LDAP Network Account Logins in Mavericks

Question

I'd like to be able to link an LDAP server to Mavericks to permit users to login with their LDAP credentials. I have the following problem:

Although I know the fully qualified DN for a user (in the form cn={username}, ou=USERS, o=ORGNAME), I cannot lookup an attribute of password for the user. (This may be anticipated.) The user can authenticate against the LDAP server though.

I have managed to link the LDAP account in Directory Utility, and do actually get a list of users in the "Directory Editor" but I have no idea how to actually propagate that into the system. Specifically (as this is an OS X Server install) I wish to import them in the Server admin app, so LDAP users can log into wiki's, etc. In the Server app, no users appear in the User browser.

In advance, I know that that DN looks like an AD DN, it is. However, this server is not on the domain and I do not have domain or LDAP admin rights, so this authentication needs to happen without that.

Can someone guide me into how to configure this? I've spent some time with Google, but either I'm searching for the wrong thing (possible) or none of the results help.

Answer 1

It's possible that you need to set the Authentication Search Path inside of Directory Utility -> Search Policy -> Authentication...Make sure "Search" says "Custom Path", and that your Active Directory domain is listed below.

If you do not see your AD domain in the list, you can authenticate to Directory Utility by clicking the lock in the lower-left corner, and then add a new search path by clicking the "+" button below the list of paths. Your domain should show up under "Available Directory Domains".

This setting should allow users to authenticate against Active Directory when connecting to your server. However, if AD users can authenticate against your OS X server successfully, the Search Path is not likely to be the culprit.

Alternatively, Workgroup Manager still exists, and may allow you to investigate the AD node more explicitly.

Lastly, you may be required to enable cleartext authentication to be able to authenticate your AD users to your OS X Server hosted wiki (the article applies to Mountain Lion and lower systems, but may be the same procedure that is required for Mavericks).