Home › Forums › OS X Server and Client Discussion › Active Directory › Record Augmentation not pulling the original record
- This topic has 5 replies, 2 voices, and was last updated 16 years, 7 months ago by
osuarez.
-
AuthorPosts
-
November 18, 2009 at 10:06 pm #377551
mdoupe
ParticipantHello all π
We’re trying to set up a Snow Leopard server for webmail with Active Directory authentication. We’ve been trying to set up Record augmentation. We’ve read the afp548 article on the Cylinder of Destiny, as well as the bombich document on AD integration (http://www.bombich.com/mactips/activedir.html)
First we bound it to AD, then set it up as an OD master. We added the augmentconfig to OD (which I’ve included below), and then imported an augmented user through “New Augmentation Record” in WGM.
The user shows up with the little blue gel, and only has the three tabs. So OD knows it’s an augmented record. However when I go to the inspector, it only shows OD attributes; not AD attributes such as SMBhome and whatnot. AD users can also log into wiki’s just fine, and we can manage them through WGM, so we also know that the Xserve is bound to AD fine. When we try to log into webmail with an AD account, the log shows a successful authentication, but the user gets an error, so I assume it’s because it’s going straight to AD and skipping the augmented record. We have set /LDAPv3/127.0.0.1 first in search within Directory Utility.
Can anyone give us any tips on why it’s not pulling the original record? or anything we can check on?
augmentconfig XMLPlist:
<?xml version=β1.0β encoding=βUTF-8β?> <!DOCTYPE plist PUBLIC β-//Apple//DTD PLIST 1.0//ENβ βhttp:// www.apple.com/DTDs/PropertyList-1.0.dtdβ> <plist version=β1.0β> <dict> <key>Augment Attribute List</key> <dict> <key>dsRecTypeStandard:Users</key> <array> <string>dsAttrTypeStandard:ServicesLocator</string> <string>dsAttrTypeStandard:HomeDirectory</string> <string>dsAttrTypeStandard:NFSHomeDirectory</string> <string>dsAttrTypeStandard:Keywords</string> </array> </dict> <key>Augment Directory Node Name</key> <string>/LDAPv3/127.0.0.1</string> <key>Augment Search</key> <true/> <key>Augmented Directory Node Name</key> <string>/Active Directory/cesd.ad</string> </dict> </plist>November 25, 2009 at 2:28 pm #377571mdoupe
Participantwe ended up statically mapping the MailAttribute for all AD users. The squirrelmail implementation doesn’t seem to be set up properly either, but we fixed that too. squirrel was trying to authenticate with cram-md5 and dovecot was having none of it. π
I think we tried looking in search, both with WGM and DSCL, and neither would show the augmented mailattribute.
April 10, 2010 at 7:33 pm #378372osuarez
ParticipantHi! mdoupe!
I have the exact same problem like you. Our AD users get an authentication error when trying to log on webmail. Our augmented users can be managed, and they can log in to other services, but they just can’t login to webmail.
How did you solve it? Any advice?
Thanks in advance for your time!
April 10, 2010 at 7:34 pm #378373osuarez
ParticipantHi! mdoupe!
I have the exact same problem like you. Our AD users get an authentication error when trying to log on webmail. Our augmented users can be managed, and they can log in to other services, but they just can’t login to webmail.
How did you solve it? Any advice?
Thanks in advance for your time!
April 10, 2010 at 10:15 pm #378374mdoupe
Participantwe never did get Augmented users to work (with any applications)
but there is an issue with squirrelmail where it tries to authenticate with dovecot using some sort of encryption. we turned that off (somewhere in the /etc dir there is a squirrelmail setup perl script, we ran that and set it to clear text auth.
April 10, 2010 at 10:24 pm #378375osuarez
ParticipantThanks for your quick reply. Gonna try that later. Tell u how it goes!
Have a nice weekend! -
AuthorPosts
- You must be logged in to reply to this topic.