Binding to a Linux-based OpenLDAP server from 10.6.x and 10.7.x
One of the services our IT team occasionally provides is connecting Mac desktops up to our Linux-hosted OpenLDAP server. Our OpenLDAP server doesn’t have any schema support built in for OS X, but historically we’ve gotten around that by using the RFC 2307 template support built into the LDAPv3 directory service plug-in. Then we hit Lion. Then we discovered how many other folks were having problems with Lion and OpenLDAP.
A lot of the problem was centered around the fact that Lion’s LDAP plug-in is now attempting to use the best SASL authentication method advertised by the LDAP server. Even if the server doesn’t require authentication, the Mac’s LDAP plug-in will still try to authenticate. What you’ll wind up with is an LDAP bind that allows lookups, but does not allow LDAP accounts to log in.
Most of the fixes involved going into the GUI and making some changes, then opening the relevant plist and making some more changes. Others recommended setting up the bind on one machine and then copying the relevant files from machine to machine.
Because I’m a lazy admin, I decided to see “How hard is this to script?” As it turned out, harder than you might think. Not all of the GUI buttons and tools have command-line equivalents and dsconfigldap turned out to be completely useless for this purpose.
In the end, I scripted the equivalent of “set up the bind on one machine, then copy the files.” I successfully bound one 10.7.x Mac, then studied the .plist carefully to find just the entries I needed for our OpenLDAP server. Then, I used a trick with /bin/cat that Peter Bukowinski showed me a while ago to feed the complete plist into a new file:
/bin/cat > /path/to/destination << ‘NEW_LDAP_BIND’
Since the technique worked on 10.7.x, I scripted my 10.6.x support in the script using the same model. At this point, the script handles everything about the OpenLDAP binding except for actually adding the LDAP domain to the authentication search path. I kept munging existing Active Directory search path entries in my testing, so it’s still necessary to go into Directory Utility at this point to add and promote the LDAP search path to be above our AD search path. For those folks who don’t have to worry about that, scripting the addition of your LDAP server to the authentication search path should be fairly straightforward.
For those interested, I’ve made the script available here. There are some Active Directory values mentioned that currently don’t do anything, but I’m planning to keep working on this script to see if I can fix the search path entry issue mentioned above.
One difference I found between 10.6.x and 10.7.x plists were that, on 10.6.x all the RFC 2307 LDAP mappings are included in the plist and must be included in the script. On Lion, just referencing that RFC 2307 is being used seems to work fine.
Another thing I found in my 10.7.x testing was that you couldn’t send the plist output directly to /Library/Preferences/OpenDirectory/Configurations/LDAPv3. Weird, but there was so much weird going on that I made a note then worked around it by sending the plist first to /tmp, then moving the complete plist over into /Library/Preferences/OpenDirectory/Configurations/LDAPv3.