Cannot Authenticate Clients to OD Replica, only to OD Master

[beazer]

I am having a serious problem (i think) at least for me.

I have setup the following,

We have a small School Division in Alberta Canada, with 13 locations

We have a nice 6mb wan between locations.

We have a nice shiny Open Directory Master setup at our Tech Location.

We have 12 School servers (Open Directory Replica’s)

In the past, we have setup each school with their own open directory master, and this year we decided to do the whole thing. All the servers at running 10.5.4 server.

The replication is working as far as we can tell, and if I setup a workstation at a school to authenticate to the open directory master, with the home folder on the school server, it works fine, but as I understand all the docs, and the reading, I should be able to point the school workstations to the school servers for open directory authentication. THIS IS WHAT DOES NOT WORK.

I am not sure why, and have printed and reviewed the 356 page manual from Apple, and I am making myself crazy, and need the assistance os ones smarter that I.

Please let me know if I am out to lunch, and maybe if I just don’t understand how this works, but I have been at this long enough that I am a little dangerous, and maybe crazy as well.

Duane Beazer
Westwind School Division #74

P.S. This is previous post I put on Apple Discussions: (I have an Open Directory Master with 12 replicas (at other locations with 6mb links) I have setup the new machines at each school, and they are pointed to the replicas at the school where they reside. If I point the clients to the open directory master, the login works and it gets the home folder from the local (od replica) at the school. If I try and point the clients to the od replica which is on the local network at each school, the login will not work. I seem to be missing something, and cannot figure it out. Please if there is any help out there for this.)

[Timothy Perfitt]

The replicas should be able to handle authentication. In fact, you should not need to bind the clients directly to the OD Replica, as the clients should be able to figure out the fastest replica based on ping times. Replicas have a copy of password server as well as the kerberos database. Verify that in /Library/Preferences/DSLDAPv3PlugInConfig.plist you have a Replica Hostname List that lists all the replicas by IP address. Sniff the network to see where the client is authenticating. If you bind directly to the replica, how is it failing? Login window shake?

[foilpan]

you can’t bind to a replica because it’s a read only copy of the master, so all binding and authentication should point to the master, which then in turn has a list of replicas. the clients should automatically know about all the available replicas once they’re bound.

[Author]

Posts