In-Depth with Mac OS X Lion Server
by Andrew Cunningham on August 2, 2011 8:00 AM ESTThe first thing I want to walk through is Open Directory, OS X’s directory services implementation (roughly analogous to Microsoft’s Active Directory). Many of OS X Server’s other services rely upon or make use of a directory in some way, so it’s important to know how it works.
For those of you who have no experiences with directory services, a brief explanation: imagine you’re the IT support person for a business of, say, 50 employees, and each of those employees has a computer. So you don’t have to manage all of the user accounts on those computers manually, you want to have all of their usernames and passwords stored on your server so that you can keep better track of them. You can also organize users into groups, so that if you have one particular attribute to apply to many different accounts, you can do it once to the group instead of once for every member of the group. This is the essence of Open Directory and other directory services.
It goes further than that: with centrally stored credentials, you can also more easily manage access permissions on file shares or enable your employees to use the same username and password to login to multiple computers. You can control password requirements and store relevant information (email addresses, etc.) about your users. You can also tie other products into your directory so that your users can use the same credentials to access email or internal websites. The list goes on.
OS X Server can either host its own directory (using Open Directory), tie into another, pre-existing directory service (like Active Directory), or both (using Active Directory to manage credentials but Open Directory to manage Apple-specific functionality - Apple calls this a “golden triangle” configuration, and it’s a bit outside the scope of this review). For our purposes, we’ll setup a standalone Open Directory that we’ll then use with other services throughout the review.
Open Directory setup is one of the few things that can still be done with both Server.app and Server Admin, though the approaches differ:
In Server.app: Go to the Manage menu and click Manage Network Accounts.
Enter your organization’s name and your admin’s email address, and click through the rest of the prompts - you’ll have a quick and easy directory setup with a minimum of fuss.
In Server Admin: To enable Open Directory in Server Admin, make sure the Open Directory service is viewable, and select it. In the Settings tab, click the Change button next to the server’s Role.
Here, you’re given three choices. We’ll want to set up an Open Directory master, but you can also connect your Mac to another directory (like Active Directory) or set up an Open Directory replica here. For the uninitiated, an Open Directory replica connects to an existing Open Directory master and mirrors every change made to the master - this can provide for load balancing (in an organization with many Macs) or automatic failover in the event that one or the other server crashes (Macs connected to an Open Directory master will automatically fall back to the replica if the master fails and vice-versa).
Anyway, elect to setup an Open Directory master, input your desired Directory Administrator credentials, input your organization name and admin email address, and you’re set, same as with Server.app. If you want to set a different Kerberos realm or LDAP search base, you can also do it here (but if you don’t know what that means, the default settings are fine).
(screenshot)
You can also use Server Admin to backup or destroy a directory you’ve made - to backup, just use the Archive tab to save and restore copies of your directory’s data. To delete the directory, go to the Settings tab, click Change next to the server’s Role, and select Set up a standalone directory.
Once it's running, you can go ahead and bind client computers to it: in OS X, this is accomplished by going to the Accounts preference pane, clicking Login Options, and clicking the Join button next to Network Account Server.
Enter your server's address in the box that pops up and click OK. If successful, you should now see a green dot followed by your server's address, and you should be able to login to your client computer with any of the user accounts you create (we'll go over that next).
Facebook
Twitter
RSS
77 Comments
View All Comments
ex2bot - Friday, August 5, 2011 - link
Upgrading OS X is not much of a pain, as Repo says. Plus, it's practical to skip at least every other upgrade. So, upgrading every four years (2 + 2) at $60 isn't a big deal and the improvements are worth it.I especially appreciate Expose', Time Machine, Spotlight, and Quick Look and use them regularly And every Mac user has benefitted from Quartz GL (uses 3d graphics card to speed up screen draws).. There have been myriad "invisible" or subtle improvements as well. See Apple's "Mac OS X" section for details.
Four years between OS upgrades is not bad, as I said. Longhorn was supposed to come out about 4 or 5 years after XP. Microsoft just had eyes bigger than its stomach and it was delayed. But Windows 7 was worth the wait. Especially features like the display compositor + aesthetically pleasing UI + improved security (and no more yellow speech bubbles popping up all the time)
Ex2bot
Automated System Process
ex2bot - Friday, August 5, 2011 - link
BTW, Expose's successor is called "Mission Control."Sahrin - Tuesday, August 2, 2011 - link
a reduction in advertising, if you guys are going to do all these paid reviews for Apple.Johnmcl7 - Tuesday, August 2, 2011 - link
It's getting a bit of a joke these days that anything with the Apple badge will get a news article, preview, in depth review the moment it's out dwarfing everything else which barely seems to get a look-in. I get that Anand likes Apple stuff and if I don't I should go elsewhere but I like the non-Apple reviews when they do occasionally get published.John
ex2bot - Friday, August 5, 2011 - link
It's no joke. Check Anand's mailbox some time*.Ex2bot
*Crazies, please don't mess with his mailbox.
ex2bot - Friday, August 5, 2011 - link
I know for a fact that Apple employees stuff money into Anand's mailbox*. Lots and lots of money. They use $20s and $50s straight from Jobs' car, who burns them to light his cigs.Ex2bot
Currency Calculating Mac Fanbot
* Anand, I don't really believe this. I was kidding, as I'm sure you've figured out. Actually, I'm sure they are $100s, not $20s and $50s. After all, he's a Billionaire.
the_engineer - Tuesday, August 2, 2011 - link
Thanks for this great in-depth look at Lion Servers new & continued functionality, I learned a lot reading this. However, I'm still very confused at where XSAN fits into the picture. As a storage power-user I've used software Linux raid, semi-hardware windows raid (Intel, Highpoint), and I've lately dabbled into ZFS because it seems like it's really got everything I could ever want as far as straight storage capabilities are concerned (I'm running a raidz6 with 6 750GB drives currently running on Nexenta). I'd really like to put Lion Server on a mac and install a generic SATA card and add 6 3TB hard drives and do a great big raid5 in a mac pro, but am very confused as to whether or not this will work. I was very hopeful that Lion Server would integrate 'software' RAID5 or similar functionality, but it's not clear anywhere whether it does this or not. Simply put, Do I still need to buy a dedicated raid5 card to have a redundant array of inexpensive disks on a mac or am I missing something still?-Looking for a great user experience AND a ton of redundant storage
HMTK - Wednesday, August 3, 2011 - link
Why not set up a NAS with iSCSI or NFS ?the_engineer - Wednesday, August 3, 2011 - link
LONG story short, geting a deidciated NAS box means spending more money than ought to be necessary at this point (I have an i7 desktop and a core2 desktop, both capable of running Lion, Windows, FreeBSD, you name it... Just fine, as well as plenty of vanilla SATA ports & cards available). I'm Trying to weigh all purely software options available to me, with ZFS/BSD sitting on top of the heap for storage features but OSX sitting on top of the heap from a usability standpoint. The longer I look at it the more likely I am to end up running one huge 20-drive ZFS based NAS under FreeBSD but was trying to avoid getting to this point.HMTK - Wednesday, August 3, 2011 - link
If you put it on the network you can access it with all decent OS's. I've got a little HP mini proliant just for that.