks for any reason the client
must be rebooted. So because the server in this case is the same as the
client, I wonder in what order they both get started up at bootup. To try to
avoid this I have set up both the LDAPv2 and the LDAPv3 plugin to
authenticate to the server, as the LDAPv2 plugin seems less picky (though is
more buggy for many operations, like console login).

There is actually reconnect support in the LDAPv3 plug-in. In some cases this would not work properly. (The fix is in the Darwin CVS version and will be included in a future release of Mac OS X.)

Configuring both plug-ins will not really address the issue. The first one in the list will take precedence. (The search policy is not a replication/fail over strategy.)

As to the startup sequence, you should make sure that the LDAP server starts before DirectoryService. This can be done by making the DirectoryServices startup item depend on your LDAP server's startup item.

Alternately, try running ftpd and the passthrough LDAP server on different machines.

-Jason

--
Jason Townsend
Open Directory engineer
Apple Computer
_______________________________________________
darwin-development mailing list | email@hidden
Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-development
Do not post admin requests to the list. They will be ignored.


Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.