News Group Posts

join mac os x to win 2003 active directory

From: "Matthew X. Economou" <xenophon+usenet@irtnog.org>
Subject: Re: AD-2k3 & SSO in Mac Rich Environment
Date: 16 Aug 2005 12:32:12 -0400
Message-ID: <uiry5sv03.fsf@irtnog.org> 
References: <1124131565.358509.81530@o13g2000cwo.googlegroups.com>
<3md7dlF16d658U1@individual.net> 

>>>>> "Scott" == Scott Lowe <me@privacy.net> writes:

    Scott> Have you looked at having the Macs bind to Active
    Scott> Directory?

I've done this.  I couldn't find a documented procedure, but this
process works for me:

    1. Open '/Applications/Utilities/Directory Access.app.

    2. Enable the Active Directory service.

    3. Configure the Active Directory service as follows:

        Active Directory forest -- 'example.com'

        Active Directory domain -- 'example.com' or
         'childdomain.example.com'

        Computer ID -- Enter the host name of the computer.

        Cache last user logon for offline operation -- Checked.

        Authenticate in multiple domains -- Depends on whether you
         want to allow cross-domain authentication.

        Prefer this domain server -- Unfortunately, until the computer
         account has time to replicate to all domain controllers in
         the domain, configure the client to only communicate with one
         of the domain controllers, e.g. 'dc1.example.com'.

        Map UID to attribute -- NOT checked.  I haven't figured out
         how to make this work without extending the Active Directory
         schema.  If you already use Services for Unix, you can map
         the UID to the 'uid' attribute (created by SFU's NIS
         component).

        Allow administration by -- For example, 'EXAMPLE\Domain Admins'.

    4. Click the Bind button, enter the user name and password of
       someone who has rights to create computer accounts in Active
       Directory, and change the OU to where you want the account
       created,
       e.g. OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=example,DC=com
       (for those of us running Windows Small Business Server 2003).

    5. Change the authentication search path to 'Custom path' and add
       '/Active Directory/example.com'.

    6. Restart the computer.

    Scott> heard from others that it works reasonably well and can
    Scott> even cache the domain credentials for logons while they are
    Scott> away from the office (just like a Windows box).  It is also
    Scott> my understanding that one you do have the Macs bind to AD,
    Scott> they can take advantage of the AD Kerberos Key Distribution
    Scott> Center (KDC) for automatic access to file servers in the
    Scott> domain (with no additional passwords).

This is indeed the case, although I think it only caches 1 logon (nor
does it obey the corresponding Group Policy setting).  I haven't quite
figured out how to automagically map user's home directories and such,
but I'm sure that it is possible.

There is one glitch, however.  If you create SMB shares on the
Macintosh, e.g. the built in user file sharing mechanism
"\\mac\username", your domain users will be unable to authenticate.
For some reason, Samba and Directory Access aren't tied together, and
I haven't bothered to figure out which lines added to smb.conf will
fix this issue.

Best wishes,
Matthew

-- 
jsoffron: I'm generally pretty high on national defense...
Mr. Bad Example: Careful...it's a gateway policy. Before you know it,
 you'll be mainlining the hard stuff like trade agreements.
jsoffron: Too late...I've been freebasing Nafta all day... Sweet,
 sweet NAFTA.
    - As seen on Slashdot
 

9 comments

Click here to add your comments




Fri Oct 21 23:13:37 2005:   anonymous


I want to do the exactly thing but with Linux.
Join my mac to an linux debian samba primary domain controller.
Its that posible without installing thirdparty soft?



Sat Oct 22 09:26:17 2005:   TonyLawrence


Both machines are running Samba, so I don't see why this should be any problem unless I'm missing what you mean..



Mon Oct 24 23:42:36 2005:   anonymous


Both OS have samba.. yes, but i didnt find any howto to configure correctly.
I mean. My linux-box is OK with 4 user (users: 'john','paul','george','ringo') and my xp no users (only administrator). When i login into my xp i use any of the 4 that are in my linux. So.. the authentication works 10 points. But i cannot do that in my Mac OS 10 :(
Any idea?

(sorry my english)



Tue Oct 25 09:01:56 2005:   TonyLawrence


If you really want login authentication, you need to configure LDAP under Applications->Utilities->Directory Access. I can't find an example against Samba, but http://www.bombich.com/mactips/activedir.html is against Active Directory

But if you only need access to shares, just connect to them, fiving the domain and user authentication info. See http://www.microsoft.com/technet/technetmag/issues/2005/01/MacSecure/default.aspx





Tue Oct 25 14:57:22 2005:   anonymous


Thanks, I will test it.



Thu Sep 18 21:37:15 2008:   anonymous


why would anyone want to join a mac to an AD? other than to have some IT guy take over your mac?



Fri Jan 9 17:41:27 2009:   anonymous


The reason why you would bind OS X or Linnux to AD is to gain access to the directory. For instance, I have a Mac OS file server and I want people to be able to access the directories without creating duplicate accounts on the server or in open directory.

No IT guy will take over your Mac. You cannot do anything with a Mac in AD.



Sat Jun 13 09:52:36 2009:   anonymous


One might want to join a mac to AD for single sign on to shares. Depending on the number of shares it can be quite cumbersome to keep entering a username and password. I hahve a common user share for music (mac does not allow this feature, and don't point out share music..it is limited in many ways), Mywife becomes annouyed with entering a password everytime she wants to connect.



Sat Jun 13 11:27:33 2009:   TonyLawrence


Macs don't allow what?

:-)

Yes, Macs do :-)



Don't miss responses! Subscribe to Comments by RSS or by Email

Click here to add your comments

If you want a picture to show with your comment, go get a Gravatar

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.