- Mac OS X and the Windows Server Environment
- Windows Clients on a Mac OS X Server Network
- So Why Create a Mixed-Server Environment?
- Directory Services/Dominant Platform: Who Gets To Be the Boss?
- Window Servers in an Open Directory Infrastructure
- Mac OS X Servers in an Active Directory Infrastructure
- The Active Directory/Open Directory Love Child: Where There Is No Dominant Platform
- For More Information
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Mac OS X Servers in an Active Directory Infrastructure
Like Mac OS X, Mac OS X Server can be bound to an Active Directory domain. This approach gives you the option of offering Mac and Windows resources using accounts stored in Active Directory. To bind the server to Active Directory, use the Active Directory plug-in in the Directory Access utility. Simply enter the appropriate information and click the Bind button (see Figure 4).
)
Figure 4 Configuration sheet for Apple's Active Directory plug-in in the Directory Access utility.
Once Mac OS X Server is bound to Active Directory, you'll be able to use Workgroup Manager to configure share points and select users and groups from the Active Directory domain for assigning ownership and access permissions to those share points. Likewise with configuring print queues in Server Admin.
There are a number of advanced options that you can configure in Directory Access to set how Mac OS X interacts with Active Directory. Many of these are more relevant for Mac OS X workstations than for servers (in particular, how home directories are accessed) and should be set on the Mac OS X workstations that will also be bound to Active Directory, rather than on the server.
The Mappings tab, however, is important to configure. Open Directory and Active Directory share few user-record attributes (username and password being two). There is no direct Active Directory equivalent to the UID number that the Mac file system uses to assign ownership and access to files. By default, Apple's Active Directory plug-in will create a UID number based on the GUID attribute in the user's Active Directory account and the MAC address of the workstation's Ethernet port where the user has logged in. While this is an effective solution in an environment with only Windows servers (which don't use the UID to assign ownership or access to resources), it doesn't work well in a mixed-server environment because the UID for a user will change depending on the workstation at which the user logs in. This means that a Mac OS X server won't be able to properly assign that user's permissions.
The solution is to map the UID to some other attribute in Active Directory. The easiest solution is to pick an unused field (such as a phone number or portion of the address or location field) and enter UIDs manually in the field when creating user accounts (ensuring that each is unique). The Mappings tab in the Directory Access utility allows you to specify which attribute is to be used (mapped) for this purpose. You can also extend the Active Directory schema to include a UID attribute. The Mappings tab also allows you to specify a primary group and additional group IDs (which are not as critical as assigning the UID).