- Introducing Directory Services Concepts
- What Is Open Directory?
- Overview of Open Directory Components
- Configuring Open Directory
- Managing Network User Accounts
- Connecting to the Shared LDAP Directory
- Configuring an Open Directory Replica
- Using Authentication Methods on Mac OS X Server
- Archiving and Restoring Open Directory Data
- Troubleshooting
- What You've Learned
- References
- Review Quiz
This chapter is from the book
This chapter is from the book
This chapter is from the book
Configuring Open Directory
Using Server Admin, a computer running Mac OS X Server can be set up in four ways:
- As a standalone server, the server does not provide directory information to other computers or get directory information from an existing system. The local directory can’t be shared.
- As a server connected to a directory system, you can set up the server to provide services that require user accounts and authentication, such as file and mail services, but use accounts that are set up on another server.
- As an Open Directory replica, a server hosts a replicated version of a directory. The replica is synchronized periodically with the master.
- As an Open Directory master, a server can provide directory information and authentication information to other systems as the host of a shared LDAP directory.
)
As you plan directory services for your network, consider the need to share user and resource information among multiple Mac OS X computers. If the need is low, then little directory planning is necessary; everything can be accessed from a local server directory. However, if you want to share information among computers, you need to set up at least one shared directory.
Connecting to an Existing Directory System
If you intend to set up multiple servers, it would be extremely inefficient to populate each server with the same user accounts. Instead, your Mac OS X Server computer can be a node connected to a directory system. In this role, the server gets authentication, user information, and other directory information from a directory system hosted on another server or servers. The Mac OS X server still gets some directory information locally from its own directory and provides authentication based on this information for local users. This puts one server at the pinnacle of your setup and other servers that obtain their directory information from this original server. This server does not have to be an Open Directory server; it could be another directory server such as Active Directory.
)
To configure your server to obtain directory services from an existing Open Directory master server:
- Open Server Admin. Select Open Directory in the Available Servers list. Click the Settings button in the toolbar, then click the Change button near the top of the window. Select “Connected to a directory server” from the Server Configuration Assistant and follow the steps.
- Open Directory Utility (located in /Applications/Utilities). If necessary, click the Lock icon and authenticate to make changes, and then click the Show Advanced Settings button.
- Click the Add (+) button and type the fully qualified domain name of the Open Directory master.
- Enter the Computer ID (usually the Computer Name of the server that will connect to the Open Directory master).
- Click OK.
You can then view your Open Directory master server in the Directory Servers list.
)
)
)
)
Your server is now bound to another Mac OS X Server Open Directory master.
Configuring an Open Directory Master
Instead of binding to another server for directory services, you can set up Mac OS X Server to host a shared LDAP directory, providing directory information and authentication to other systems. To do so:
- Click the Change button in the Settings pane to open the Server Configuration Assistant.
- Enter a Name, a Short Name, and a Password for a new account that will administer the shared LDAP directory. You can use the default user name and diradmin as the password as your initial LDAP account.
)
Once you have set up your server to be an Open Directory master, you can configure other computers on your network to access the server’s shared LDAP directory.
To recap, you began with a local database for your local users. That database still exists. The administrator of that database is ladmin. You have now created a secondary, shared LDAP database. The administrator of that database is (by default) diradmin. Each database is separate and requires different authentication to manage either one. You have also created a Password Server database to store LDAP user passwords and a Kerberos Key Distribution Center (KDC). You will learn about those later in this book.