If you have an Open Directory infrastructure, and you want to secure your connections between the client and Open Directory services using SSL, the simplest solution is to purchase SSL certificates and install the certificate on your Open Directory Master and each Replicas.
If you are in an environment where you are integrating Mac OS X with a 3rd party KDCs, you already know about builtin:krb5authnoverify addition to your /etc/authorization. But did you know that you can use the builtin:krb5authenticate option to provide better security by assuring that your KDC is not being spoofed?
Ed. Note: Perhaps a word of warning? Discuss. Firefox 3 appears to have issues with user accounts not located on the main drive. At the very least it cannot deal with a network user account being located on a remote OS X Server.When I updated to Firefox 3, I immediately noticed that Bookmarks were not visible under bookmarks menu.
There were some bugs in the first version of the "Mac OS X Server Open Directory Administration For Version 10.5 Leopard" Check out the new version.
As part of some self-documentation, I posted on my personal blog exactly what works and where I found the help for getting an OpenDirectory 10.5 Server running from a 10.4 in production box. The twist is that I needed to keep my SID and other PDC functionality that I've inherited up from 10.3.9.
When creating an image, you typically have user creation as part of the build process. If you're doing this as part of a install and capture (aka the "Old Way") you simply create the user as part of the Setup Assistant, or use SysPrefs after the install to set it up.
So this has recently been discussed on the MacEnteprise list, but we thought we'd try and collate these ideas into a real world example. Most of you should be aware of how you can use MCX to manage preferences for your directory service.
Sponsored by IronGate Server Management & Consulting, in association with Digital Transitions the next OS X Integrators Birds of a Feather gathering is taking place at MaRS Discovery District on College St.
We're testing the following process to see if we can force a user's local computer will copy back to their home folder remotely. Been working with an Apple rep on this and we were successful in doing this on a test account.
An updated version of my WebObjects application that allows for user password changes and resets from a web page, released September 10, 2007.
