OS X Active Directory Group Limits

[benfeea1]

The following information has been tested in and is applicable to Open Directory, NetInfo and Active Directory (AD).

I am presenting it as it relates to AD and OS X 10.3.x.

OS X Clients logged into a directory system such as Active Directory are only aware of 15 domain groups.

To recreate the problem:
Log into an OS X client that is bound to an Active Directory domain.
Open terminal and type the ‘id’ command. This will show your UID and GID for any groups you are a member of.
The list will only include 15 groups. If you are a member of more than 15 Active Directory Domain groups they will not be displayed or recognized.

The OS X client will acknowledge the group memberships of the groups listed in ‘id,’ but not any other groups you may be a member of.

The biggest impact this has is on OS X Servers that are joined to an Active Directory domain. If the user’s short-name and UID match on the client and on the server (meaning the username/UID the user connects to the AFP server with), the AFP server assumes that the client shares the same directory services as the server, and hands off enforcement of user/group/other permissions to the client. However if you are a member of more than 15 AD groups it might or might not work.

The Active Directory schema here was modified two weeks ago to include information for Exchange 2003. Now Active Directory sees all the email distribution lists as Membership groups. When you include the AD Security groups with the newly-added Membership groups, most of my OS X clients exceed the 15 group limit. This has broken our OS X server group permissions for AFP shares.

And it took two weeks to figure it out.

Any Thoughts?

Eric Benfer
ITSD – IDS
Johns Hopkins University Applied Physics Laboratory
11100 Johns Hopkins Rd
Laurel, MD 20723
[email protected]
443-778-4248 Balto.
240-228-4248 DC

[benfeea1]

Supposedly there is a way to configure AFP to NOT hand off enforcement of user/group/other permissions to the client.

Does anyone know how to configure this option?

[benfeea1]

I tried mapping UID to uSNCreated on the server and it did not seem to make a difference. Well it did break single sign on SMB for the PCs.

I tried mapping UID to uSNCreated on the client and it seemed to help. Now Mac clients who are joined to the domain can access all the areas on the OS X server they has privileges to. However, now there network drives don’t mount.

Fix one break another.

If I could just get AFP not to pass group auth down to the client that would do it.

[Author]

Posts