Using the AD-Plugin from the Command Line in Font

Printing QR Code ISO/IEC18004 in Font Using the AD-Plugin from the Command Line

It may become necessary to bind a Mac to Active Directory using the Active Directory plug-in from the command line. Perhaps you need to force the binding, you want to use a setting not available in the GUI, or you want to use the Active Directory plug-in in a server script. For times like these, you will find the command dsconfigad to be handy. dsconfigad does not require root privileges to run and can be used from the command line to force certain aspects of directory services to work even when the GUI will not bind clients as needed. These include the following: -enableSSO enables Kerberos authentication for services, such as AFP, by generating Kerberos principals (commonly used with the magic triangle, described in the next section). -ggid maps group ID information. -mobile automates the enabling of mobile accounts. -preferred enables the use of a preferred server.

-localhome places the home folder on the local system rather than using a server shared home. -f forces the command to run (which is useful when forcing an unbind). These become very helpful with scripting. A script can be told to run on the first access of an imaged system. This allows for easy mass deployment and for the scripting of specific options to be pushed out to clients for binding.

Setting up the magic triangle involves the administrator building an Open Directory infrastructure, binding it to an Active Directory infrastructure, and then binding the clients to both Active Directory and Open Directory. It is a common way in the Mac OS X Server community to get Mac management policies and still use centralized Active Directory based directory services. This seemingly awkward setup results in Active Directory handling password authentication and Open Directory handling policy management, giving administrators a fairly simplistic way to manage their Mac systems, even if within the confines of Active Directory. It is also possible to extend the Active Directory schema (which Windows administrators are generally resistant to) to include MCX attributes that can be used to manage Mac workstations or use augmented records (a new feature in Leopard Server). To set up a magic triangle, promote your first server to an Open Directory master. Next you will need to strip the KDC functionality out of Open Directory since Kerberos functionality will be hosted by Active Directory. To do this, remove Kerberos from sso_util using the sso_util command as follows: sudo sso_util remove -k a <diradmin> -p <pass> Next you will need to delete any stale Kerberos configuration data if there is any. If there isn t any, you will receive an error that the data could not be found, which is fairly common with newer installations. To remove the stale Kerberos data, use the following two commands: dscl -u <diradmin> /LDAPv3/127.0.0.1 -delete /Config/KerberosKDC dscl -u <diradmin> /LDAPv3/127.0.0.1 -delete /Config/KerberosClient Then, bind the server into Active Directory as described in previous sections. Once the Open Directory server is bound into Active Directory, it is possible to reenable single sign-on functionality. To do so, run the following command: dsconfigad -EnableSSO Now, bind Mac clients into both directory structures (using the same steps for both Open Directory and Active Directory that were mentioned previously). Active Directory will now process user credentials, and Open Directory will now process system policies for the Mac clients.

Note We have stepped through this in a very simplistic manner. In reality, you might have a variety of problems with DNS, Active Directory, Open Directory, or server communications. If this is the case, check the forums at http://www.AFP548.com to see whether others have experienced the same issues and published fixes for them.