AFP548 Changing the world one server at a time.

Directory binding and Kerberos best practices.

Home › Forums › OS X Server and Client Discussion › Open Directory › Directory binding and Kerberos best practices.

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • May 1, 2007 at 1:15 pm #368886
    mikemchargue
    Participant

    First, a visual. In the following diagram we have a network. All the computers are on a single subnet. The two switches are connected via a 6 Gbps fiber link. There’s a master and two replicas, as well as two AFP servers hosting home directories. All servers should be Kerberized. Lets assume all clients will be configured to use Portable Home Directories because users all have a dedicated machine.

    http://farm1.static.flickr.com/203/479836641_0a95038ea4_o.png

    Obviously, clients on the same switch as replica1 would have Directory Access LDAP pointed at replica1.corp.com for Autehntication and Contacts and clients on the same switch as replica2 would point to replica2.corp.com. Likewise, they’d point to the nearest server for home directories. That much seems clear and consistent.

    I have two questions I haven’t been able to get a consistent answer on, and I’d like to see if any of you have an opinion.

    1. home1.corp.com would be confirgued as Connected to a Directory System and then Kerberized. Should the LDAP binding be set to master.corp.com or replica1.corp.com? If you point a server to a replica, can you still Kerberize it easily via the GUI in Server Admin? Likewise, would home2.corp.com be set to bind with master or replica2?

    2. If you wanted to provide clients with a second LDAP server in case of a failure, would you point the seconday LDAP entry to master or the other replica?

    Any thoughts you have would be immensely helpful.

    ***I tried to embed the image, but it’s getting flagges as spam. Click the URL to see the visual.

    May 2, 2007 at 5:11 pm #368909
    mikemchargue
    Participant

    MacTroll wrote:

    1. Makes no difference which one you’re using. The Kerberization process will work with either.

    2. OS X clients will already know about the replicas. There is no need for a secondary LDAP entry.

    1. That was my assumption, but I hate to roll out servers on an assumption. Thanks!

    2. The Open Directory Administration manual seemed to indicate that. Do you have any insight into how clients know about replicas? I’d just like to know. 🙂

  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.