Everybody Staze...

Nobody leavz...

You are here: Home / Archives for Open Directory

10.6 Server, Xsan 2.2.1, and ACL oddities

By

UPDATE: So there was one more issue going on with this. After re-reading all the Xsan 2.2 documentation, it indicates that the primary MDC should be either a replica, or the Master OD server. In my setup, the backup MDC is the Master, but the Primary MDC is only “Connected”. Apparently this doesn’t work right. So, I made the Primary a replica, and everything now works. So, while the below is true, I’d make sure the above is also true if you’re running Xsan.

So, as I talked talked about earlier, we recently updated to 10.6 server, and along with that, Xsan 2.2.1. Since then, we’d been seeing odd ACEs (Access Control Entries) on folders that are on the Xsan, on the 10.6 Servers (the 10.5 Server saw everything just fine). But, the 10.6 Servers would see many of the ACEs as FFFFEEEE-DDDD-CCCC-BBBB-AAAA82xxxxxx (where xxxxxx is a hex equivalent of something (seemingly not the user/group id).

Removing and reapplying the ACLs wouldn’t help. Some of the ACLs would show fine, but some no matter what would show up as the above. So obviously there is an issue with the client looking up the user/group associated with that ACL (yet 10.5 works).

The solution came to me a few days ago. As I said previously, our Open Directory server has been around for a while. It started life as a 10.1 or 10.2 server, and has been upgraded since that point to 10.6 now. Any several of the groups/users have stayed the same on this system since then. Which relates to some issues I had a while back with iCal server not working for our older users. Accounts/Groups back in the 10.2 days didn’t have a UUID created and assigned to them. I fixed this for the user accounts about 10 months ago with a script that generates UUIDs and adds them to the user record. But at the time, I didn’t think of it about the groups. Now I wish I had. Once I added GeneratedUIDs to the groups that didn’t have them, and then removed and re-added the ACEs, everything seems to have worked. We still have a couple that don’t resolve right visually, but access to the files seems to work fine, so no clue why that’s happening.

All and all, kind of an annoying issue. Apple really should have their upgrade from 10.x to 10.x check for users/groups that don’t have GeneratedUIDs add them to the record, since some people have thousands of users, and have been upgrading since the days before LDAP (NetInfo is what used to hold directory info).

Ah well. So, anyone having a similar issue, check the inspector in WGM for a GeneratedUID for the group/user in question. My script linked above should easily be able to be modified to add GUIDs for groups as well.

Open Directory oddities…

By

Just this last weekend, I upgraded our primary systems from 10.5.8 Server to 10.6.2 Server, and the Xsan to 2.2.1 from 2.1.1. All and all, everything went well, though there’s been an odd issue that arose.

Since the update, I’ve seen something like the following error every 2 hours on the 10.6 machines: “Dec 25 14:03:26 server DirectoryService[29]: Misconfiguration detected in hash ‘Global GID’ – see /Library/Logs/DirectoryService/DirectoryService.error.log for details”

You look in DirectoryService.error.log, and you find:
2009-12-25 14:03:26 PST - T[0x0000000104781000] - Group 'wheel' (/LDAPv3/od.example.com) - ID 0 - UUID 9E733C05-88DE-4F83-9E09-038A887F1327 - SID S-1-5-21-4096-2147483678-1391576524-1001
2009-12-25 14:03:26 PST - T[0x0000000104781000] - Group 'wheel' (/Local/Default) - ID 0 - UUID ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000 - SID S-1-5-21-4171259825-3059450906-1974363594-1001

This error is there for several system level groups: daemon, kmem, sys, wheel, etc. Basically, the OD clients are all complaining that there is a conflict between the local group “wheel”, and the “wheel” that exists in the directory. These accounts, seemingly, shouldn’t exist within the directory, as they’re local accounts that exist on all the OD clients.

So, at this point, I think I’m safe removing them from the directory at this point. Looking at an ldif dump of the directory, it shoes these groups were created in 2003, when I upgraded the directory server from 10.2 to 10.3 (Netinfo to LDAP).

All told, there are probably 15 of these groups. They all conflict with other groups on the local directories, or are antiquated and don’t need to exist on the directory.

UPDATE: I successfully removed all of these groups, and it seem to have resolved the error messages, and had no ill effects. So, if you’re getting a bunch of the above errors, check to make sure you don’t have some weird group sitting on your directory that’s conflicting with a local system group. In general, all the groups you create should start with UID 1000 or above. There are only a few that are supposed to exist on the directory (admin, staff, domainadmins, domaincomputers, domainusers… I think that’s it).

Good luck, and hopefully post again shortly after the new year and students return from vacation.

Missing OD Attributes

By

A while back, when 10.5 first shipped, my boss and I were intrigued by iCal Server. And after getting it going, we found that for some reason, we couldn’t set a calendar server for our users. We’d set the calendar in Workgroup Manager (WGM hereafter), hit save, and right after that, WGM would uncheck the box, and set it back to none. Something was weird with our accounts. My boss deleted his account and recreated it, and that fixed it. So, the problem was obviously something with the “old” accounts on the system (e.g. the accounts that had been migrated from 10.1 -> 10.2 -> 10.3 -> 10.4 -> 10.5. Some attribute didn’t get added.

At first glance, the obvious missing one was there was only one authAuthority entry in our user accounts. Just the ApplePasswordServer entry, no Kerberosv5 entry. And deleting and recreating his account remedied that. So, I put it on the back burner because we figured out that iCal Server was kinda buggy, and later found out that the iPhone couldn’t write to it, just read (no good). When 10.6 was announced, and we heard that iCal Server 2 supported read/write from the iPhone (with version 3.x+ of the iPhone software), I started thinking about it again. So, I looked at the attribute, and figured out that a single “sed” would create the attribute I needed. So, I coded up this. And figured, problem solved.

Alas, it was not. While testing a migration of 10.4 email (cyrus) to a 10.6 server (dovecot) using the migrate_mail_data.pl script, I noticed at the end, the script renames the imap spool folders after the user’s UUID. It failed to rename them for several users (like me) because we didn’t have a UUID. Then it hit me, iCal Server’s URLs contain the UUID for the user. No UUID, no iCal Server calendar. DOH! So, I took the Kerberos script, changed it a bit (using uuidgen), and batch added UUIDs for all the users that didn’t have them (Script here. Re-ran the migrate_mail_data.pl script, and viola, all the spools got renamed. Now, I’m not sure if this really fixes the iCal Server 1 problem, since I don’t have an iCal Server set up, but iCal Server 2 works (though, it works differently, so this issue doesn’t occur). I also got word from a bug I filed about the initial issue, that Apple thinks 10.6 fixed it, so I’d imagine when you upgrade your OD server to 10.6, it adds missing attributes.

More later, work related. Thought I should keep topics distinct.