Read from AD, Create in OD

[gliverman]

Does anyone know how to have an OS X Server 10.4 (soon to go to 10.5) use an account if it exists in AD and create an account in OD if it does not? I am wanting to do this so that my web server will be able to use all the accounts in AD for our staff but, at the same time, allow OD accounts to be created for use on it by people whom have no reason to be in our AD server. The web server will be running several applications that are all able to take advantage of an external LDAP server like OD for authentication. These apps will all be told to look at OD, so OD will need to do a one-way sync with AD so that when accounts are created or updated in AD the changes show up in OD. Thanks ahead of time for any help you all can provide, I really appreciate it!

[shadedream]

You actually dont need to mirror the accounts in OD. If you bind the server to AD (basically the same way you do via Mac OS X client) you can place the AD users that need access in groups on the OD server and give them access. I’ve been doing this with a podcast server in our implementation. If I remember correctly it can even take advantage of SSO so they wont even need to type in their credentials, it will just use their kerberos ticket for authentication.

Then if you have additional non-AD people that need access you can create those accounts in OD and mix them together in groups to give them access.

[gliverman]

My server is now bound to AD and all the users show up… the problem is that I can not seem to figure out how to get my websites, which use LDAP for authentication, to see who is in a group. I can point them at the group that all users are in (cn=users,dc=myserver,dc=mydomain,dc=org) to let all users created in OD log into the web with no problem. What I want to do, though, is point my websites at a group I have made for users who need access to the websites called Web Users (cn=webusers,cn=groups,dc=myserver,dc=mydomain,dc=org). As of now, both my Drupal site and my Moodle site are using LDAP authentication with a base dn of cn=users,dc=myserver,dc=mydomain,dc=org for OD users and ou=LDAP Website Users,dc=mydomain,dc=org for AD users.

Any ideas?

[Author]

Posts