The first article describes how to add the appropriate Apple LDAP schema to your external directory. The second article describes how to set up appropriate partitions (e.g., cn=config, ou=MacOSX…) in your external directory to hold data from the Apple server. This article tackles the augmentation of user records in the external directory so that OSX Server recognizes them as native users.

(more…)

In the first article in this series, I described how to get the schema data out of Leopard and into a Sun ONE Directory Server. In this article, I’ll describe how to get the container objects out of Leopard’s LDAP server, and add them to the UNIX directory. These container objects will hopefully hold data relevant for assigning access to Apple’s Blog & Wiki server, among other things.

I say “hopefully” because I’m writing as I go, and I don’t know how it will turn out. However, given that others have had success at employing this method to get NFS automounting home directories working from Solaris LDAP, there is good reason to believe that it will work for other OSX services as well.

(more…)

Rajeev used Tiger server, which has a different apple.schema file from Leopard. It looks like he upgraded his Tiger server to Leopard instead of starting with a clean install of Leopard, so he may not have encountered the same obstacles as those of us who are starting from a non-upgraded Leopard server. The procedure is basically the same, but we need a new schema file (Leopard’s LDAP schema has an additional 400+ lines!), and we’ll need to add some missing attributes to it. Conveniently, I am also integrating with Sun ONE Directory Server 5.2. However, this methodology should apply equally to any LDAPv3 compliant directory server, such as OpenLDAP.

(more…)

Here are the problems that I encountered:

“agent could not determine the expected controller service principal”

The Podcast Producer manual says that Kerberos authentication in Xgrid is necessary (page 26)…
(more…)

class Event < ActiveRecord::Base
  has_many :memberships
  has_many :people, :through => :memberships
end

And:

class Person < ActiveRecord::Base
  has_many :memberships
  has_many :events, :through => :memberships
end

The join table is “memberships”, and the problem was in its model:

class Membership < ActiveRecord::Base
  validates_presence_of :event_id, :person_id
  belongs_to :people
  belongs_to :events
end

It is a subtle problem; the model looks OK. However, the “belongs_to” statements should point to the models of the other two tables, not the names of the tables themselves. The models are Event and Person, so the join model should be:

class Membership < ActiveRecord::Base
  validates_presence_of :event_id, :person_id
  belongs_to :person
  belongs_to :event
end

It took me a while to see the problem because it is so subtle, even though the answer is everywhere. Hopefully spelling it out here will help someone.

I installed the binary distribution of MySQL, and proceeded to install the mysql ruby gem to connect to it. First, the build failed because it didn’t know where to look for the mysql client libraries, then it failed again because by default the Makefile tries building for both PPC and Intel architectures.

To make a long story short, the solution is to add an ARCHFLAGS environment variable specifiying your architecture, and to provide the path to mysql_config on the command line. For the former, add:

ARCHFLAGS="-arch i386"

To your /etc/bashrc (assuming you use the default shell, bash), and open a new terminal or run ‘bash’. If you’re on PPC architecture, change “i386″ to “ppc”. Then try the gem again with the path to mysql_config appended, like so:

sudo gem install mysql -- --with-mysql-config=/usr/local/mysql/bin/mysql_config

That is all on one line.

It has been awhile since my last post of this series — sorry to keep you waiting. Kerberos on Mac OS X Server is a finicky thing, and it took me this long to get it working! Well, I did take a 3 week vacation, and was busy with other projects for at least 2 weeks … but it was a major pain in the ass to set up, and I’m not yet entirely satisfied.

To get straight to the point, the following procedure got kerberos with single sign-on up and running for me. Hopefully it will work for you too.

(more…)

To enable Sieve support:
1. Add the following entry in /etc/services/:
sieve 2000/tcp #Sieve mail filtering
2. Reload the mail service.

Right. This will enable the service, but it doesn’t configure it. This short article describes how to do both.

(more…)

I worked on it for awhile, sifting through log files and Googling for answers, but ran out of time for the evening: I was almost late for American Gangster. To my surprise, when I booted up Leopard server today, it worked. To confirm my sanity, I rebooted again: this time, no dice. So there was some kind of random failure happening. After some hunting around, I noticed a single entry in slapd.log:

slapd[40]: SASL [conn=9] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Decrypt integrity check failed)

(more…)