<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><div class=""><div class=""><blockquote type="cite" class="">I have some questions for the author himself or anyone who has replicated<br class="">his work:<br class=""><br class=""> - Which OS X versions has this been tested on?<br class=""></blockquote></div></div><br class=""><div>10.6.7 through 10.10.4 (latest Snow Leopard through latest Yosemite in May <b style="text-decoration: underline;" class="">2015</b>). The client had two Snow Leopards, one or two Lions, 10 Mountain Lions and the rest were Mavericks slowly upgraded during the project to Yosemite.</div><div><br class=""></div><div class=""><div class=""><blockquote type="cite" class=""> - Does changing a expired password work on an OS X GUI login?<br class=""></blockquote></div></div><div><br class=""></div><div>I don't recall testing it. I recall testing the password change with the Kerberos "Ticket Viewer.app" and from the Users and Groups applet of System Preferences.</div><br class=""><div class=""><div class=""><blockquote type="cite" class=""> - Does the LDIF file included in that thread only work for MIT Kerberos<br class=""> or does it also work for Heimdal?<br class=""></blockquote></div></div><div><br class=""></div><div>It should work for both. IIRC FreeIPA uses MIT while OS X uses Heimdal.</div></div><div><br class=""></div><div>Let's start with a bit of background:</div><div><ul class=""><li class="">The project that I worked on was for an all Apple house (50+ of OS X installations, hundreds of iOS and only 2 Windows stations).</li><li class="">It took place between late November 2014 and February 2015 and I monitored it through May 2015.</li><li class="">I reasonably sure that we haven't set password expiration.</li><li class="">One of the criteria for the project was to actually migrate the original passwords stored in almost clear-text in OpenDirectory to the FreeIPA server (80 lines of code and the /var/db/authdb file).</li><li class="">We've migrated the file sharing to Samba and NetATalk. Samba was a royal pain for LDAP+Kerberos in user mode.</li><li class="">We migrated L2TP/IPSec and PPTP using Winbind for authentication (again with LDAP+Kerberos).</li><li class="">We migrated mail and calendar to Postfix+Dovecot+SOGo.</li><li class="">And we've also migrated a few simple (static) websites.</li><li class="">Mostly unrelated to IPA we also migrated DHCP and DNS. DiscoveryD gave us major headaches.</li></ul><div class="">The interesting part that we've accomplished was that we've managed to do the migration almost transparently because FreeIPA was seen as a Kerberized OD Server. As such, the clients were able to use Kerberized logins to each others services (local file shares and such).</div></div></body></html>