TweetFollow Us on Twitter

Strangers in a foreign land

Volume Number: 23 (2007)
Issue Number: 10
Column Tag: MacEnterprise, networking

Strangers in a foreign land

Integrating OS X with Active Directory

By Philip Rinehart, Yale University

Active Directory!

Of the topics that come up on the Macenterprise list, Active Directory and its integration with OS X is discussed frequently. Why? Many environments are using Active Directory for integration for the Windows side of the house, and many Mac administrators don't want to manage the information store separately for Macs alone. This month we will look at some tips for working with the Active Directory plug-in. Let's get started!

Binding

Binding, what is it? Directory Services uses a machine account and "binds" the account to the Active Directory domain. When logging in, the authentication framework is able to use the bound machine's account for non-local users. As a result, a user is granted access to a machine without a local account. With the Active Directory plug-in, there are a number of intricacies that make binding difficult. We will look at one of the most common issues. Before we begin this discussion, though, remember to check forward and reverse DNS, a common binding problem. For more information about testing, check out the article here, http://macenterprise.org/content/view/305/84.

Finding my Organizational Unit

Often, an administrator does not have access to the default Organizational Unit used by the Active Directory plug-in. How does an administrator find their Organizational Unit then? Fortunately, the tools for performing a lookup are built into OS X! Let's look at a rather verbose command.

ldapsearch -LLL -Hldap://yourdomaincontroller.ad.test -x -D "admin@ad.test" -b "dc=ad,dc=test" -W  "cn=activedirectorycomputerobjectname" dn

Looks rather complicated doesn't it? Fortunately, it isn't that hard to understand once we dissect it a little bit. The first option, -LLL is not strictly necessary. However, using it omits comments, restricts the output to LDIFv1 (not important here), and the last L prevents printing of the LDIF version.

Next, the -H option is specified. This option is very important! Enter the URI of a domain controller that has a copy of the Global Catalog. Ldapsearch uses this domain controller to look up information about a computer account.

Next, the -x option is used for simple authentication, not SSL. In some cases, SSL is not used on domain controllers. The -D option is important, as it supplies the Active Directory credentials that are used to authenticate for the LDAP search.

-b provides the search base. The search base is the point in the LDAP tree where the search should begin. If unsure, enter the top level of the forest. -W is similar to using the -x option, telling ldapsearch to prompt for the password, instead of supplying it with the ldapsearch command.

The last two entries are used to get the actual Organizational Unit path. The first option "cn=activedirectorycomputerobjectname" looks for the computer account in Active Directory. The last option tells ldapsearch that only the dn attribute is important. It's o.k. not to specify it, but every attribute is then returned. Sounds like a lot, doesn't it? Try executing the command once. After you have the hang of it, you will find how powerful ldapsearch can be. As a sanity check, here's an example of how the ldapsearch results might appear:

dn: CN=mbp,OU=One,OU=Two,OU=Three,OU=Four,DC=ad,DC=test

With this information, it's easy to determine the OU path for machine binding. Note however that the machine account must exist before this search is executed. The command and its results could also be wrapped in Applescript, an Automator action, or any other scripting language. Once the machine is bound, the fun begins!

Static maps

One of the hidden gems of the Active Directory plug-in is the ability to use "static maps". Usage of static maps was originally conceived for usage with the LDAP plug-in, but it can now be used for mapping any needed attributes. Let's use an example. On the list, a discussion about using NFS shares on Active Directory asked about how to provide an attribute for each user logging in that would be exactly the same. Static maps to the rescue! Here's how to do it:

This will require a little bit of command line magic. Open a terminal, and enter the following command:

dsconfigad -staticmap attributetype attributevalue

Three attributes should not be statically mapped, UID, RecordName and GeneratedUID. As stated in the man page, mapping these attributes may produce "unexpected" results. What is the syntax? It's pretty simple, first the attribute value. Attribute values are preceded by a pound sign "#". If the goal is to have every non-local user use the same value, enter #value to provide each user with that value at login. Another feature, variable mappings, is not available with the Active Directory plug-in. It should also be noted that using static maps is only available from the command line using dsconfigad.

Timeout values

Controlling the timeout values for the Active Directory plug-in involves editing the ActiveDirectory.plist in /Library/Preferences/DirectoryService. First, note that this procedure is completely unsupported by Apple! A very common problem occurs with mobile accounts and Active Directory is extremely slow logins. This problem commonly occurs due to the fact that the Domain Controller is firewalled, and unavailable outside the corporate network. For each Domain Controller, a value of 240 seconds is assigned. Imagine what happens when the laptop user goes home. Login times, and even wake from sleep times can become almost unbearably long. Fortunately, an administrator who knows what values to change in the plist can alter them, reducing the timeout times manually. Open the ActiveDirectory.plist in your favorite editor. Next search for the following entries:

<key>LDAP Connection Timeout</key>
<string>240</string>

This entry usually occurs in multiple places. Depending on your environment, change the value to a lower value. Restart the computer, and the timeout values should be in effect. It has been reported that for some environments the value may get overwritten, but in my experience it has worked.

Question marks in the Dock

The last thing that appeared recently is the appearance of a host of question marks in the dock on Intel-based machines when using the Active Directory plug-in with mobile accounts. Credit Mike Yocom and Brian Warsing for this solution. It is a bit involved, but does solve the problem quite nicely.

Step one: Convert com.apple.dock.plist for each user to xml. This task is best accomplished with a loginhook. Here is the command:

plutil -convert xml1 -o /tmp/foo.xml com.apple.dock.plist

Step two: Use a bit of xmlmagic, using xsltproc to filter out "_CFURLAliasData" entries from the plist.

xsltproc -o com.apple.dock.plist /path/to/style-sheet/com-apple-dock-style.xsl /tmp/foo.xml

And the required style sheet:

<?xml version='1.0' encoding='utf-8'?>
<xsl:stylesheet version='1.0'
xmlns:xsl='http://www.w3.org/1999/XSL/Transform'>
<xsl:output method='xml' version='1.0' encoding='utf-8' indent='yes'
doctype-public="-//Apple Computer//DTD PLIST 1.0//EN"
doctype-system="http://www.apple.com/DTDs/PropertyList-1.0.dtd"/>
<!-- This template copies the entire root -->
<xsl:template match="@*|node()">
    <xsl:copy>
        <xsl:apply-templates select="@*|node()"/>
    </xsl:copy>
</xsl:template>
<!-- This template removes the _CFURLAliasData node -->
<xsl:template match="array/dict/dict/dict/key">
    <xsl:variable name="foo">
        <xsl:value-of select="." />
    </xsl:variable>
    <xsl:choose>
        <xsl:when test="$foo = '_CFURLAliasData'">
            <!-- Do nothing. I mean don't print it -->
        </xsl:when>
        <xsl:otherwise>
            <!-- Output a copy of the orig. node -->
            <xsl:copy-of select="." />
        </xsl:otherwise>
    </xsl:choose>
</xsl:template>
<!-- This template dumps the data nodes with the alias data -->
<xsl:template match="array/dict/dict/dict/data">
    <xsl:for-each select="." />
</xsl:template>
</xsl:stylesheet>

Step 3: There is no step 3!

It really is that simple once all of the pieces are in place, and solves the immediate problem so that question marks will not appear in the dock. This month, we've tackled some of the most recent issues with Active Directory. As always, Active Directory integration continues to be a very complex problem, as each environment has unique qualities. Keep sending in feedback to Apple, and keep discussing on the lists, to make the Active Directory plug-in as good as it can be! One last thing, check out the following Best Practices paper about Active Directory integration from Apple: http://images.apple.com/itpro/pdf/AD_Best_Practices_2.0.pdf. It also supplies very useful information about troubleshooting and integration. Until next month, see you on the lists!


Philip Rinehart is co-chair of the steering committee leading the Mac OS X Enterprise Project (macenterprise.org) and is the Lead Mac Analyst at Yale University. He has been using Macintosh Computers since the days of the Macintosh SE, and Mac OS X since its Developer Preview Release. Before coming to Yale, he worked as a Unix system administrator for a dot-com company. He can be reached at: philip.rinehart@yale.edu. The MacEnterprise project is a community of IT professionals sharing information and solutions to support Macs in an enterprise. We collaborate on the deployment, management, and integration of Mac OS X client and server computers into multi-platform computing environments.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

TextSoap 8.4.1 - Automate tedious text d...
TextSoap can automatically remove unwanted characters, fix up messed up carriage returns, and do pretty much anything else that we can think of to text. Save time and effort. Be more productive. Stop... Read more
TextSoap 8.4.1 - Automate tedious text d...
TextSoap can automatically remove unwanted characters, fix up messed up carriage returns, and do pretty much anything else that we can think of to text. Save time and effort. Be more productive. Stop... Read more
Backblaze 4.3.0.44 - Online backup servi...
Backblaze is an online backup service designed from the ground-up for the Mac. With unlimited storage available for $5 per month, as well as a free 15-day trial, peace of mind is within reach with... Read more
Numi 3.15 - Menu-bar calculator supports...
Numi is a calculator that magically combines calculations with text, and allows you to freely share your computations. Numi combines text editor and calculator Support plain English. For example, '5... Read more
EtreCheck 3.3.3 - For troubleshooting yo...
EtreCheck is an app that displays the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to... Read more
BusyContacts 1.1.8 - Fast, efficient con...
BusyContacts is a contact manager for OS X that makes creating, finding, and managing contacts faster and more efficient. It brings to contact management the same power, flexibility, and sharing... Read more
TunnelBear 3.0.14 - Subscription-based p...
TunnelBear is a subscription-based virtual private network (VPN) service and companion app, enabling you to browse the internet privately and securely. Features Browse privately - Secure your data... Read more
Apple Final Cut Pro X 10.3.4 - Professio...
Apple Final Cut Pro X is a professional video editing solution.Completely redesigned from the ground up, Final Cut Pro adds extraordinary speed, quality, and flexibility to every part of the post-... Read more
Hopper Disassembler 4.2.1- - Binary disa...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32-bit and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about... Read more
Slack 2.6.2 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.6.2: Fixed Inexplicably, context menus and spell-check... Read more

Latest Forum Discussions

See All

The best new games we played this week
We were quite busy this week. A bunch of big mobile games launched over the past few days, alongside a few teeny surprises. There're lots of quality games to load your phone with. We've gone and picked out five of our favorites for the week. [... | Read more »
Magikarp Jump beginner's guide
Magikarp Jump is a mystifying little game. Part Tamagotchi, part idle clicker, there's not a whole lot of video game there, per se, but for some reason we can't help coming back to it again and again. Your goal is to train up a little Magikarp to... | Read more »
Goat Simulator PAYDAY (Games)
Goat Simulator PAYDAY 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: ** IMPORTANT - SUPPORTED DEVICES **iPhone 4S, iPad 2, iPod Touch 5 or better Goat Simulator: Payday is the most... | Read more »
GRID Autosport delayed until autumn
Sorry mobile racing fans -- GRID Autosport has been delayed a few months. The game is now expected to launch this fall on iOS. Feral Interactive announced that they wanted more time to work on the game's UI and overall performance before launching... | Read more »
Zombie Gunship Survival Beginner's...
The much anticipated Zombie Gunship Survival is here. In this latest entry in the Zombie Gunship franchise, you're tasked with supporting ground troops and protecting your base from the zombie horde. There's a lot of rich base building fun, and... | Read more »
Mordheim: Warband Skirmish (Games)
Mordheim: Warband Skirmish 1.2.2 Device: iOS Universal Category: Games Price: $3.99, Version: 1.2.2 (iTunes) Description: Explore the ruins of the City of Mordheim, clash with other scavenging warbands and collect Wyrdstone -... | Read more »
Mordheim: Warband Skirmish brings tablet...
Legendary Games has just launched Mordheim: Warband Skirmish, a new turn-based action game for iOS and Android. | Read more »
Magikarp Jump splashes onto Android worl...
If you're tired ofPokémon GObut still want something to satisfy your mobilePokémon fix,Magikarp Jumpmay just do the trick. It's out now on Android devices the world over. While it looks like a simple arcade jumper, there's quite a bit more to it... | Read more »
Purrfectly charming open-world RPG Cat Q...
Cat Quest, an expansive open-world RPG from former Koei-Tecmo developers, got a new gameplay trailer today. The video showcases the combat and exploration features of this feline-themed RPG. Cat puns abound as you travel across a large map in a... | Read more »
Jaipur: A Card Game of Duels (Games)
Jaipur: A Card Game of Duels 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: ** WARNING: iPad 2, iPad Mini 1 & iPhone 4S are NOT compatible. ** *** Special Launch Price for a limited... | Read more »

Price Scanner via MacPrices.net

Memorial Day savings: 13-inch Touch Bar MacBo...
B&H Photo has the 2016 Apple 13″ Touch Bar MacBook Pros in stock today and on sale for up to $150 off MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: - 13″ 2.9GHz/512GB... Read more
Apple refurbished 13-inch MacBook Airs availa...
Apple has Certified Refurbished 2016 13″ MacBook Airs available starting at $849. An Apple one-year warranty is included with each MacBook, and shipping is free: - 13″ 1.6GHz/8GB/128GB MacBook Air: $... Read more
Apple restocks refurbished 11-inch MacBook Ai...
Apple has Certified Refurbished 11″ MacBook Airs (the latest models recently discontinued by Apple), available for up to $170 off original MSRP. An Apple one-year warranty is included with each... Read more
12-inch 1.2GHz Retina MacBooks on sale for up...
B&H has 12″ 1.2GHz Retina MacBooks on sale for up to $150 off MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: - 12″ 1.2GHz Space Gray Retina MacBook: $1449.99 $150 off... Read more
15-inch 2.7GHz Silver Touch Bar MacBook Pro o...
MacMall has the 15-inch 2.7GHz Silver Touch Bar MacBook Pro (MLW82LL/A) on sale for $2569 as part of their Memorial Day sale. Shipping is free. Their price is $230 off MSRP. Read more
Free Tread Wisely Mobile App Endorsed By Fath...
Just in time for the summer driving season, Cooper Tire & Rubber Company has announced the launch of a new Tread Wisely mobile app. Designed to promote tire and vehicle safety among teens and... Read more
Commercial Notebooks And Detachable Tablets W...
Worldwide shipments of personal computing devices (PCDs), comprised of traditional PCs (a combination of desktop, notebook, and workstations) and tablets (slates and detachables), are forecast to... Read more
Best value this Memorial Day weekend: Touch B...
Apple has Certified Refurbished 2016 15″ and 13″ MacBook Pros available for $230 to $420 off original MSRP. An Apple one-year warranty is included with each model, and shipping is free: - 15″ 2.6GHz... Read more
13-inch MacBook Airs on sale for up to $130 o...
Overstock.com has 13″ MacBook Airs on sale for up to $130 off MSRP including free shipping: - 13″ 1.6GHz/128GB MacBook Air (sku MMGF2LL/A): $869.99 $130 off MSRP - 13″ 1.6GHz/256GB MacBook Air (sku... Read more
2.8GHz Mac mini available for $973 with free...
Adorama has the 2.8GHz Mac mini available for $973, $16 off MSRP, including a free copy of Apple’s 3-Year AppleCare Protection Plan. Shipping is free, and Adorama charges sales tax in NY & NJ... Read more

Jobs Board

*Apple* Media Products - Commerce Engineerin...
Apple Media Products - Commerce Engineering Manager Job Number: 57037480 Santa Clara Valley, California, United States Posted: Apr. 18, 2017 Weekly Hours: 40.00 Job Read more
Best Buy *Apple* Computing Master - Best Bu...
**509643BR** **Job Title:** Best Buy Apple Computing Master **Location Number:** 001482- Apple Valley-Store **Job Description:** **What does a Best Buy Apple Read more
*Apple* Media Products - Commerce Engineerin...
Apple Media Products - Commerce Engineering Manager Job Number: 57037480 Santa Clara Valley, California, United States Posted: Apr. 18, 2017 Weekly Hours: 40.00 Job Read more
*Apple* Mac and Mobility Engineer - Infogrou...
Title: Apple Mac and Mobility Engineer Location: Portland, OR Area Type: 12 month contract Job: 17412 Here's a chance to take your skills to the limit, learn new Read more
*Apple* Retail - Multiple Positions, White P...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.