I have a new G5 pretty much set up to go. It is currently serving
mail, web, AFP and print queues.
The only thing that doesn't work is Open Directory (I think). That
is, what I can't do is have a user on another computer on the same LAN
login remotely (that is, login on the non-server, but mount their
directory from the server.)
The server has a static IP of 192.168.0.10 and sits behind a firewall
which has all the public ports I care about sent to it; all of that
works fine. There are a number of systems on the 192.168.X.Y LAN.
What's been done:
On the server in WGM->Sharing the mount point (/Users) has been set to
"LDAPv3/127.0.0.1", via AFP and Use for User Home Directories.
From Server Admin:
Open Directory: Role set to "Open Directory Master"; Protocols, LDAP
Settings has Search Base "dc=local".
On the client, via Directory Access, the LDAPv3 service goes to server
192.168.0.10, LDAP Mappings from Open Directory Server, and search
base suffix is dc=local. Authentication is "Custom Path", with
/LDAPv3/192.168.0.10 set.
Logs:
From Server Admin there is *nothing* in the logs for this particular
user under the Password Service Server logs.
There is nothing in /var/log/system.log
The *only* thing different from the last time I set this up is that I
now have a dedicated router/firewall box that sits between the
Internet and my LAN; mostly this was done because a) (as Dan Shoop
always says) I wanted to get my computer out of the NAT/Firewall
business and b) my IP address is not static. Given that, the LDAP
search used to be "dc=theboykins,dc=com" in all the appropriate places
as opposed to "dc=local".
Any help (HELP! REALLY!) would be appreciated; I'm pulling out what
little hair I have left.
Please tell me you're not using the .local DNS namespace (which Apple
has pre-empted). There was no need to change your existing search base;
it's not like search base is fundamentally tied to your DNS search
base; use of the DNS namespace to generate a search base is largely a
convenience.
Anyway to get around Apple's .local thing add a boykin.local file in
/etc/resolver.. make it look something like this (adjusted for your
site):
cat /etc/resolver/4am.local
nameserver 222.222.222.222
port 53
timeout 5
domain 4am.local
...apple has a kbase on the process but it's a little backward in its
thinking as far as I can tell.
If you're not using .local DNS, good for you (I only do it to support
AD, so I can work through the kinks before I encounter them in the
wild). It's unclear if your mappings are "from server" or Open
Directory Server. I've had better luck with the latter, being sure to
specify a search base.
On the server:
a) id a non-admin user in the shared domain
b) /usr/libexec/chkpasswd a non-admin user in the shared domain
c) kinit a non-admin user in the shared domain
On the client:
-open up an ethereal session, check out the LDAP packets-
a) id a non-admin user in the shared domain
b) /usr/libexec/chkpasswd a non-admin user in the shared domain
c) kinit a non-admin user in the shared domain
d) dscl /LDAPv3/192.168.0.10 -read /
http://www.4am-media.com
Mac OS X Consulting and Training
Michael Bartosh
email@hidden
303.517.0272
Denver, CO
"The surest way to corrupt a youth is to instruct him to hold in higher
regard those who think alike than those who think differently."
