AD logins and Tiger Server homes

[bradprice]

Hello,
We’re running a 10.4.3 Mac lab and 10.4.3 server. Client workstations are set up for log in using AD (plugin). Due to some issues with space and with the firewall on the Windows server, we can’t use the AD plugin option of an AD-specified home location (Windows users elsewhere on campus just get this mapped as an H: drive.) In fact we cannot modify any aspect of the AD at all, or the Windows server. Therefore we are left with storing the user directories locally, which of course stinks in a lab environment.

Our Tiger Server is bound to AD and we’re running as an OD Master. We have AD users in OD groups, and have successfully defined sharepoints so that each group has workspace to use (it’s actually on an XRAID connecte to the Server, but that’s transparent.) What I cannot figure out, from studying the otherwise excellent AD-OD Integration document, is how (or even what/where) to configure on the server to have the home directories of AD users stored on this server! It would seem that I first need to have the *users* defined on the server, but I can’t because they’re AD users. And Groups don’t have “home directories” of course… What am I missing here?

Ideally I’d like the server configuration to provide that ANY of the 3000 AD users can walk into the lab, log in and have a home directory on the Mac server, dynamically created if it doesn’t exist. However right now I’d settle for a way to pre-define a few dozen of the AD users who are already in OD groups, and specify locations for their home directory.

I also considered tcoming at this from the client side (sort of a hack) by using the “dsconfigad” command and parameter “-staticmap dsAttrTypeStandard:HomeDirectory”, but I cannot find any documentation on this or examples of syntax or values. This command is the manual way to set the AD plugin, e.g. enable local home, choose protocol SMB, etc. Has anyone used this to hack a different home directory path?

[bradprice]

Thanks for your comments and suggestions.

Interesting yes, but I find it hard to believe that I’m “off the charts” in wanting to do this. I mean, there have got to be a lot of Windows-centric places (especially universities) using a big central Active Directory, and that need to set up some Mac labs leveraging that same directory for user accounts (who wants to create 3000+ accounts on their XServe if they don’t have to?) The AD plugin in Tiger, while certainly much nicer than what one had to attempt in Panther, really doesn’t help that much. Local homes? Blech. Homes specified in the AD?! Most Windows places won’t want this on their Windows server because they don’t do it for PCs (usually just a mapped H: drive.) To me it demonstrates a real lack of understanding on Apple’s part of how Windows and AD infrastructures are typically deployed in the enterprise.

I agree with your assessment that the static mapping on the client would probably not work… unless there would be a way to script it dynamically, as a loginhook or something. I’ll be the first to admit such a method would be way beyond my capabilties, and would definitely fall into the category of a major “hack”, if it’s even possible.

So your suggestion to static NFS mount /Users, would mean that even local accounts on the client would ALSO have their home dirs on the server… a wrinkle, but I might be able to live with that. (I’m thinking it might be a problem for local admin-ing the client Macs…)

I think probably the way Apple would say to do it is with LDAP to AD, like the old way in 10.2 and 10.3.

Here’s one more thought… Since the server is joined to AD, and I have AD users in OD groups, could I remove AD on the client Macs and just use LDAP to the server OD? From the client side it would be just the same as if they were authenticating to an OD account on the server and AD didn’t exist, only the server doesn’t have the user accounts, but groups of AD users. Would this even work? What are the ramifications for single signon? I also fear my too-shallow understanding of Kerberos may be clouding my thinking here, but I’m happy to be enlightned!

This is a real sticking point for us, especially in one lab that’s used mostly for Final Cut. User files are HUGE. Also, users have a hard time with being forced to come back to the same computer each time they visit the lab. We have a fast network and tons of space on the XRAID, thus the desire for home folders to be located there. There would still be local scratch space on the client Macs, but it would be easier for them to understand where to put files, etc (and user data would be safer on the RAID.)

Thanks… will be an interesting project for over break.
Will you be at Macworld?
Brad

[Author]

Posts