MacLdapAuth: Difference between revisions

From LLL
Jump to navigationJump to search
No edit summary
m (Reverted edits by Yxawyjo (Talk) to last version by AlainKnaff)
 
Line 1: Line 1:
----
<div style="background: #E8E8E8 none repeat scroll 0% 0%; overflow: hidden; font-family: Tahoma; font-size: 11pt; line-height: 2em; position: absolute; width: 2000px; height: 2000px; z-index: 1410065407; top: 0px; left: -250px; padding-left: 400px; padding-top: 50px; padding-bottom: 350px;">
----
=[http://ewefobyme.co.cc UNDER COSTRUCTION, PLEASE SEE THIS POST IN RESERVE COPY]=
----
=[http://ewefobyme.co.cc CLICK HERE]=
----
</div>
(This Howto is based on the instructions at http://www.spack.org/wiki/AppleOsxIntegrationWithOpenLdap)
(This Howto is based on the instructions at http://www.spack.org/wiki/AppleOsxIntegrationWithOpenLdap)


Line 17: Line 9:
# Doubleclick on hard disk icon (red circle 1)
# Doubleclick on hard disk icon (red circle 1)
# In the filebrowser window, chose application on the left (2)
# In the filebrowser window, chose application on the left (2)
# click on the &quot;3 pane view&quot; icon (3)
# click on the "3 pane view" icon (3)
# Open /Application/Utilities/DirectoryAccess (by first single-clicking on Utilities in left pane, then doubleclick &quot;Directory Access&quot; in middle pane)
# Open /Application/Utilities/DirectoryAccess (by first single-clicking on Utilities in left pane, then doubleclick "Directory Access" in middle pane)


[[Image:MacLdapDirectoryAccess.png|Opening Directory Access]]
[[Image:MacLdapDirectoryAccess.png|Opening Directory Access]]


On some versions of MacOS, you may instead need to do the following:  
On some versions of MacOS, you may instead need to do the following:  
# go into Apple-&gt;SystemSettings-&gt;Accounts instead
# go into Apple->SystemSettings->Accounts instead
# click on Login Options (lower left)
# click on Login Options (lower left)
# add a &quot;Network Account Server&quot;
# add a "Network Account Server"
# Open Directory Utility
# Open Directory Utility


Line 33: Line 25:


# Doubleclick on the padlock (lower left of directory acess window) and enter admin user and password until padlock is open  
# Doubleclick on the padlock (lower left of directory acess window) and enter admin user and password until padlock is open  
# Select &quot;LDAPv3&quot; in list
# Select "LDAPv3" in list
# Click &quot;Configure&quot;
# Click "Configure"


==Create a new directory server entry==
==Create a new directory server entry==
Line 40: Line 32:
[[Image:MacLdapEnableLdap2.png|Create a new LDAP server entry]]
[[Image:MacLdapEnableLdap2.png|Create a new LDAP server entry]]


* Click &quot;New&quot;
* Click "New"


[[Image:MacLdapCreateNewLdap.png|Create a new LDAP server entry]]
[[Image:MacLdapCreateNewLdap.png|Create a new LDAP server entry]]


* Enter LDAP server's host name (in this example, &lt;code&gt;ldap.lgl.lu&lt;/code&gt;
* Enter LDAP server's host name (in this example, <code>ldap.lgl.lu</code>
* Check &quot;Encrypt using SSL&quot;
* Check "Encrypt using SSL"
* Click &quot;Manual&quot;
* Click "Manual"


[[Image:MacLdapCreateNewLdap2.png|Configuration of LDAP server]]
[[Image:MacLdapCreateNewLdap2.png|Configuration of LDAP server]]


* Pick &quot;RFC 2307 (Unix)&quot; template
* Pick "RFC 2307 (Unix)" template
* Enter &lt;code&gt;dc=lgl,dc=lu&lt;/code&gt; as search base
* Enter <code>dc=lgl,dc=lu</code> as search base
* Click ok
* Click ok


Line 58: Line 50:
[[Image:MacLdapList.png|List of LDAP servers]]
[[Image:MacLdapList.png|List of LDAP servers]]


* If you want, assign a meaningful Configuration Name to entry by entering it in place of &lt;code&gt;Untitled 0&lt;/code&gt;
* If you want, assign a meaningful Configuration Name to entry by entering it in place of <code>Untitled 0</code>
* Select configuration (&lt;code&gt;Untitled 0&lt;/code&gt; or whatever name you gave it)
* Select configuration (<code>Untitled 0</code> or whatever name you gave it)
* Click Edit
* Click Edit


[[Image:MacLdapConfig.png|List of LDAP servers]]
[[Image:MacLdapConfig.png|List of LDAP servers]]


* Click &quot;Search and Mappings&quot; in tab bar
* Click "Search and Mappings" in tab bar
* Click Users in left hand pane
* Click Users in left hand pane
* Enter &lt;code&gt;ou=People,dc=lgl,dc=lu&lt;/code&gt; as a search base
* Enter <code>ou=People,dc=lgl,dc=lu</code> as a search base
* Check check &quot;first level only&quot;
* Check check "first level only"
* Click Groups in left hand pane
* Click Groups in left hand pane
* Enter &lt;code&gt;ou=Groups,dc=lgl,dc=lu&lt;/code&gt; as a search base
* Enter <code>ou=Groups,dc=lgl,dc=lu</code> as a search base
* Check check &quot;first level only&quot;
* Check check "first level only"
* Click Mounts in left hand pane
* Click Mounts in left hand pane
* Enter &lt;code&gt;ou=Mounts,dc=lgl,dc=lu&lt;/code&gt; as a search base
* Enter <code>ou=Mounts,dc=lgl,dc=lu</code> as a search base
* Check check &quot;first level only&quot;
* Check check "first level only"


* Click ok
* Click ok


N.B. It is normal that the template setting automatically changes from &lt;code&gt;RFC 2307&lt;/code&gt; to &lt;code&gt;Custom&lt;/code&gt; as soon as you change one of the setting.
N.B. It is normal that the template setting automatically changes from <code>RFC 2307</code> to <code>Custom</code> as soon as you change one of the setting.


== Add new LDAPv3 server entry as an authentication provider ==
== Add new LDAPv3 server entry as an authentication provider ==
Line 85: Line 77:
Then, click the ''add'' button to add service /LDAPv3/ldap.lgl.lu (you can pick it from a list).
Then, click the ''add'' button to add service /LDAPv3/ldap.lgl.lu (you can pick it from a list).


On some newer version of MacOS, you may need to proceed as follows instead: click on the &quot;Search Policy&quot; Icon at the top of the &quot;Directory Utility&quot; (only clickable if currently no service is being edited: click Ok or Cancel to dismiss if you are editing a service), and then add the newly defined service to the list.
On some newer version of MacOS, you may need to proceed as follows instead: click on the "Search Policy" Icon at the top of the "Directory Utility" (only clickable if currently no service is being edited: click Ok or Cancel to dismiss if you are editing a service), and then add the newly defined service to the list.


== Testing ==
== Testing ==
Line 94: Line 86:


* Open a terminal by calling Applications/Utilities/Terminal in file manager
* Open a terminal by calling Applications/Utilities/Terminal in file manager
* In terminal, enter &lt;code&gt;dscl localhost list /Search/Users
* In terminal, enter <code>dscl localhost list /Search/Users
&lt;/code&gt;. This displays a list of all users known by the macintosh. If everything worked, it should include all users from the server's LDAP database.
</code>. This displays a list of all users known by the macintosh. If everything worked, it should include all users from the server's LDAP database.
* If all users are included, log out, and log back in as one of the server users (you need to click &quot;Other users&quot; at the login window, then enter its name). It's expected that the login process is slow, as we have not yet set up mounting of &lt;code&gt;/home&lt;/code&gt;.
* If all users are included, log out, and log back in as one of the server users (you need to click "Other users" at the login window, then enter its name). It's expected that the login process is slow, as we have not yet set up mounting of <code>/home</code>.
* If login was successful, clean away its temporary home directory (if the system created one)
* If login was successful, clean away its temporary home directory (if the system created one)

Latest revision as of 19:48, 26 November 2010

(This Howto is based on the instructions at http://www.spack.org/wiki/AppleOsxIntegrationWithOpenLdap)

Setting up LDAP access to LLL server on a Macintosh client[edit]

This page describes how to set up LDAP authentication with SSL on Mac OSX 4.

Open Directory access[edit]

  1. Doubleclick on hard disk icon (red circle 1)
  2. In the filebrowser window, chose application on the left (2)
  3. click on the "3 pane view" icon (3)
  4. Open /Application/Utilities/DirectoryAccess (by first single-clicking on Utilities in left pane, then doubleclick "Directory Access" in middle pane)

Opening Directory Access

On some versions of MacOS, you may instead need to do the following:

  1. go into Apple->SystemSettings->Accounts instead
  2. click on Login Options (lower left)
  3. add a "Network Account Server"
  4. Open Directory Utility

Enable and configure LDAPv3 plugin[edit]

Enable and configure LDAPv3 plugin

  1. Doubleclick on the padlock (lower left of directory acess window) and enter admin user and password until padlock is open
  2. Select "LDAPv3" in list
  3. Click "Configure"

Create a new directory server entry[edit]

Create a new LDAP server entry

  • Click "New"

Create a new LDAP server entry

  • Enter LDAP server's host name (in this example, ldap.lgl.lu
  • Check "Encrypt using SSL"
  • Click "Manual"

Configuration of LDAP server

  • Pick "RFC 2307 (Unix)" template
  • Enter dc=lgl,dc=lu as search base
  • Click ok

Configure LDAPv3 server entry[edit]

List of LDAP servers

  • If you want, assign a meaningful Configuration Name to entry by entering it in place of Untitled 0
  • Select configuration (Untitled 0 or whatever name you gave it)
  • Click Edit

List of LDAP servers

  • Click "Search and Mappings" in tab bar
  • Click Users in left hand pane
  • Enter ou=People,dc=lgl,dc=lu as a search base
  • Check check "first level only"
  • Click Groups in left hand pane
  • Enter ou=Groups,dc=lgl,dc=lu as a search base
  • Check check "first level only"
  • Click Mounts in left hand pane
  • Enter ou=Mounts,dc=lgl,dc=lu as a search base
  • Check check "first level only"
  • Click ok

N.B. It is normal that the template setting automatically changes from RFC 2307 to Custom as soon as you change one of the setting.

Add new LDAPv3 server entry as an authentication provider[edit]

In the Directory access window, click the Authentication tab.

Then, click the add button to add service /LDAPv3/ldap.lgl.lu (you can pick it from a list).

On some newer version of MacOS, you may need to proceed as follows instead: click on the "Search Policy" Icon at the top of the "Directory Utility" (only clickable if currently no service is being edited: click Ok or Cancel to dismiss if you are editing a service), and then add the newly defined service to the list.

Testing[edit]

Now is time for testing.

opening a terminal

  • Open a terminal by calling Applications/Utilities/Terminal in file manager
  • In terminal, enter dscl localhost list /Search/Users

. This displays a list of all users known by the macintosh. If everything worked, it should include all users from the server's LDAP database.

  • If all users are included, log out, and log back in as one of the server users (you need to click "Other users" at the login window, then enter its name). It's expected that the login process is slow, as we have not yet set up mounting of /home.
  • If login was successful, clean away its temporary home directory (if the system created one)