- This topic has 5 replies, 1 voice, and was last updated 17 years ago by
.
-
Posts
-
Hi all,
Posted this on the Apple Discussions board too, but no luck as yet. Hoping you guys will know what’s going on…
I’m running an Xserve with 10.6 Server installed (updated from 10.5.8), set as an Open Directory Master and connected to a university Active Directory system (magic triangle job). All our users live in the external AD, but are added to appropriate user groups in OD. We use these groups to determine who can log in to which machines using the Access Control List section of Login > Access in Workgroup Manager (computers are assigned to groups and those groups are used to add the ACL to). It worked perfectly with 10.5.8 Server and 10.4.11 clients.
Upgraded the server to 10.6 – all still appears fine with the 10.4.11 clients, despite the slightly unhelpful section in the ‘Upgrading and Migrating’ document that mentioned “manually move the LDAP access control lists (ACLs) after the upgrade is finished.”. Looked into this, but it doesn’t really seem related to the problem (as far as I could tell).
Now I’m trying to update our clients to 10.5.8, but my test machine will not log in with any ACL in effect. If the Access section is disabled (set to ‘Never’) for the computer or computer group, AD users can log in fine and get the appropriate settings for their OD group. But add a user group to the ACL for that computer (or group of computers) and nobody can log in, even if they’re a member of the group that I’ve just given ‘Allow’ access to.
Tried creating a new group and giving it the right permissions to a test computer group – no luck. Disable the Access section – can log in fine.
Have I missed a trick here with not ‘manually moving my LDAP ACLs after upgrade’? Is there a new setting somewhere that 10.5.8 clients might be getting muddled on? This is the first time we’ve had 10.5.8 clients, so it has previously been untested.
Thanks,
Andy.
The plot thickens. When the Access Control List is in use, the 10.5.8 client doesn’t seem to see that the AD user is in an OD group…
Ignoring computer groups for now – just changing the Access setting for a single test machine. With Login > Access for a test box set to ‘Never’ or to ‘Always’ with nothing in the Access Control List, everything works fine – other than anyone in the AD being able to log in, obviously. ‘Local-only users may log in’ is ticked, as is ‘Combine available workgroup settings’. An AD user in the OD group ‘Postgrads’ logs in and gets all of the customisations set for the Postgrads group. Lovely.
The OD ‘Postgrads’ group is added to the Access Control List with the setting ‘Allow’. The AD user in the OD ‘Postgrads’ group is now blocked.
The OD ‘Postgrads’ group is added to the Access Control List with the setting ‘Deny’. The AD user in the OD ‘Postgrads’ group can now log in again, but receives none of the customisations of the Postgrads group.
While all this is going on with the test 10.5.8 client, the 10.4.11 clients are behaving perfectly normally. As far as I can see there must be something that is set wrongly, or is being mistakenly interpreted, that’s causing the issue. Either that or it’s a big fat bug.
Any suggestions very gratefully appreciated!
Still holding out for help, but it’s definitely not the server at fault here. I’ve now tried a 10.4.11 and a 10.6.1 install on the same machine, and the problem is not present. Definitely has something to do with the 10.5.8 client, but they’re configured in exactly the same way. Will try clearing out everything related to OD / AD bindings on the machine and see if I can resurrect it.
roobarb%21 wrote:
Will try clearing out everything related to OD / AD bindings on the machine and see if I can resurrect it.
Went one step further and created a completely new, up-to-date install of v10.5.8 on a new partition. Exactly the same problem. Tiger logs in fine, Snow Leopard logs in fine, Leopard refuses.
so i had the same problem and i started comparing os versions and such after not too long of looking at my setup i decided to check the SYSTEM TIME of the DOMAIN CONTROLLER, remember in an AD-OD setup all system times must be within +- 5 minutes in sync otherwise the apple clients and server will not allow users to log in. (similar issue as when you use bootcamp and the go back to mac os x) for some reason the DC time was 5 min and 48 sec ahead of my OD server time and OS clients. the moment i made all servers the same time, it all started to work again. hope this helps… good luck!!!
Hi all,
Thought I should post an update now that I know the cause of the problem. The cause is Mac OS X v10.5. It doesn’t work with AD users in OD groups, and there’s no sign of it ever being fixed. My thread is here: http://discussions.apple.com/thread.jspa?threadID=2150405&tstart=0 and the Apple KB article is here: http://support.apple.com/kb/TS2814
Overall I’ve been rather disappointed with Apple’s ‘solution’. The KB article suggests adding the users directly to the ACL, which just isn’t an option when you’ve got large numbers of users to keep track of. It works perfectly in 10.6 and 10.4 and the galling thing is that there are no more OS updates for PPC machines, so the ones we have will simply have to stay on 10.4 until they are given new homes and new jobs to do. 🙁
Hope this cuts down on frustration for other users if they come up against the same issue.
Cheers,
Andy.
- You must be logged in to reply to this topic.