Part 3: Hunter College: Setting up a Netinfo/LDAP catalog

Computerworld - In a series of articles written by Yuval Kossovsky, manager of digital media systems at Hunter College's Department of Film and Media Studies, Computerworld is following the school's integration of new Apple hardware and software. This is the third of those articles, which are designed to offer a hands-on view of integrating Macs and Apple software in what is largely an Intel and Windows world.

The first question to ask in a situation like this is: "Why do I want a central catalog?" The answer is obvious to anyone who has tried to maintain more than one identity on 10 or more machines.
When setting up a large number of user identities in an enterprise or lab environment, it is nearly impossible to visit every machine and set up an identical profile for each new user. And what do you do when an account is deleted, or the password is changed in one place? Centralizing the catalog allows an administrator to keep all user information in one place.
While Mac OS X integrates with industry-standard methods such as Microsoft's Active Directory and Sun's Open LDAP, my focus is on managing a purely OS X environment. Much like the enterprise administrator tool in the Windows world, the Workgroup Manager (WGM) tool in OS X enables the administrator to completely control an end user's experience. With WGM you can manage specific machine, group and user preferences.
The first step in building a net info directory is Planning, with a capital P! I made the mistake of not planning my first implementation and had to scrap it part of the way through. You'll need to consider how many users and potential groups you have now, and how many there will be in the future. What is the naming convention for users? How many IDs will you require? In the Unix world, the user identity (UID) is the most important piece of data: It is a unique identifier for an account, and all privileges and permissions are given to that unique number. If there are duplicate ID numbers, you've got a big problem.
For people, it helps to have that UID number mean something -- and this is where a conflict usually arises. For example, I set aside UIDs 1001-1099 for user accounts and 1101-1199 for administrators. What happens when I have 100 users? Do I use an admin number or jump to another range? Either way, the neat mapping I had is now all mucked up. Lesson learned: Give yourself some room to