Getting Trusted Binding to work

[OD Master]

Hello,

I’ve started rolling out the first Tiger Server install at client sites in the last weeks, upgrading existing installs to 10.4. The main feature behind this fast switch is the support for Trusted Binding which finally arrived in Tiger.

So far I’ve identified quite a few bugs in the current implementation. For example trying to upgrade existing computer records failed for me all of the time. I resorted to deleting the computer’s record in the OD domain before binding the client to the server thus recreating the entry.

But I was unable to create a binding across a VPN connection. So far I was only able to bind clients to a server in the same LAN. Might be some timing issue when two routers plus the Internet link are involved.

Besides that clients that have been bound successfully inside the LAN are not able to connect to the LDAP server from the Internet. I temporarily activated port mapping for LDAP (port 389) in the router, and clients without binding could connect just fine or browse the directory in Address Book.

If someone managed to get the above scenario to work I’d happy to hear and share my results.

TIA,
Norbert

[OD Master]

I especially hoped to get trusted binding to work across the Internet, so there will be routers involved. As long as you stay inside your own LAN Trusted Binding seems like an overkill to me, but outside it’s really the only way to go.

Yes, I turned on all the options including man-in-the-middle attack prevention. I’ll try to bind a client tomorrow inside the LAN and see how far I can get by turning one option on after the other when I move outside.

Norbert

[OD Master]

Latest update on this issue: I was able to solve it: Now Trusted Binding seems to work across the whole VPN. As usual it was a DNS issue 🙂

Well, Tiger’s new simplified DNS GUI is really making things more complicated than before. The thing was that on the secondary servers I only mirrored the normal zones, not the reverse – I also wonder how to get this to work in the GUI – perhaps time for separate discussion in the right forum.

Now I used the primary DNS on the secondary server as well and after that Trusted Binding started to work between the two. It looks like when the reverse lookup does fail the Trusted Binding fails as well.

So when we move into the Internet we need to make sure that Reverse DNS works for the public IP as well. Then it should be possible to get it going across the Internet, too.

Norbert

[Author]

Posts