[speleo]

Hello again

Well, obviously no one is having a similar problem… but maybe some of you can help me out with some information which might enable me to find ot what’s wrong myself.
So I did some (many) tests, including setting up a 10.4 test server with a 10.4 test client to try and find out what exactly the difference is between managing user access in 10.4 an 10.5 (and to make sure that I’m not starting to imagine things and it WAS actually working under 10.4!). There are some questions remaining, though.

Fact is, the management of user / group access to computers is done very differntly in 10.4 and 10.5:
In 10.5, the GUID of user groups that are allowed to access computers of a computer group is stored in the respective ComputerGroup in the attribute “MCXSettings” in the key “Allow-List”. The OD server then sends the file com.apple.loginwindow.plist to the client, where it is stored in /Library/ManagedPreferences.
In 10.4, the short names of authorized user groups are stored in the ComputerList in the attribute “apple-computer-list-group” (I haven’t found out how the list of these groups gets to the client, and where it is stored there, if it is at all).
Thus, the difference between 10.4 and 10.5 is a) how the authorized groups are stored (short name vs. GUID) and b) where they are stored (apple-computer-list-groups vs. MCXSettings). If a user group contains users from an external LDAP server, access control to a computer list /group works for those users under 10.4 (i.e. members of that group can log in, non-members can’t), whereas it doesn’t work under 10.5 (no LDAP users can log in, regardless whether they are a member or not). Access management does work under 10.4 and 10.5 for users that are defined on the OD server itself.

Now, my question:
A managed client gets sent the short name / GUID of the group(s) that are allowed to log in to that client (this is done differently on 10.4 and 10.5), but then, how does the client find out which users belong to that group? Does it go and check that group on the OD?
Cause I suspect that this might be my problem on 10.5, that either the client or the OD doesn’t recognize users from the extrenal LDAP server as belonging to a group that is allowed to log in… maybe?

Thanks, Tina

[Author]

Posts