Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: PAM questions. HELP!

On Wednesday, December 4, 2002, at 01:38 AM, Stephen Brandon wrote:
Configuring both plug-ins will not really address the issue. The first
one in the list will take precedence. (The search policy is not a
replication/fail over strategy.)

Oh, that's interesting. It is for NetInfo though - if a user is not found in
NetInfo then it will go on to look in LDAP (search order in Directory
Access.app)... or do you mean that if a user is found in one, but does not
authenticate (wrong password) then it does not go any further?

That's right. The search policy is making the assumption that the individual nodes are generally available. Any fail-over would need to be handled at the plug-in level by making a set of replicas appear to be one DS node.

As to the startup sequence, you should make sure that the LDAP server
starts before DirectoryService. This can be done by making the
DirectoryServices startup item depend on your LDAP server's startup
item.

Hmmm. Is it possible to simply restart DirectoryService in some way so I can
test this without restarting the machine?

Yes, you can kill DirectoryService and it will be relaunched by the next dsOpenDirService call. This is not a recommended thing to do, but many DS clients will reestablish communication after DirectoryService restarts. Any authenticated sessions you had open will be lost however. (Such as those in Workgroup Manager.)

% sudo killall DirectoryService

Alternately, try running ftpd and the passthrough LDAP server on
different machines.

Yes, good idea. Is the stock ftpd on OSX client machines (10.2.2) supposed to
work in the same way (by authenticating via DirectoryServices)? I suspect
not, having looked at the lukemftpd sources in Darwin... but I could be wong.

If it uses PAM it should work with Directory Services. I'm not sure whether that is the case. As an experiment, could you try running the LDAP passthrough server on a Mac OS X client machine?

-Jason
_______________________________________________
darwin-development mailing list | email@hidden
Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-development
Do not post admin requests to the list. They will be ignored.


Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.