Enabling Mail for AD Users on OS X Server

This isn't the royal pain in the rear that it used to be.

With the Service Access Controls on 10.4 you won't need to edit anything in Active Directory.

The Problem

To enable a mail account for a user on OS X Server you need to go into Workgroup Manager and establish some basic mail settings for them. These get saved into an apple-user-mailattribute for the user in LDAP or NetInfo.

If you're getting your users from Active Directory, however, this isn't an easy thing to do as that attribute doesn't exist in AD. There are some ways to work around it, but they used to be not so easy.

You could use LDAP instead of the AD plugin and then use static mapping on the variable. It is also possible, in 10.4, to use the dsconfigad command to static map the information. Or you could go crazy and add that attribute to your AD schema and then enable as you like.

The Better Way

A little known fact of 10.4's Service Access Control Lists is that enabling a SACL for mail does an end run around the need for the custom mail attribute. In fact, enabling the SACL for mail eliminates any lookups for the attribute at all.

So, join to AD as normal, then in Server Admin use the SACLs to add a group to the Mail service and disable all others. Now these users will automatically be configured to have a mail account on that particular server without any need to change their directory entry. Other users, regardless of whether you have added mail information to them in WGM or not, will not have access to mail.

Also keep in mind that once you enable the SACL you won't be able to set any quotas or set up an e-mail account to forward instead of storing locally since the SACLs overrides all of the mail settings.