- Introducing Directory Services Concepts
- What Is Open Directory?
- Overview of Open Directory Components
- Configuring Open Directory
- Managing Network User Accounts
- Connecting to the Shared LDAP Directory
- Configuring an Open Directory Replica
- Using Authentication Methods on Mac OS X Server
- Archiving and Restoring Open Directory Data
- Troubleshooting
- What You've Learned
- References
- Review Quiz
This chapter is from the book
This chapter is from the book
This chapter is from the book
Connecting to the Shared LDAP Directory
Once you have an Open Directory master set up, you must configure the client computers to connect, or bind, to the server. Using Directory Utility on each client computer, you create an LDAP configuration that has the address and search path for your Open Directory master. This method forces you to visit every computer running Mac OS X, which can be quite time-consuming if you have a few hundred Mac OS X computers that need to be bound to your server.
You will now configure your Mac OS X computer to use authentication services from your Mac OS X Server. You just configured a shared directory, so your Mac OS X computers must be able to see the shared directory in order to authenticate against it. There are two main ways to do this, manually define the Open Directory master on your Mac OS X computer or receive the information via DHCP. Using Mac OS X Server’s DHCP service is an excellent way to permit Mac OS X computers to obtain the shared directory information.
You will configure your Mac OS X computer to use authentication services on your Mac OS X Server. Once you have configured a shared directory on Mac OS X Server, you need to set the client machines to look for it. You can configure DHCP to provide the information required to locate the shared directory or you can set it up manually. Any client bound to the server can authenticate users using the data in the shared directory. Your Mac OS X computer must be using the static IP address (10.1.17.2) manually assigned in Lesson 3, “Authenticating and Authorizing Accounts,” for this next set of steps.
Set Static LDAP Binding to Your Server
The Mac OS X computers need to bind to your Open Directory master server to connect. In the following steps, you will set the binding manually, and then set the client to use the server for authentication information.
- On the Mac OS X computer, open Directory Utility (located in /Applications/Utilities). If necessary, click the Lock icon and authenticate to make changes, and then click the Show Advanced Settings button.
- Click the Add (+) button and type the fully qualified domain name of the Open Directory master.
- The Computer ID field will be automatically populated with the predefined name of the computer. Click OK.
- Click OK, and the Mac OS X computer is now bound to the Open Directory master.
)
)
)
)
Verify Authentication
Now that binding is complete, you must verify that you are using the server for authentication information.
- Click the Search Policy button in Directory Utility and verify that /LDAPv3/server17.pretendco.com is in the list.
- If the server path is not in the list, you will need to add it (you will not need to complete the following steps if the authentication
is set for you):
- Choose Custom path from the Search menu.
- Click the Add (+) button.
- Select server17.pretendco.com.
- Click Add.
- Click Apply.
- Quit Directory Utility.
- Quit any applications and log out of your Mac OS X computer.
)
)
You have now bound your Mac OS X computer to your Mac OS X Server. Your login window now has the option for Other, and you could use that to log in as a network user, something you will do in a later lesson.
Using DHCP to Obtain LDAP Directory Information
An alternative to manually setting the address on each computer is to provide the LDAP binding information through the DHCP service. You can configure the Mac OS X Server DHCP service to provide connection information for an LDAP server. After the DHCP service has been configured, the client computer receives the address of an LDAP directory server from the DHCP service that also supplies the computer’s IP address, router address, and DNS server addresses. If the Directory Utility is set to use that LDAP information, the LDAP server’s address automatically becomes part of your Mac OS X computer’s search path.
- Using Server Admin, enable the DHCP service by clicking the checkbox next to that service in the Services list.
- Select the DHCP service from the server list on the left, select the Subnets button in the toolbar, enable the subnet, click
the General tab below the list of subnets, and configure it with the following parameters:
- Subnet Name: Mac OS X Server Essentials Book Subnet
- Starting IP Address: 10.1.17.10
- Ending IP Address: 10.1.17.11
- Subnet Mask: 255.255.0.0
- Network Interface: en0
- Router: 10.1.17.1
- Lease Time: 2 hours
- Select the DNS tab below the list of subnets, and configure it with the following parameters:
- DNS Servers: 10.1.17.1
- Default Search Domain: server17.pretendco.com
- Select the LDAP tab below the list of subnets, and configure it with the following parameters:
- Server Name: server17.pretendco.com
- Search Base: dc=server17,dc=pretendco,dc=com
- Leave the Port field blank, save the changes, click the Start DHCP button in the bottom of the Server Admin window, and quit Server Admin.
- On your Mac OS X computer, create a new network location, call it Using DHCP, and ensure that your built-in Ethernet is using DHCP. You should obtain an IP address from your server after a few moments.
Now that you have obtained an IP address, you have also obtained your shared LDAP directory information. You must now tell the Directory Utility to look for that information.
- On the Mac OS X computer, open Directory Utility (located in /Applications/ Utilities). If necessary, click the Lock icon and authenticate to make changes, and then click the Show Advanced Settings button.
- Select the Services button in the toolbar, then select the LDAP service.
- Click the Pencil icon (or double-click the LDAP service) to edit the service.
- Select the “Add DHCP-supplied LDAP servers to automatic search policies” checkbox and click OK, then click the Apply button if necessary.
- Confirm the LDAP information is supplied by clicking the Search Policy button in the toolbar and ensuring Automatic is selected in the pop-up menu. You should see your server’s fully qualified domain name in the list.
)
)
)
)
)
)
)
Your Mac OS X computer is now bound to the Mac OS X Server’s LDAP server simply by using the information provided by the DHCP server.