LDAP-UX, Active Directory and Mac OS

[Nicolas_17]

Hello,

I just started digging into this LDAP stuff and I have questions that may save me some time.
We have a bunch of Mac OS machines that don't play well at all with Active Directory. We also have very stable HP-UX servers.

Question: would it be simpler to have the Mac OS machines authenticate with an HP-UX server running LDAP-UX instead? Then we would have only that HP-UX server to configure to properly speak to Active Directory.

Can LDAP-UX be kind of a relay?

Nicolas.

[Nicolas_17]

I guess this isn't so popular...

Has anyone heard a another way to sync active directory with hpux maybe?

[Bob Neal-Joslin]

WARNING: I have very little expertise in configuring Mac OS X. But here's some information that might help...

LDAP-UX itself can't act as a relay for ADS. The closest solution there would be to use the NIS/LDAP Gateway and then configure your Mac OS systems to be an NIS client. But that would only help solve identity discovery. You'd still need a way to support authentication. You might be able to configure kerberos on the Mac to talk to a windows domain for identity authentication. But again, I'm not a Mac OS IdM expert by any means so I could not tell you how that's done.

Another solution is to use the Red Hat Directory Server v7.1 on HP-UX to act as a directory gateway for the Macs. RHDS 71 includes a feature called winsync. This will allow the directory server to discover and sync accounts stored in an ADS directory. And then, if you configure LDAP client support properly on your Mac, you can point it to RHDS on HP-UX. Note, that I'm not a 100% expert here either. But I believe one potential issue with this solution is full support of password policy, meaning it might not handle things like password expiration properly.

Good luck!

[Nicolas_17]

Thanks Bob! Just when i had given up hope!

I will definetely give it a shot with my Mac guy and post results if any!

Nicolas.