Mounting Home Directories from Mac OS X Server on Windows Clients when using xpasystems' pGina (long enough title?)
Required (Extra) Software:
-
pGina (http://pgina.xpasystems.com)
|
Mac OS X Server will emulate a Windows NT domain controller to allow Windows computers to authenticate against it. However, there are some limitations and potential problems that can be caused by this. pGina is an opensource substitute GINA (Graphical Identification aNd Authentication) for Windows that allows the use of various plugins for authenticating against non-windows and non-windows emulating servers. Thus, you can authenticate directly against Open Directory. |
-
LDAPAuth for pGina (http://pgina.xpasystems.com/plugins/ldapauth.php)
|
This is the ldap (lightweight directory access protocol) authentication plugin for pGina that allows it to connect to Open Directory. |
-
OpenLDAP for Windows32 (http://lucas.bergmans.us/hacks/openldap)
|
OpenLDAP is one of the part of Mac OS X's Open Directory. It is open source and has been compiled to run on Windows as well. This will give the tools necessary to search Open Directory from a PC. |
-
Gawk 3.1.4 (http://home.att.net/~short.stop/freesoft/txtfrmt.htm)
|
Find the gwk314b.zip file. This is a DOS implementation of the powerful text manipulation program awk. |
This document will assume that you already have pGina installed and you are able to authenticate against the Mac OS X Server. The LDAPAuth plugin comes with a Mac OS X Wizard that almost works. It was written for Mac OS X 10.2 and I haven't been able to get it to mount home folders under 10.3. So, this is my solution:
A login script: logon.bat
It mounts the user's home folder as the H: drive.
|
d:\tools\ldapsearch -h 10.5.5.72 -LLL -x -b “dc=twomblys,dc=com” “uid=%username%” > d:\textfiles\ldap.txt
findstr /B home d:\textfiles\ldap.txt > d:\textfiles\home.txt
For /F “tokens=*” %%A in (’d:\tools\gawk -f”/” ‘{print $4}’ d:\textfiles\home.txt’) Do Set newvar=%%A
net use h: \\%newvar%\%username%
|
A script - wether it's a batch script, unix shell script, applescript, ... - is just a series of commands that are generally, but not necessarily interrelated. So, let's take a look at these commands one at a time.
|
d:\tools\ldapsearch -h 10.5.5.72 -LLL -x -b “dc=twomblys,dc=com” “uid=%username%” > d:\textfiles\ldap.txt
|
|
The command here is ldapsearch. It is found in the OpenLDAP installation. In my case the command is located on the D: drive inside the tools directory. Following ldapsearch are the modifiers. -h allows you to specify an ldap server - in my case 10.5.5.72. For your script, you will need to change this to the IP address of your Mac OS X Server that is acting as the Open Directory Master.
-LLL modifies the output of this command, so that we get more specific results.
-x has to do with the authentication method we use to connect to the ldap server.
-b tells ldapsearch to use the following search base as the starting point for the search. In my case I used "dc=twomblys,dc=com". In general, this is your domain information. In LAUSD for instance you would use "dc=lausd,dc=k12,dc=ca,dc=us".
After the search base, we specify what we are looking for, that is a uid matching %username%. %username% is a Windows variable for the current user.
NOTE: in order for this to work properly, you must have the checkbox next to "User ID for Username" checked in the Mac OS X Wizard for the LDAPAuth plugin for pGina
This ldapsearch will give us a long list of all the directory information relating to the current user, which will then be stored in d:\textfiles\ldap.txt
|
|
findstr /B home d:\textfiles\ldap.txt > d:\textfiles\home.txt |
|
The command here is findstr. It is a simple pattern matching program.
/B matches a specified pattern (in this case "home") at the beginning of a line.
So, this will search for a line starting with "home" in the d:\textfiles\ldap.txt file that we created with the ldapsearch command, and output just that one line to d:\textfiles\home.txt.
|
|
For /F “tokens=*” %%A in (’d:\tools\gawk -f”/” ‘{print $4}’ d:\textfiles\home.txt’) Do Set newvar=%%A |
|
This is the most complicated of the lines within this script. It's a command within a command. Ultimately what it does is pull out the dns information of the server which hosts the current user's home folder.
NOTE: if you have only one server that hosts home folders, then the only command you need is the last one - replace %newvar% with the DNS name of your server.
"For /F “tokens=*” %%A in" and "Do Set newvar=%%A" are the fun DOS way of saying, set the variable newvar to the results of the command within the Parentheses.
gawk is the command that pulls the DNS name out of the file we created with findstr. It looks like this:
"homeDirectory: /Network/Servers/pmserve.twomblys.com/Volumes/Data/Students/200"
-f tells gawk we want the use the following "/" as a field separator.
'{print $4}' tells gawk to print out the 4th field. homeDirectory: is the first, Network is the second, Servers is the third. So, the fourth is the dns name of the server that hosts my home folder.
|
|
net use h: \\%newvar%\%username% |
|
The net series of commands in DOS are very useful. net use sets a specific drive to map to the specified server and sharepoint.
In this case, we're using the h: drive and mapping to servername %newvar%, which we discovered using gawk, and the sharepoint %username%.
NOTE: for this to work, you must have the virtual share points enabled on your server. This can be set in Server Admin, under Windows - Settings - Advanced. It's the last checkbox on the screen. |
Now, that you know how the script works you can write your own. You will definitely need to modify the IP address and search base in the ldapsearch command. You will also likely need to modify the location of files. They will probably be installed somewhere on your C: drive, rather than in d:\tools like on my computer. Additionally, you will want to specify a path for the output files. I used d:\textfiles.
Once you write the script and save it as a .bat file, you will need to call the script to run at login. pGina has a mechanism for this, but I haven't had success with it. You can set the default windows login script in the group policy under the user settings. I intend to write some documentation for this as well as a registry modifier to remap your "Desktop" and "My Documents" folders, such that they are on the H: drive. Check back next week.
Notice: None of the documentation or software provided on this site comes with any kind of warranty whatsoever. Nor, does it come with any kind of endorsement from my employer.
|