<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Hi Fredy,</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">We have integrated our Mac Worstations (Mountain Lion and Maverick) with FreeIPA with good success except for password change.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Does your method allows users to change their password through the OSX interface for example when a new user is created and logs in for the first time? For now we need to have our users go through the web interface of a different workstation to change their newly created account password.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">At this point that is the only thing that still doesn’t work for us.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Davis</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div> <div id="bloop_sign_1403889579922851072" class="bloop_sign">
<title></title>
<div style="font-family:helvetica,arial;font-size:13px"><table border="0" cellpadding="0" cellspacing="0" style="font-family: Times;"><tbody><tr><td valign="top" style="font-family: arial, sans-serif; margin: 0px; padding-left: 0px; font-size: 8pt;"><span style="font-family: Arial, sans-serif; font-size: 9pt; font-weight: bold;">Davis Goodman</span><br><span color="#B9B9B9" style="margin-top: 0px; margin-bottom: 0px; font-family: Arial, sans-serif; font-size: 8pt;">Directeur Informatique <font color="#B9B9B9" size="1"> |</font> IT Manager<br></span></td></tr></tbody></table><font color="#888888" style="font-family: arial; font-size: small; line-height: normal;"><a href="http://www.digital-district.ca/" style="color: rgb(17, 85, 204); font-family: Times;"><img src="cid:92D87869-0CBA-42D3-B788-2F8265D2FEB8" alt="Digital-District" title="Digital-District" align="middle" border="0" vspace="2"></a></font><span style="color: rgb(34, 34, 34); font-family: arial; font-size: small; line-height: normal;"></span><table cellpadding="2" cellspacing="1" style="font-family: Times;"></table><table border="0" cellpadding="0" cellspacing="0" style="font-family: Times;"><tbody><tr><td valign="top" style="font-family: arial, sans-serif; margin: 0px; padding-left: 0px; font-size: 8pt;"><span style="font-family: Arial; font-size: 8pt;">5605 Avenue de Gaspé, Suite 408 <font color="#B9B9B9" size="1">|</font> Montréal, QC H2T 2A4 <br></span><span style="font-family: Arial; font-size: 8pt;"><a href="tel://Cell:
+1 (514) 994-7360"><br><br></a></span></td></tr></tbody></table><div dir="ltr" style="font-size: small; line-height: normal; color: rgb(34, 34, 34); font-family: arial;"><div dir="ltr"><table border="0" cellpadding="0" cellspacing="0" style="font-family: Times;"><tbody><tr><td valign="top" style="font-family: arial, sans-serif; margin: 0px; padding-left: 0px; font-size: 8pt;"><br></td></tr></tbody></table>
</div>
</div>
</div>
</div> <div style="color:black"><br>From: <span style="color:black">Simo Sorce</span> <a href="mailto:simo@redhat.com">simo@redhat.com</a><br>Reply: <span style="color:black">Simo Sorce</span> <a href="mailto:simo@redhat.com">simo@redhat.com</a><br>Date: <span style="color:black">April 16, 2014 at 18:06:27 </span><br>To: <span style="color:black">Fredy Sanchez</span> <a href="mailto:fredy.sanchez@modmed.com">fredy.sanchez@modmed.com</a><br>Cc: <span style="color:black">Guillermo Fuentes</span> <a href="mailto:guillermo.fuentes@modernizingmedicine.com">guillermo.fuentes@modernizingmedicine.com</a>, <span style="color:black">freeipa-users@redhat.com</span> <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>Subject: <span style="color:black"> [Freeipa-users] [SOLVED] Re: FreeIPA backend. Mavericks server shows UIDs instead of usernames in File Sharing. <br></span></div><br> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>Good!
<br>And thanks for letting us know, it may help other users too.
<br>
<br>Simo.
<br>
<br>On Wed, 2014-04-16 at 17:58 -0400, Fredy Sanchez wrote:
<br>> Hi Simo,
<br>>
<br>> Thanks for your reply. Good old Google pointed me to
<br>> https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/open-ldap_bind_script/Mac_OpenLDAP_bind_script.sh,
<br>> which gave me the idea of
<br>> updating the RealName mapping to displayName. This solved the problem, I'll
<br>> have to recreate the permissions for every share, but the user names now
<br>> show up, and stick. No more UIDs.
<br>>
<br>>
<br>> On Tue, Apr 15, 2014 at 9:30 AM, Simo Sorce <simo@redhat.com> wrote:
<br>>
<br>> > On Fri, 2014-04-11 at 10:37 -0400, Fredy Sanchez wrote:
<br>> > > Hi all,
<br>> > >
<br>> > > We asked this same question at discussions.apple.com, but figured we'd
<br>> > have
<br>> > > better luck here. I apologize in advance if this is the wrong forum.
<br>> > >
<br>> > > We are switching from Synology (DSM 5) to Mavericks server (v3.1.1.
<br>> > running
<br>> > > in Mavericks 10.9.2) for File Sharing. We use a FreeIPA
<br>> > (ipa-server.x86_64
<br>> > > 3.0.0-37.el6) backend for SSO, and the Mac server seems correctly
<br>> > > bound to it. Unfortunately, although we can add usernames to the shares
<br>> > for
<br>> > > the initial config, the usernames transform to UIDs after (only for SSO
<br>> > > accounts; local accounts are not affected). That is, when we go to edit
<br>> > the
<br>> > > permissions for a share, all we see are UIDs. We can always figure out
<br>> > the
<br>> > > username from the UID, but this is an extra step we don't want to have.
<br>> > > We've tried reinstalling the Mac server app from scratch, re-binding to
<br>> > the
<br>> > > FreeIPA backend, changing mappings in Directory Utility (for example,
<br>> > > mapping GeneratedUID to uid, which is the username), recreating the
<br>> > shares
<br>> > > and permissions, etc. Here are more details about the binding:
<br>> > >
<br>> > > * The binding happens thru a custom package we created based primarily on
<br>> > >
<br>> > http://linsec.ca/Using_FreeIPA_for_User_Authentication#Mac_OS_X_10.7.2F10.8
<br>> > > * Sys Prefs, Users & Groups, Login Options show the server bound to the
<br>> > > FreeIPA backend with the green dot
<br>> > > * The following mappings are in place in Directory Utility, Services,
<br>> > > LDAPv3, FreeIPA backend
<br>> > >
<br>> > > Users: inetOrgPerson
<br>> > > AuthenticationAuthority: uid
<br>> > > GeneratedUID: random number in uppercase
<br>> > > HomeDirectory: #/Users/$uid$
<br>> > > NFSHomeDirectory: #/Users/$uid$
<br>> > > OriginalHomeDirectory: #/Users/$uid$
<br>> > > PrimaryGroupID: gidNumber
<br>> > > RealName: cn
<br>> > > RecordName: uid
<br>> > > UniqueID: uidNumber
<br>> > > UserShell: loginShell
<br>> > > Groups: posixgroup
<br>> > > PrimaryGroupID: gidNumber
<br>> > > RecordName: cn
<br>> > >
<br>> > > The search bases are correct
<br>> > >
<br>> > > * Directory Utility, Directory Editor shows the right info for the users.
<br>> > > * $ id $USERNAME shows the right information for the user
<br>> > >
<br>> > > FreeIPA is working beautifully for our Mac / Linux environment. We
<br>> > provide
<br>> > > directory services to about 300 hosts, and 200 employees using it; and
<br>> > > haven't had any problems LDAP wise until now. So we think we are missing
<br>> > a
<br>> > > mapping here. Any ideas?
<br>> >
<br>> > Fredy,
<br>> > I quickly tried to check for some documentation on how to configure this
<br>> > stuff, but found only useless superficial guides on how to find the
<br>> > pointy/clicky buttons to push to enable the service.
<br>> >
<br>> > I am not a Mac expert by a long shot so I cannot help you much here.
<br>> >
<br>> > Is there any guide available on how to use this service with other LDAP
<br>> > servers, like openLDAP or Active Directory ? We can probably draw some
<br>> > conclusions from there.
<br>> >
<br>> > Simo.
<br>> >
<br>> > --
<br>> > Simo Sorce * Red Hat, Inc * New York
<br>> >
<br>> >
<br>>
<br>>
<br>
<br>
<br>--
<br>Simo Sorce * Red Hat, Inc * New York
<br>
<br>_______________________________________________
<br>Freeipa-users mailing list
<br>Freeipa-users@redhat.com
<br>https://www.redhat.com/mailman/listinfo/freeipa-users
<br></div></div></span></blockquote></body></html>