TweetFollow Us on Twitter

New Networking Tricks in Panther

Volume Number: 19 (2003)
Issue Number: 12
Column Tag: Programming

Patch Panel

New Networking Tricks in Panther

by John C. Welch

A quick look at some new tricks, good and bad, in Panther

What's up Doc?

So, once again, we have a major release of Mac OS X upon us, and while everyone else is ooh-ing and ah-ing things like Expose and vertical toolbars, I, MacTech's intrepid IT Geek, am plumbing the networking changes to Panther. Well, okay, so most of the UI stuff is not that exciting to me. Expose is cool I suppose, but I had my own methods of dealing with this that don't require Quartz Extreme, or yet another set of key equivalents. (Lately I've been having flashbacks to WordPerfect 5.1, and the dorky key-command templates we all needed with it.)

But Panther is a big change, and I daresay that if you're a networking type, (I'll assume you are, since you're reading a column called "Patch Panel"), Panther has a lot of stuff for you. Now, I'm not going to be able to look at everything in this column. To do so would mean the "John C. Welch" issue of MacTech, and while that's a great ego stroke, there's a hard limit to how much of me anyone should have to take in a month. Instead, I'll take a look at a key element of Panther's networking subsystem.

Active Directory Integration

This is one of the most improved areas of Panther, and the changes are a long time in coming. Personal opinions of Microsoft not withstanding, it's just sensible for Mac OS X to play nice with Active Directory. In this area, the biggest new toy is the Active Directory, (AD) plugin for Directory Services. This allows you to make your Mac a member of an Active Directory domain, and be able to play almost as nicely as a Windows box. (I say "almost" because there's a huge part of AD that requires windows, such as MSI, certain group policies, ACLs, etc.) This is quite different from the way you did this in Jaguar, which used the LDAP connector to talk to AD, and could sometimes require modifying the AD schema to work right. (To be fair, there's nothing wrong with using LDAP. It's how AD does a lot of its work, and even with the plugin, if you want certain things stored in AD, you're still going to need to modify the schema. But the plugin minimizes some of this.) As well, enabling automatic Kerberos authentication at login with Jaguar was somewhat tricky, and not for the faint of heart. You could use ADmitMac, from Thursby Systems with Jaguar, and get the same level of integration as the Panther plugin enables, along with some extras, such as better use of Windows shares, (no .DS_Store booger files littered everywhere), and support for NT 4 Domains, (Panther's plugin is AD only.) So, if you need to deal with NT 4 domains, or need to integrate Jaguar with AD, ADmitMac is a great solution, albeit not free. But then again, neither is Panther. In any case, with Panther, AD just got a lot easier.


Directory Access in Panther

So, as we see above in the Directory Access application, AD now has its own entry. Click on Active Directory, hit "Configure..." and you get the following screen:


Active Directory Plugin Configuration

To add, or bind a computer to an Active Directory domain, you enter in the forest name, the domain name, and the computer name. If you don't have a separate domain, then use the forest name. Click on the "Bind..." button, (It says "Unbind..." here because my laptop is already bound to a domain.), enter in your Mac OS X admin password, and the userid and password of a user that is able to add machines to an AD domain, and you're set. Note that the userid and password for the AD domain does not have to be the logins for local users on that machine. In my case, they're completely different. If there are no errors, then your machine is now a part of an AD domain. There are a few options that can make your life easier here. "Cache last user logon for offline operations" is very handy for laptops, so that you can log onto your machine and get work done, even when you're off the network. If you have a large AD forest, the "Authenticate in multiple domains" can make your life easier. "Prefer this domain server:" allows you to specify what domain server to authenticate to when available. Unless you have a specific need for this, leave it unchecked. (If you have to ask if you need this, the answer is probably "no".) "Map UID to attribute:" allows you to map the unique User ID to a specific AD attribute instead of letting AD handle this. Again, if you aren't sure you need to do this, leave it alone. "Allow administration by:" lets you give admin rights to users in certain domain groups. By default, the domain admins and enterprise admins groups are used if this option is enabled, and you can add others if you like. This allows AD administrators to have administrator rights on a Mac OS X machine without having to create local accounts for them.

However, if you have to set up the plugin on multiple machines, using the UI tools can get a bit tedious. They still work, but automating the Directory Access application is fairly tedious. Luckily, you can completely set up the AD plugin via the command line, and the dsconfigad application. The man page for dsconfigad is pretty complete, and has some nice examples. So, to add a machine to a domain, the command line would look like the example in the man page:

dsconfigad -a ThisComputer -u "administrator" -ou 
"CN=Computers,OU=Engineering,DC=ads,DC=demo,DC=com" -forest ads.demo.com -domain 
domain.ads.apple.com

The man page gives clear examples of using dsconfigad to set up all the different features of the plugin. Including a command line configuration option makes the plugin much easier to use with other management tools, even if your management console is running a different flavor of Unix, or even Windows. Cross-platform automation in the IT space is a good thing.

Authentication and Contacts setup

By default, Mac OS X will search through the local authentication domains first, then any external directories. If you have multiple authentication directories, or you want to force a specific order, then you can create custom authentication paths as in the image below:


Setting custom authentication paths

This tells Directory Services where to look, and in what order when performing authentication operations on a given machine. Now, there's another thing that we use directories for, namely as distributed address books. If we take a look at the "Contacts" tab in directory services, we see that it looks much the same as the Authentication tab, and you can set up custom search paths there as well, like in this image:


Setting custom Contacts paths

If you do this in Panther with Active Directory, you get one immediate bonus. Address Book, and therefore Mail can now use Active Directory's Global Address List, or GAL, to look for email addresses when sending mail.

Once you have this set up, how's it work? Well, pretty darn well so far. I can log into my laptop using my AD login identity, with no local account creation. My home directory is created, and I have access to all my Mac applications. When I connect to shares on the Windows network that I have access to, I don't have to supply additional credentials for them, they just work. So the single signon aspects of Active Directory work with Panther as well. This is due to the other part of the AD plugin's magic, namely it's Kerberos support. When I log into my AD domain, since AD and Panther both heavily use Kerberos, I automatically get my Kerberos tickets. So when I attempt to use AD services, like access to network file shares, I don't have to re-enter my user information. One signon does it all, thanks to Kerberos.

The only real problem I ran into was a momentary problem with DNS. Like a lot of network services in Mac OS X, the AD plugin makes heavy use of reverse DNS lookups to get information on the AD domain so that it can interoperate correctly. When I first tried to bind to the domain, I kept getting reverse DNS errors. Nothing seemed to be wrong, and by the next morning everything was working fine, and I could bind with the domain, so I'm not really sure what went wrong there, or what got fixed, since nothing was changed on the AD side.

This is a major benefit to Apple and Mac OS X in almost every market they compete in. Regardless of your opinion of Microsoft, Active Directory is one of the most popular directory systems on the market, and with good reason. It's flexible, fairly secure, (As a product. While Windows tends to have a lot of security holes, AD has been pretty clean here.), and had excellent management tools. It's very dominant in the enterprise, and is gaining ground in both the higher ed and k-12 markets. Integrating well with AD is critical for Apple to go from a reluctantly accepted platform to an accepted alternative to Windows on the desktop and Linux in the server room.

I know that in my case, the ease of setup of the plugin, and the functionality it provides is going to make my Macs a much more accepted part of the network. This doesn't mean that we automatically start buying Macs by the truckload, but in the future, if I bring up Mac OS X as a solution to a problem, there won't be the automatic "Macs can't integrate with AD" dismissal.

There are still a few things that need to be done on the integration side, such as creating a Microsoft Maintenance Console, (MMC) snap-in for Mac OS X, so that you can properly manage Macs with the Windows AD administration tools. Giving Windows administrators a way to use Group Policies with Macs would be another good idea too. Since most Mac OS X applications don't use a resource fork, it has more flexibility with installation sources than Mac OS 9 did, so there is at least a theoretical potential for MSI integration that I would like to see explored a little more. However, for a first implementation, the plugin works quite well.

Conclusion

Obviously Panther contains far more networking improvements than just an Active Directory plugin, but the plugin is a major new feature that will help Apple be thought of as a much better player in the enterprise space. No matter how you look at it, this can only be thought of as good for Apple and the Mac community.


John Welch <jwelch@provar.com> is a Technical Strategist for Provar, (http://www.provar.com/) and the Chief Know-It-All for TackyShirt, (http://www.tackyshirt.com/). He has over fifteen years of experience at making Macs, and other computers work. John specializes in figuring out ways to make the Mac do what nobody thinks it can, showing that the Mac is a superior administrative platform, and teaching others how to use it in interesting, if sometimes frightening ways. He also does things that don't involve computers on occasion, or at least that's the rumor.

 
AAPL
$105.22
Apple Inc.
+0.39
MSFT
$46.13
Microsoft Corpora
+1.11
GOOG
$539.78
Google Inc.
-4.20

MacTech Search:
Community Search:

Software Updates via MacUpdate

f.lux 34.0 - Adjusts the color of your d...
f.lux makes the color of your computer's display adapt to the time of day, warm at night and like sunlight during the day. Ever notice how people texting at night have that eerie blue glow? Or wake... Read more
Ember 1.8.2 - Versatile digital scrapboo...
Ember (formerly LittleSnapper) is your digital scrapbook of things that inspire you: websites, photos, apps or other things. Just drag in images that you want to keep, organize them into relevant... Read more
Tonality Pro 1.1.2 - Professional-grade...
Tonality Pro gives you the power to create stunning and dramatic black & white images. This is a complete monochrome image editor with more than 150 one-click style presets, totally unique... Read more
VueScan 9.4.49 - Scanner software with a...
VueScan is a scanning program that works with most high-quality flatbed and film scanners to produce scans that have excellent color fidelity and color balance. VueScan is easy to use, and has... Read more
OS X Server 4.0 - For OS X 10.10 Yosemit...
Designed for OS X and iOS devices, OS X Server makes it easy to share files, schedule meetings, synchronize contacts, develop software, host your own website, publish wikis, configure Mac, iPhone,... Read more
TotalFinder 1.6.12 - Adds tabs, hotkeys,...
TotalFinder is a universally acclaimed navigational companion for your Mac. Enhance your Mac's Finder with features so smart and convenient, you won't believe you ever lived without them. Tab-based... Read more
BusyCal 2.6.3 - Powerful calendar app wi...
BusyCal is an award-winning desktop calendar that combines personal productivity features for individuals with powerful calendar sharing capabilities for families and workgroups. BusyCal's unique... Read more
calibre 2.7 - Complete e-library managem...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital... Read more
Skitch 2.7.3 - Take screenshots, annotat...
With Skitch, taking, annotating, and sharing screenshots or images is as fun as it is simple.Communicate and collaborate with images using Skitch and its intuitive, engaging drawing and annotating... Read more
Delicious Library 3.3.2 - Import, browse...
Delicious Library allows you to import, browse, and share all your books, movies, music, and video games with Delicious Library. Run your very own library from your home or office using our... Read more

Latest Forum Discussions

See All

Rami Ismail Opens Up distribute​() for D...
Rami Ismail Opens Up distribute​() for Developers Posted by Jessica Fisher on October 24th, 2014 [ permalink ] Rami Ismail, Chief Executive of Business and Development at indie game studio | Read more »
Great Hitman GO Goes on Sale and Gets Ne...
Great Hitman GO Goes on Sale and Gets New Update – Say That Three Times Fast Posted by Jessica Fisher on October 24th, 2014 [ permalink ] | Read more »
Rival Stars Basketball Review
Rival Stars Basketball Review By Jennifer Allen on October 24th, 2014 Our Rating: :: RESTRICTIVE BUT FUNUniversal App - Designed for iPhone and iPad Rival Stars Basketball is a fun mixture of basketball and card collecting but its... | Read more »
Rubicon Development Makes Over a Dozen o...
Rubicon Development Makes Over a Dozen of Their Games Free For This Weekend Only Posted by Jessica Fisher on October 24th, 2014 [ permalink ] | Read more »
I Am Dolphin Review
I Am Dolphin Review By Jennifer Allen on October 24th, 2014 Our Rating: :: NEARLY FIN-TASTICUniversal App - Designed for iPhone and iPad Swim around and eat nearly everything that moves in I Am Dolphin, a fun Ecco-ish kind of game... | Read more »
nPlayer looks to be the ultimate choice...
Developed by Newin Inc, nPlayer may seem like your standard video player – but is aiming to be the best in its field by providing high quality video play performance and support for a huge number of video formats and codecs. User reviews include... | Read more »
Fighting Fantasy: Caverns of the Snow Wi...
Fighting Fantasy: Caverns of the Snow Witch Review By Jennifer Allen on October 24th, 2014 Our Rating: :: CLASSY STORYTELLINGUniversal App - Designed for iPhone and iPad Fighting Fantasy: Caverns of the Snow Witch is a sterling... | Read more »
A Few Days Left (Games)
A Few Days Left 1.01 Device: iOS Universal Category: Games Price: $3.99, Version: 1.01 (iTunes) Description: Screenshots are in compliance to App Store's 4+ age rating! Please see App Preview for real game play! **Important: Make... | Read more »
Toca Boo (Education)
Toca Boo 1.0.2 Device: iOS Universal Category: Education Price: $2.99, Version: 1.0.2 (iTunes) Description: BOO! Did I scare you!? My name is Bonnie and my family loves to spook! Do you want to scare them back? Follow me and I'll... | Read more »
Intuon (Games)
Intuon 1.1 Device: iOS Universal Category: Games Price: $.99, Version: 1.1 (iTunes) Description: Join the battle with your intuition in a new hardcore game Intuon! How well do you trust your intuition? Can you find a needle in a... | Read more »

Price Scanner via MacPrices.net

Weekend sale: 13-inch 128GB MacBook Air for $...
Best Buy has the 2014 13-inch 1.4GHz 128GB MacBook Air on sale for $849.99, or $150 off MSRP, on their online store. Choose free home shipping or free local store pickup (if available). Price valid... Read more
Nimbus Note Cross=Platform Notes Utility
Nimbus Note will make sure you never forget or lose your valuable data again. Create and edit notes, save web pages, screenshots and any other type of data – and share it all with your friends and... Read more
NewerTech’s Snuglet Makes MagSafe 2 Power Con...
NewerTech has introduced the Snuglet, a precision-manufactured ring designed to sit inside your MagSafe 2 connector port, providing a more snug fit to prevent your power cable from unintentional... Read more
Apple Planning To Sacrifice Gross Margins To...
Digitimes Research’s Jim Hsiao says its analysts believe Apple is planning to sacrifice its gross margins to save its tablet business, which has recently fallen into decline. They project that Apple’... Read more
Who’s On Now? – First Instant-Connect Search...
It’s nighttime and your car has broken down on the side of the highway. You need a tow truck right away, so you open an app on your iPhone, search for the closest tow truck and send an instant... Read more
13-inch 2.5GHz MacBook Pro on sale for $949,...
Best Buy has the 13″ 2.5GHz MacBook Pro available for $949.99 on their online store. Choose free shipping or free instant local store pickup (if available). Their price is $150 off MSRP. Price is... Read more
Save up to $125 on Retina MacBook Pros
B&H Photo has the new 2014 13″ and 15″ Retina MacBook Pros on sale for up to $125 off MSRP. Shipping is free, and B&H charges NY sales tax only. They’ll also include free copies of Parallels... Read more
Apple refurbished Time Capsules available sta...
The Apple Store has certified refurbished Time Capsules available for up to $60 off MSRP. Apple’s one-year warranty is included with each Time Capsule, and shipping is free: - 2TB Time Capsule: $255... Read more
Textilus New Word, Notes and PDF Processor fo...
Textilus is new word-crunching, notes, and PDF processor designed exclusively for the iPad. I haven’t had time to thoroughly check it out yet, but it looks great and early reviews are positive.... Read more
WD My Passport Pro Bus-Powered Thunderbolt RA...
WD’s My Passport Pro RAID solution is powered by an integrated Thunderbolt cable for true portability and speeds as high as 233 MB/s. HighlightsOverviewSpecifications Transfer, Back Up And Edit In... Read more

Jobs Board

*Apple* Solutions Consultant - Apple Inc. (U...
…important role that the ASC serves is that of providing an excellent Apple Customer Experience. Responsibilities include: * Promoting Apple products and solutions Read more
Senior Event Manager, *Apple* Retail Market...
…This senior level position is responsible for leading and imagining the Apple Retail Team's global event strategy. Delivering an overarching brand story; in-store, Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Project Manager / Business Analyst, WW *Appl...
…a senior project manager / business analyst to work within our Worldwide Apple Fulfillment Operations and the Business Process Re-engineering team. This role will work Read more
*Apple* Retail - Multiple Positions (US) - A...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.