Leopard eats Active Directory

I've commented a couple of times about vendors and how they need to beef up their Active Directory integration (if they even integrate to start with). Now the opposite happens: Apple's Active Directory integration has blown up in their latest OS X incarnation - Leopard.

I heard about this yesterday when I was at the Vintela offices in Lindon, Utah (yes, downstairs from the evil Canopy Group and across the street from the eviler than yesterday SCO Group).

Here are some details...

Leopard Problems: Active Directort integration - First, Active Directory integration is broken. It centers mostly around authentication issues. If the Mac was joined to the domain before it was upgraded, it can’t log on after. Directory Utility returns a “Server can not be contacted” error. If the machine was not joined to the domain, it fails while trying to with an “unknown error” in step 3 of the bind process.

The other issue is in Safari through a Microsoft ISA 2006 proxy server. When going to an SSL website, Safari crashes after it tries to authenticate. Firefox still works.

Avoid an Active Directory 10.5 upgrade issue - If your Mac is bound to Active Directory (AD), make sure you unbind it before upgrading. Also make sure you have a local admin account (that was not created via AD) beforehand. I had a tough time with a Mac here -- the only account on the machine was created through authenticating via AD. In case this happens to someone else, and they find this, here's a fix:

Start up in single user mode (power on while holding Command-S) and enable the root account by giving it a password (by typing passwd and entering a password). Then reboot and log in as root. Once you've logged in (it was very slow for me), go into Directory Utility (/Applications » Utilities) and you will see the AD entry listed there.

For me it showed as connected, but was not getting the proper info. Unbind it, and as soon as it's done, you should see an immediate improvement. I was not able to log into my old account; I had to create a new (local) one, and then transfer the old home folder to my new one. I think I added that hint before, but here it is again, in case I didn't:

Create new user newuseraccount. In Terminal, do:
$ sudo -s (enter password)
$ cd /Users
$ rm -rf newuseraccount
$ mv olduseraccount newuseraccount
$ chown -R newuseraccount:staff newuseraccount

I guess Apple's QA team didn't include any cases for testing their Active Diretory integration?

Technorati Tags:
Active Directory, identity management, Apple, Quest Software

Identity Management and Photography

Ian Glazer asks a couple of really interesting questions about identity management and photography in his recent post titled "Identity Management and Photography". Like the best questions they are hard to answer because they are "core" - at least core to me. This post is just to say that I believe there is some sort of link, Ian.

There are a bunch of people in the greater identity management world who would consider themselves amateur photographers. I wonder if there is commonality of photography and IdM that practitioners of both find compelling.

Anyone else want to sound off?

p.s. My photos usually end up here: http://picasaweb.google.com/jackson.shaw

Technorati Tags:
identity management

Google's GrandCentral Service

OK, kinda weird post, eh? This is GrandCentral from Google. You can use the "Call Me" button to literally call me...Enter your name and the phone number you are at and GrandCentral will call you and then connect you to me!

Cool stuff as it will call all my lines (home, business, mobile) simultaneously and route the call wherever I pick up. Neat.

Cisco to acquire Securent

OK, looks like the first move in consolidation in the authorization marketplace has happened...not bad: $100M! (Analysis and commentary by Phil Schacter at Burton Group can be found here.)

Congrats to the folks at Securent!

Cisco Announces Definitive Agreement to Acquire Securent

Cisco® today announced an agreement to acquire Securent, Inc., a leading provider of policy management software for enterprises. Securent's scalable, distributed policy platform allows enterprises to administer, enforce, and audit access to data, communications, and applications in heterogeneous IT application environments. Securent is privately held and based in Mountain View, Calif.

Securent's software will enable Cisco customers to protect and secure valuable application data regardless of vendor, platform, or operating system while still allowing ubiquitous access to the content workers and their collaborative communities need to be productive. By delivering policy from the network, Cisco will simplify entitlement decisions for all communications, collaboration and other third party applications.

Technorati Tags:
Securent, Cisco, XACML, authorization