How to support Macs in an Active Directory environment

Computerworld - Editor's note: When originally published this article said that by using dynamic user identification (UID) generation, users might be assigned a different UID number each time they logged onto a different Mac. We have confirmed with Apple that this is no longer the case; the story is corrected below.

Supporting Mac users can be a challenge to systems administrators in a Windows Active Directory environment. Although Apple has used Samba to make it easy for Macs to browse and access shares and printers hosted by Windows servers using Microsofts server message block (SMB) protocol, true Active Directory integration requires more than just access to resources.

For one thing, it requires support for an environment where users can rely on their Active Directory accounts for log-in to both Mac and Windows computers. Depending on your environment, you may also want to be able to implement security measures to limit what users may do while logged into a Mac or to manage the user experience as you would do with group policies for Windows machines.

There are a number of solutions and approaches that you can take for integrating Macs into your Active Directory infrastructure, and I'll be talking about some of them here.

Apples Active Directory plug-in

The lowest-cost solution is to use Apples built-in Active Directory support. Beginning in Mac OS X Panther (10.3), Apple introduced a plug-in to its Directory Access utility that allows you to configure authentication against Active Directory. Apples Active Directory plug-in uses LDAP to query Active Directory.

The Active Directory plug-in works fairly well. It supports forests with multiple domains, domain controller fail-over and can automount a users home directory. It can also grant users administrator access to a Mac workstation based on their Active Directory group membership. You can also enable mobile accounts for portable computers and designate a preferred domain controller if needed.

The process of using the plug-in to join a Mac to an Active Directory domain is straightforward, and is similar to joining a Windows computer to a domain. Youll need an Active Directory account with permission to join the computer to the domain; if the account was not created in advance, youll need authority to create it. You will also need to configure the search path of available directories to include Active Directory using the Authentication tab in the Directory Access tool. Mac OS X can search multiple directory configurations in a specified path when a user attempts to log in.

Dynamic UID vs. static UID mapping

One of the hurdles to integrating Mac OS X with Active Directory is that their directory services schemas are significantly different. One of the key attributes in the Open Directory schema used by Mac OS X is the User ID number (UID). As in other Unix systems, the UID is used by the Mac OS X file system to designate file ownership and permissions both for local and remote files.