<div dir="ltr">Hi Davis,<div><br></div><div>We tried to get this working for a couple of days, but gave up. It is actually better for us to have our users reset their FreeIPA passwords only from the web interface. </div></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 27, 2014 at 1:23 PM, Davis Goodman <span dir="ltr"><<a href="mailto:davis.goodman@digital-district.ca" target="_blank">davis.goodman@digital-district.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
Hi Fredy,</div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><br></div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
We have integrated our Mac Worstations (Mountain Lion and Maverick) with FreeIPA with good success except for password change.</div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
<br></div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">Does your method allows users to change their password through the OSX interface for example when a new user is created and logs in for the first time? For now we need to have our users go through the web interface of a different workstation to change their newly created account password.</div>
<div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><br></div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
At this point that is the only thing that still doesn’t work for us.</div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><br></div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">
Davis</div><div style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><br></div> <div>
<div style="font-family:helvetica,arial;font-size:13px"><table border="0" cellpadding="0" cellspacing="0" style="font-family:Times"><tbody><tr><td valign="top" style="font-family:arial,sans-serif;margin:0px;padding-left:0px;font-size:8pt">
<span style="font-family:Arial,sans-serif;font-size:9pt;font-weight:bold">Davis Goodman</span><br><span color="#B9B9B9" style="margin-top:0px;margin-bottom:0px;font-family:Arial,sans-serif;font-size:8pt">Directeur Informatique <font color="#B9B9B9" size="1"> |</font> IT Manager<br>
</span></td></tr></tbody></table><font color="#888888" style="font-family:arial;font-size:small;line-height:normal"><a href="http://www.digital-district.ca/" style="color:rgb(17,85,204);font-family:Times" target="_blank"><img src="cid:92D87869-0CBA-42D3-B788-2F8265D2FEB8" alt="Digital-District" title="Digital-District" align="middle" border="0" vspace="2"></a></font><span style="color:rgb(34,34,34);font-family:arial;font-size:small;line-height:normal"></span><table cellpadding="2" cellspacing="1" style="font-family:Times">
</table><table border="0" cellpadding="0" cellspacing="0" style="font-family:Times"><tbody><tr><td valign="top" style="font-family:arial,sans-serif;margin:0px;padding-left:0px;font-size:8pt"><span style="font-family:Arial;font-size:8pt">5605 Avenue de Gaspé, Suite 408 <font color="#B9B9B9" size="1">|</font> Montréal, QC H2T 2A4 <br>
</span><span style="font-family:Arial;font-size:8pt"><a><br><br></a></span></td></tr></tbody></table><div dir="ltr" style="font-size:small;line-height:normal;color:rgb(34,34,34);font-family:arial"><div dir="ltr"><table border="0" cellpadding="0" cellspacing="0" style="font-family:Times">
<tbody><tr><td valign="top" style="font-family:arial,sans-serif;margin:0px;padding-left:0px;font-size:8pt"><br></td></tr></tbody></table>
</div>
</div>
</div>
</div> <div style="color:black"><br>From: <span style="color:black">Simo Sorce</span> <a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a><br>Reply: <span style="color:black">Simo Sorce</span> <a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a><br>
Date: <span style="color:black">April 16, 2014 at 18:06:27 </span><br>To: <span style="color:black">Fredy Sanchez</span> <a href="mailto:fredy.sanchez@modmed.com" target="_blank">fredy.sanchez@modmed.com</a><br>Cc: <span style="color:black">Guillermo Fuentes</span> <a href="mailto:guillermo.fuentes@modernizingmedicine.com" target="_blank">guillermo.fuentes@modernizingmedicine.com</a>, <span style="color:black"><a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a></span> <a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a><br>
Subject: <span style="color:black"> [Freeipa-users] [SOLVED] Re: FreeIPA backend. Mavericks server shows UIDs instead of usernames in File Sharing. <br></span></div><br> <blockquote type="cite"><span><div><div></div><div>
<div><div class="h5">Good!
<br>And thanks for letting us know, it may help other users too.
<br>
<br>Simo.
<br>
<br>On Wed, 2014-04-16 at 17:58 -0400, Fredy Sanchez wrote:
<br>> Hi Simo,
<br>>
<br>> Thanks for your reply. Good old Google pointed me to
<br>> <a href="https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/open-ldap_bind_script/Mac_OpenLDAP_bind_script.sh" target="_blank">https://github.com/rtrouton/rtrouton_scripts/blob/master/rtrouton_scripts/open-ldap_bind_script/Mac_OpenLDAP_bind_script.sh</a>,
<br>> which gave me the idea of
<br>> updating the RealName mapping to displayName. This solved the problem, I'll
<br>> have to recreate the permissions for every share, but the user names now
<br>> show up, and stick. No more UIDs.
<br>>
<br>>
<br>> On Tue, Apr 15, 2014 at 9:30 AM, Simo Sorce <<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>> wrote:
<br>>
<br>> > On Fri, 2014-04-11 at 10:37 -0400, Fredy Sanchez wrote:
<br>> > > Hi all,
<br>> > >
<br>> > > We asked this same question at <a href="http://discussions.apple.com" target="_blank">discussions.apple.com</a>, but figured we'd
<br>> > have
<br>> > > better luck here. I apologize in advance if this is the wrong forum.
<br>> > >
<br>> > > We are switching from Synology (DSM 5) to Mavericks server (v3.1.1.
<br>> > running
<br>> > > in Mavericks 10.9.2) for File Sharing. We use a FreeIPA
<br>> > (ipa-server.x86_64
<br>> > > 3.0.0-37.el6) backend for SSO, and the Mac server seems correctly
<br>> > > bound to it. Unfortunately, although we can add usernames to the shares
<br>> > for
<br>> > > the initial config, the usernames transform to UIDs after (only for SSO
<br>> > > accounts; local accounts are not affected). That is, when we go to edit
<br>> > the
<br>> > > permissions for a share, all we see are UIDs. We can always figure out
<br>> > the
<br>> > > username from the UID, but this is an extra step we don't want to have.
<br>> > > We've tried reinstalling the Mac server app from scratch, re-binding to
<br>> > the
<br>> > > FreeIPA backend, changing mappings in Directory Utility (for example,
<br>> > > mapping GeneratedUID to uid, which is the username), recreating the
<br>> > shares
<br>> > > and permissions, etc. Here are more details about the binding:
<br>> > >
<br>> > > * The binding happens thru a custom package we created based primarily on
<br>> > >
<br>> > <a href="http://linsec.ca/Using_FreeIPA_for_User_Authentication#Mac_OS_X_10.7.2F10.8" target="_blank">http://linsec.ca/Using_FreeIPA_for_User_Authentication#Mac_OS_X_10.7.2F10.8</a>
<br>> > > * Sys Prefs, Users & Groups, Login Options show the server bound to the
<br>> > > FreeIPA backend with the green dot
<br>> > > * The following mappings are in place in Directory Utility, Services,
<br>> > > LDAPv3, FreeIPA backend
<br>> > >
<br>> > > Users: inetOrgPerson
<br>> > > AuthenticationAuthority: uid
<br>> > > GeneratedUID: random number in uppercase
<br>> > > HomeDirectory: #/Users/$uid$
<br>> > > NFSHomeDirectory: #/Users/$uid$
<br>> > > OriginalHomeDirectory: #/Users/$uid$
<br>> > > PrimaryGroupID: gidNumber
<br>> > > RealName: cn
<br>> > > RecordName: uid
<br>> > > UniqueID: uidNumber
<br>> > > UserShell: loginShell
<br>> > > Groups: posixgroup
<br>> > > PrimaryGroupID: gidNumber
<br>> > > RecordName: cn
<br>> > >
<br>> > > The search bases are correct
<br>> > >
<br>> > > * Directory Utility, Directory Editor shows the right info for the users.
<br>> > > * $ id $USERNAME shows the right information for the user
<br>> > >
<br>> > > FreeIPA is working beautifully for our Mac / Linux environment. We
<br>> > provide
<br>> > > directory services to about 300 hosts, and 200 employees using it; and
<br>> > > haven't had any problems LDAP wise until now. So we think we are missing
<br>> > a
<br>> > > mapping here. Any ideas?
<br>> >
<br>> > Fredy,
<br>> > I quickly tried to check for some documentation on how to configure this
<br>> > stuff, but found only useless superficial guides on how to find the
<br>> > pointy/clicky buttons to push to enable the service.
<br>> >
<br>> > I am not a Mac expert by a long shot so I cannot help you much here.
<br>> >
<br>> > Is there any guide available on how to use this service with other LDAP
<br>> > servers, like openLDAP or Active Directory ? We can probably draw some
<br>> > conclusions from there.
<br>> >
<br>> > Simo.
<br>> >
<br>> > --
<br>> > Simo Sorce * Red Hat, Inc * New York
<br>> >
<br>> >
<br>>
<br>>
<br>
<br>
<br>--
<br>Simo Sorce * Red Hat, Inc * New York
<br>
<br></div></div><div class="">_______________________________________________
<br>Freeipa-users mailing list
<br><a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>
<br></div><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a>
<br></div></div></span></blockquote></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div style="text-align:right"><div style="text-align:left"><div><div>Cheers,</div><div><br></div><div>
Fredy Sanchez</div><div>IT Manager @ Modernizing Medicine</div><div>561-880-2998 x237</div><div><a href="mailto:fredy.sanchez@modmed.com" target="_blank">fredy.sanchez@modmed.com</a></div><div><br></div><div>Need IT support? Visit <a href="https://mmit.zendesk.com" target="_blank">https://mmit.zendesk.com</a></div>
</div></div><div style="text-align:left"><div style="width:650px"><div style="padding-top:10px;float:left"><ul style="color:rgb(153,153,153);font-family:ubuntu;font-size:8pt;line-height:15px;padding:0px;list-style:none">
<li>
<br></li></ul></div></div></div><div style="text-align:left"><div style="color:rgb(0,0,0);font-family:Times;font-size:medium;min-width:650px"><div style="padding-top:10px;font-family:ubuntu,verdana,arial,sans-serif;font-size:8pt;line-height:15px;float:left;color:rgb(153,153,153)">
<ul style="margin:0px;padding:0px;list-style:none"><li style="padding:0px;margin:0px"><b style="line-height:normal;font-family:arial,sans-serif;font-size:13px;color:rgb(34,34,34)"><br></b></li></ul></div></div></div></div>
</div>
</div>