[rstasel]

Hmmm… I hadn’t thought of quotas. Damn.

Guess I may be looking at Augments myself. Do we know if Augments in 10.6 can be added to OD groups?

[rstasel]

cmra,

Thinking about this, it sounds like the AFP server that’s hosting the home directories isn’t a member of the Kerberos realm. That would be why it’s asking for a network login…

I could be wrong, but that’s certainly what it sounds like.

[rstasel]

Here’s what I have:

Create Mobile Account: true
Create Mobile Home with Local User Template: true
Create Portable Home Directory: false
Mobile Account Lifetime: 86400
Mobile Home Location: path
Mobile Home Parent Path: /Users
Require Sync to Delete Mobile Account: true
Show Mobile Account Dialog: false
Synchronization URL: afp://server.example.com/Users/%@
Time Server: time.apple.com

[rstasel]

I get similar results on 10.5.8 clients. It creates the home on the client, and even mounts the /Users share from the server, but it doesn’t create the home folder on the server, so sync doesn’t work. If I create the folder on the server, it works perfectly!

So, the steps required would be adding the AD user to the OD group, and then manually creating their home directory on the Users share.

Haven’t tried with 10.6 yet, but, this is extremely promising in 10.5.8.

[rstasel]

We’re looking at something similar… where we’re tying into central IS AD for auth, but want to provide network homes/PHDs for people via an OD/AFP solution (which is what we’re doing now, completely outside of AD).

Mike Bombich’s info about augments for 10.5 seem like what you have to do, but I’m stopped in my tracks by the fact you can’t add augment user records to OD groups. We have to lock down who can use our computers to just those who are within our program (not everyone at the university).

I’m not sure why Apple hasn’t implemented some function where you can have a “default” user record within OD that says “augment all records coming from AD with this template”, that would say “NFSHomeDirectory = /Network/Servers/server.example.com/Users/%username%”, etc. Then we’d just add the AD users to an OD group and be done with it.

Creating an augment record for each user, when they’re all “the same” seems a bit extreme.

Any additional info that can be supplied would be extremely helpful. Ideally this would also work on 10.5.8 clients since we still have some of those around to… if not, please note what isn’t possible on 10.5.x?

Thanks!

[rstasel]

I’d suggest looking at this:

http://support.apple.com/kb/HT3655

It actually works.

[rstasel]

These accounts did indeed result from the upgrade from 10.2 to 10.3.

I have removed them, and it seems to have fixed the error with no ill side effects.

If this happens to anyone else, feel free to remove them. Though, I’d make an OD backup first.

[rstasel]

okay, I just answered my own question…

[code]mkpassdb -dump | grep username[/code]

will return slot-id and last account modification/login time (if you enable/disable an account, it updates that date/time… so it’s not just last login).

*sigh* Well, at least it’s here for posterity.

[rstasel]

You can do this in dscl…

Assuming it was run on the OD server…

dscl /LDAPv3/127.0.0.1 -list /Users PrimaryGroupID | grep 20 | cut -d’ ‘ -f1

This would return all the uid’s that have group 20 (staff) as their primary group. Combine that with something that looks at the group itself for members, and you could construct a complete list. =/

Should be able to do something similar with ldapsearch, but I’m too used to using dscl.

[rstasel]

MacTroll,

Yeah, that makes sense. But, still, where’s the white paper on this? Or some type of “feel good” official documentation? The Online Seminar is fine (though the server that those are on must be on a DSL connection or something, cause it streams horribly, and downloads at 40KB/sec), but it doesn’t really give you something that you can point your boss to and say “here’s what we want to do”.

[rstasel]

Seemingly other people are getting this too (google AppleFileServer sigbus).

10.5.7 does not resolve. Only solution anyone has found yet, to my knowledge, is to remove the “deny all” ACL from shares/folders within shares. Apple considers this an “unacceptable workaround”.

Since we notified them of this back in January, and it STILL didn’t make it into 10.5.7, it’s seeming more and more likely this won’t get fixed until 10.6, if we’re lucky.

Great…

See thread here: http://discussions.apple.com/thread.jspa?threadID=1975848

[rstasel]

further correction, that error was due to a home folder not mounting correctly. I changed the home folder, and now kinit for a user that’s missing kerberos info in their account works.

Odd. I wouldn’t think this should work…

[rstasel]

okay, correction.

I manually ran mkpassdb -kerberize, and now kerberos works. I can get issued a ticket on an account that has the kerberos authentication info in their user account. A user that does not have that info gets an error :

kinit: Unable to create principal for current user: Unknown Error Code: 118
kinit: Error getting initial tickets: Operation not permitted

So, still having the initial issue.

[rstasel]

Seemingly, no.

No matter what I try, I keep getting: “Kerberos Login Failed: Client not found in Kerberos database” on the actual OD master machine. The machine is listed in computers in the OD, and has a kerberos entry.

Users with or without the kerberos auth info get the same response.

Thoughts?

[rstasel]

leaving the process running over the weekend changed nothing.

I can’t help but think this is a bug in slapconfig, as mkpassdb -kerberize runs fine otherwise.

[Author]

Posts