20110629: Mac authentication using UW NetIDs

Last updated: September 29, 2023
Audience: IT Staff / Technical

A meeting to discuss “Macintosh authentication using UW NetID” took place:

Wednesday, June 29 2011

2:00 pm  – 3:30 pm

Notes from the meeting of 6/29 (courtesy of Brian High)

Dan Sinema, Apple Computer Inc.
Mac OS X Directory Services/AD scenarios
dsconfigad: to find group membership, to script mounting shares
– static mapping only, no variables.  See:
(Maybe script around this?)

MCX Attributes for policies can be stored as XML in LDAP
– Volume Mounting
– Energy Saver
– Preferences Manifest per Application

Auxiliary Classes “overlay” via LDIF Schema extensions
See: http://www.opensource.apple.com/source/OpenLDAP/OpenLDAP-37/AppleExtras/apple.schema
See: /etc/openldap/schema/apple.schema

Magic Triangle:

LDAP (groups) <==> Mac <==> AD (users)

Magic Triangle with file services:

OSX Server <= AD Plugin => AD <= SMB Server
^                                    ^            ^
|                            AD Plugin       |
|                                     |            |
\== SMB ============> MAC <== SMB ==/

Using just AD and SMB server:

Scripting mounting from client-end:
– login from AD
– dseditgroups
– launchd and plist to mount from SMB

Lion has Profile Manager for remote management

OSX has Workgroup Manager for local policies
and can push to LDAP server or OSX Server

Brian Arkills
Delegated OUs

See: Overview/review the UW “Netid” domain and delegated OUs

UW Group Service has Hourly Sync

Used for example: budget groups
– Free (costs paid by UWIT chargeback fee)
– Domain Migration
– Group Sync from old DC
– delegated group of computers

John Canfield, Stephen Bangs (CIS)
How UW-IT computing labs manage authentication on Macintosh
– Free
– Imaging
– works with UWWI

Had to populate UW delegated group of computers to get it to work

Martin Criminale, Andy Gravano
How the ISchool manages authentication on Macintosh
iMacs in labs dual-boot OSX/Windows, both using UWWI and automatically join UWWI as image is deployed
They also use DeployStudio
They use delegated group of computers as does CIS
Use ARD since it is req’d by DeepFreeze
Can’t extend schema in delegated UWWI OU
memberOf attribute is locked down so cannot use for assigning, for example admin rights, to users in UW groups only in local groups.
(Group membership in UW Groups are not recognized)
Time Mgmt. conflicts with Windows (due to dual boot configuration)
3 hour nightly management window.

Links to other resources:


No agreed upon proposal has emerged from this discussion. There are published ways to do Mac authentication integration.