unable to Join 10.7 client to 10.5.8 Open Directory Master ?

[reippuert]

Hi im unable tobind 10.7 clients to our 10.5.8 Open Directory Master (set up in a magic triangle) – has anyone succeded in binding 10.7 clients to 10.5.8 Open Directory?

When i bind from GUI im not getting a prompt, like i do on our 10.5 and 10.6 clients.
Wehn i tjeck settings it looks like the client is unable to pull our schema from the od master.

when i try to bind from GUI i get the following error.

bash-3.2# dsconfigldap -fvi -a od_master -c client_hostname -n configname -u diradmin -l localaccount
dsconfigldap verbose mode
Options selected by user:
Force authenticated (un)binding option selected
Interactive password option selected
Add server option selected
Server name provided as
LDAP Configuration name provided as
Computer ID provided as
Network username provided as
Local username provided as
Adding new node to search policies

Please enter network user password:
Please enter local user password:
Error: The attribute value could not be used because it does not meet the requirements of the attribute. (4202)
bash-3.2#

[st3w13]

reippuert, we have the same problem.

I can replicate your error. Also, I noticed if you add the OD master first (dsconfigldap -a myod.company.com) then try to bind (dsconfigldap -fvi -a myod.company.com -c mymac -n myodconf -u directoryadmin -l admin), you’ll get an error “Computer with the name ‘mymac’ already exists” even though mymac does not have a directory entry. Provide any computer name & it errs with a similar message.

I turned on OD debugging in Lion (with odutil set log debug) & ran these commands. With no assigned OD, I noticed this log entry:

Node: /LDAPv3/myod.company.com - queuing request to connection - '/LDAPv3/myod.company.com:ldap:D79ACA28-BE35-4566-BF6D-131FC5C3BCBF'
Node: /LDAPv3/myod.company.com, Module: ldap - calling request handler
Node: /LDAPv3/myod.company.com, Module: ldap - adding superior 'top' to class list for objectclass 'apple-computer'
Node: /LDAPv3/myod.company.com, Module: ldap - adding required attributes for objectClass 'apple-computer'
Node: /LDAPv3/myod.company.com, Module: ldap - adding required attributes for objectClass 'top'
Node: /LDAPv3/myod.company.com, Module: ldap - adding attribute - 'objectClass'
Node: /LDAPv3/ldap://myod.company.com, Module: ldap - creating record with DN - cn=mymac$,cn=computers, dc=myod,dc=company,dc=com
Node: /LDAPv3/ldap://myod.company.com, Module: ldap - Audit - Record attribute value schema error (4202) - Create record type Computers 'mymac$' node '/LDAPv3/ldap://myod.company.com'

Executing with the OD already added I don’t notice anything unusual in the log other than “Trigger – cancelled.”

Noticing the “cn” attribute is used & that the Search & Mappings > Default Attribute Types is empty (Leopard & Snow Leopard show entries here) I attempted to recreate them, especially RecordName = cn. But alas, the custom settings do not get saved. (If you create a new record & attributes, however, they do save. It’s only the Default Attribute Types record that appears broken, & you can’t delete & recreate it either.)

I’m still looking for a solution. But figured I would to add to you post in the hope it may be helpful to you.

[st3w13]

reippuert, any update? I haven’t been able to work on this issue lately but the problem persists. Any additional info would be appreciated.

[electrowave]

I am having a problem binding a 10.7 client to a 10.5.8 OD server as well. We get an error that the computer name already exists and the user doesn’t have sufficient privileges to overwrite.

The computer definitely does not exist on the server, and the user name is directory admin so it definitely does have rights. We were told to attempt to remove the LKDC certificates and recreate them to hopefully create a new unique LKDC for OD to see, this proved to be of no help to us.

Not sure where to go from there.

[electrowave]

I had this same problem, we have since fixed the issue. The issue is Lion can not bind to a 10.5.8 server that requires Authenticated Binding. In order to have Lion bind to OD with authenticated binding you need at least 10.6 server. The way to get around this is to disable authenticated binding on the OD Master (Just uncheck “Enable authenticated binding”) Here is the other catch, if you disable this then your clients that are currently connected (We had over 300) will now require unbinding and rebinding, we were not looking to do this.

So there SHOULD be a second box under “Enable Authenticated Binding” that says “Require authenticated Binding” uncheck this and this will allow you to either authenticate or not authenticate, allowing new machines right away access and the old machines access without changing a thing.

Here is where we had a problem with that. For some reason our Admin Utility on our server was missing that second option to require authentication, that’s why I stressed SHOULD be there haha. The way we fixed this was to just install the admin tools on a client computer that was running the same version as our server (10.5.8) pointed it to our xServe server then the option was there on the client computer (still not the server) and we were able to then bind all the Lion Mac Books at that point.

Hope this helps!

Good luck

[Author]

Posts