Active Directory

[bossa nova]

Joel,

Really enjoyed your piece on active directory. I was wondering if you could answer a question about it.

I did everything so far up to a point but got confused when I got down to section discussing the mappings. You have RecordName, UniqueID, Password, NFSHomeDirectory, PrimaryGroupID, HomeDirectory and RealName in bold. Are these the names AD uses for them? Or are these the names OS X Uses? If AD then where can I find OS X’s naming convention because clicking on the item on the left in the directory access config window gives you an empty field.

Here is the excerpt I am referring to…
<snip>
Now that you know how to map, what should you map?
the RecordName, which should map to the shortname of the user
the UniqueID, which should map to a user ID
the Password, which you don’t need to map since the LDAP specification will handle that by itself.
the NFSHomeDirectory, which is the POSIX path to the user’s home folder.
the PrimaryGroupID, which should be mapped to “20” (the staff group). This is the default for all users created on Mac OS X. You may wish to alter this to better suit your needs, however.

the HomeDirectory references a remote server which contains your home folder. This isn’t necessary if you are only using local home folders and not network home folders.

The RealName field maps to the users full, or long, name, but isn’t all that necessary.
<end snip>

Thanks!
John

[Anonymous]

Yes that helps a lot! Thanks!

by using ipphone (as in your example) will that write to the ad server?

I am beginning to think I should buy a machine to run at home and try this there. You did warn us this was involved!!!

[bossa nova]

MacTroll wrote:

—
The problem is that this won’t write to the server. That attribute has to already be there if you want unique ID numbers. You can do this by just going into the AD Users module and getting the properties for the user.

This is one of the reasons why the static maps become interesting.
—

Okay so we already have users defined. Do I still need to enter static values? This is a very large company with accounts defined by someone else and AD administered by 3 other people and yada, yada, yada….I asked one of the admins about this and would I need to write and if I did write something would it damage my record, he says I do not need to write to the ldap server-I just need read access. Is this correct?

oh and yes me and my co-hort are already looking at setting up a small lab with a 2k server off-line!! So we can seek and destroy…um…Harmlessly!

[Anonymous]

Hi BossaNova

Probably you realy need to write on the ad, at less the mac UID.
The win UID is cripted, and so you can’t use it.
Without a UID, you will finish ine the console, and won’t be abble to login in the finder. The other way is to put a static UID, for exempel #521 directly in the Directory access mapping. If you have not access to the AD, but you have a account who have the permission to change it, you should use a ldap browser for add the values. For exemple go to http://www.iit.edu/~gawojar/lda.

Good luck

[Author]

Posts