Providing Home Folders for AD users using the "Magic Triangle"
Hello everyone,
I have an issue that I have yet to find a clear and detailed answer to. I am the lead Mac admin at a large public university of 40,000+ users that uses Active Directory for all user accounts, home volumes, etc. I have read the white pages published by Joel Rennich, Mike Bombich, and the custom OD page by John Grigutis from IU and I have the whole "Magic Triangle" setup working great for managed preferences and fully kerberized services. The only issue that I have run into is that I cannot find a way to provide an alternate home volume location (using a kerberized AFP/SMB Mac OS X server) for any AD user. Our AD system uses the Distributed File System (DFS) for all shares and home volumes and Mac OS X doesn't support DFS, which is a big pain in the rear. We have evaluated ADmitMac but due to the cost, it is not a real option for our users and local admins. Since our AD admins are not willing to make changes to the schema or allow anyone other than AD admins to edit profiles, I have no way of editing AD user records to have the AD users' home location to point to another non-DFS file server. I have tried creating a custom LDAP setup on the client side in Directory Access to remap NFSHomeDirectory (#/Network/Servers/FQDN_of_my_fileserver_server/Users/$uid$), HomeDirectory (#afp://FQDN_of_my_file_server/Users) and when I attempt to login with an AD user, the client machine appears to authenticate but then I immediately get an error stating,
[i]"You are unable to log in to the user account "username" at this time. Logging in to the account failed because an error occurred. The home folder for the user account is located on an AFP or SMB server. Contact your system administrator for help."[/i]
Well, I am the system administrator and I know that the home volume is located on an AFP/SMB share. Duh. ;) I have also tried the solution that John Grigutis uses at IU where he exports users from AD and imports them to a main OD server that is kerberized and I cannot get that to work either. I have enabled the debug log with all of my testing and I cannot find anything that sticks out like a sore thumb. All of my test servers/clients are running Mac OS X 10.4.8 for what it is worth.
Basically, what I would like to know is providing alternate home folders even possible without making changes to the schema or user account attributes? So many local departmental admins and users have been asking me this for awhile now and I am really close to giving them a working solution, with the last piece being home folders managed by OD. Any ideas, tips, suggestions, or questions will be greatly appreciated.
Many thanks!