2

I'm looking for an automated way to set up LDAPv3 on OSx Catalina.

There is an additional level of complexity as we need to set a custom search base for the Automount, Groups, and Users.

Prior to catalina:

/Library/Preferences/OpenDirectory/Configurations/Search.plist
/Library/Preferences/OpenDirectory/Configurations/LDAPv3/my_ldap_server.plist

These files are now write-protected, yet the OS is still capable of writing to them it seems(or rather the /System/Volumes/Data/Library/... variant)

I can't understand why sudo/root can't write to these files as I can't find a firm link that would limit this in /usr/share/firmlinks

I'm also open to other automated ways of setting up LDAP connections by the way :)

EDIT: Please note that I'm not looking to edit the files mentioned above. I'm trying to automate LDAP setup! It can be done in the system preferences, and I'm just looking for a terminal way to do the same.

| improve this question | |
  • If you want to circumvent the write protection to OS files introduced in Catalina, you'll need to disable SIP, after which you can remount all partitions with read- and write-access rather than read-only with sudo mount -uw /. Upon reboot, /System and the like will be read-only again, at which point, you may want to re-enable SIP. – Jivan Pal Dec 20 '19 at 15:26
  • Thanks @Jivan Pal. It just seems a bit much of an effort to reboot every macbook, put them in recovery mode, disable SIP and reverse it every time I run Ansible. There has to be a way to automate this. Furthermore, the files are being changed if you use the GUI. Which means it's not read only. I just don't know the 'real' location of these files – maartend Dec 23 '19 at 10:52
  • "which means it's not read only" — indeed, it's not read-only in the strict sense that no-one is able to write to it, it's just that no regular user (including root) has permissions to do so; only certain kernel tasks are able to write to such locations. That's the point of SIP. The only solution that doesn't require disabling SIP would be to write your own kernel extension which you would install via the DriverKit API. – Jivan Pal Dec 24 '19 at 12:02
  • Alternatively, you can create a macOS "system extension" rather than a proper kernel extension. – Jivan Pal Dec 24 '19 at 12:04
  • I simply can't believe that creating a kernel modlue or 'system extension' is the only way to automate LDAP setup. – maartend Jan 6 at 13:08
1

The easy way is to make a configuration profile and push it via MDM once you reach the break even point where you’re spending more time touching machines vs scripting solutions.

You don’t need an MDM to make these or could use server app as your MDM if you just want to manage a couple items past this, but most teams that have staff to run LDAP would want MDM as well.

You could script downloading your profile from any file share using curl but it’s also possible to just script your MDM enrollment and push the profile to the Macs that need it using APNS.

| improve this answer | |
  • How can I use MDM to overwrite the /Library/Preferences/OpenDirectory/Configurations/LDAPv3/my_ldap_server.plist file? Because that file contains many more LDAP configuration options than just the server hostname and whether it is LDAP or Active Directory. For example, I need to set “LDAP mappings” to “RFC2307” and specify a “Search Base Suffix”. Can MDM do all that as well? – Markus Kuhn Oct 6 at 15:56
  • I’m not sure it works that way @MarkusKuhn which MDM solution are you using? That creates a recipe that the OS follows which may include the one step you seen to script... – bmike♦ Oct 6 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .