Tiger Server: OD Group Oddities

[bschwark]

Tiger Server 10.4.8 Open Directory Master. Lately have been having weird issues manifest themselves with Open Directory groups and both ACL or POSIX permissions on shares. Let’s say ‘user’ is a member of group ‘a’. Group ‘a’ is defined in an ACL as having read/write permissions for a certain share. While other members of group ‘a’ have read and write access to the share (as verified using the effective permissions inspector in Workgroup Manager), ‘user’ will quite often have no access to the resource, despite being defined in the group and there being no other conflicting ACLs to deny that user (i.e., user is also part of group ‘b’ which is denied access). Even deleting all ACLs and relying on POSIX permissions for the group have no effect. The strange thing about this is that it has been manifesting itself with different users inexplicably, without any change to the ACL or POSIX configurations on any of the shares. Often, we have to explicitly add the user in question to the ACL in order to rectify the situation. I have been able to fix the situation once by completely deleting the user in question, recreating their account, and readding them to the group, but this obviously is an unacceptable way to handle the situation. I thought that the situation may have been an issue with access via SMB, but it also occurs via AFP and considering that the effective permissions inspector in WM shows the problem as well makes me figure it’s something deeper with OD that’s borked.

Has anyone experienced this issue, or have suggestions as to where I need to look next? I’ve tried to fish through various logs to see if anything comes up awry, but it all looks kosher – I’m at a loss as to where to look next.

[wandal]

Something similar is happening to me.

I migrated the group folders from the old G4 to the new XServe. Kerberos is not running, just OD auth. No ACL on the shared disk. I have group ‘a’ that is the main group every registered OD user belongs to. Each user may also belong to one or more out of three groups, ‘b’ ‘c’ and ‘d’. I am the user ‘mike’, belonging to the group ‘a’ and the group ‘b’.

Now the issue. I login as ‘guest’ to a machine on the LAN, then I go thru network-server (or cmd-K) to access the shared folder for group ‘b’ on the XServe disks. Login okay with userd ‘mike’ an password, then I see all the shared disks and the folders on it (group ‘a’ membership should be ok). When I try to open the group ‘b’ folder, I can’t. Permission denied. Just like ‘mike’ is not belonging to group ‘b’. Surprisingly, the issue is present only on a few machines, not on each one. I thought the problem arises on the identifying system of each user, particularly on the generateduid for the user/group. Maybe the cache of the osolete generatedid on the client machine.

I tried this on the client machine: 1) Open Directory Access and deactivate the LDAPv3 service. 2) Reboot the client machine. 3) Open Netinfo Manager, and delete the MCX Cache: groups users machines. 4) Open Directory Access and activate the LDAPv3 service. 5) Reboot the client machine.
This solved the problem. Anyway I am still investigating the issue.

[Author]

Posts