In this lesson, we're going to talk about directory services and users and groups in Austin server
mentioned before, and it bears repeating that if you already have a directory server out there, let's
say you've got an old observer or you're using Microsoft Active Directory, you do not need another
directory service for your Mac client.
You can either, let's say in the case of Active Directory, you can find your MAX two active directory,
which will show you how to do in a future lesson.
But you can also make all of the same services that you offer to your Mac clients on Windows clients
off of the same Windows Server.
So whether that's the DNS file sharing, printer sharing, those types of things, you can do those
directly through the Windows Server environment.
You don't need to do this separate thing for your Mac clients using a Mac server.
In that case, you wouldn't really need to do anything with the Mac server.
From a directory standpoint, if you're not going to have users and groups accessing resources on your
OS 10 server.
However, if you do, let's say you you're going to provide some number of services and I don't know
what those would be at this point.
I'd be hard pressed to say that there'd be any reason for you to want to use an Austin server in a production
environment for, say, high end file sharing.
But let's say, for example, that you do and you want to make sure that users can use the same username
and password.
You may want to bind your Mac to active directory or to another directory service that you're using
so that the users can use the same username and password to authenticate.
And you can set permissions on the resources that are being hosted by your Ostende server.
One of the main reasons you'd probably do this, given how much Apple has deemphasize file sharing,
Perner sharing other things in Ostende server is with the case with a profile manager.
And like I mentioned before, we'll talk more about profile manager in the future.
But you may actually want to assign profiles to users at a user level, and you may want those users
to be part of your larger directory of users, maybe, say, hosted on Active Directory.
So that may be one reason why you'd want to bind your host and server to your Microsoft active directory
environment or another directory service.
So if you do want to do that.
The easiest way is just go up to Tool's directory utility.
And authenticate.
And here we've got active directory and all that V three as our options, I'm just going to choose Active
Directory because it's probably the most common hip, a little pencil here to edit.
And then this brings up your ability to join your server to your existing domain.
So I'm just going to do.
This and then she put it in your domain and then you put in the computer ID, basically this is going
to be the record that gets created in the computers, you and so you can specify a computer ID here
and then you hit Binde and you have some options here as well.
These are the same options you would have if you were joining a client machine.
And we'll get into these options a bit more in the future.
But basically just hit that hit bind.
It will bind it to the domain and I'm not going to do that right now, but that will bind it to the
domain and then you'll be able to use your machine is joining the actor director.
You'll be able to then modify and host and bring in users into your users and groups here that already
exist, an active directory, and then that will allow you to assign resources and the same things,
permissions, set up profiles, prayer groups and things like that.
And that gives you some rudimentary active directory integration.
But really, the focus of this lesson isn't on how to integrate active directory into your OS 10 server.
It's really about creating open directory as an open directory master for your server so that if you
don't have a existing active directory or an open directory or other kind of LD app, and you are,
let's say, creating a user group or user accounts for a small business or for specific use case in
a small network, or maybe something to do with profile manager for mobile device management.
And you want to have some users and groups created for that.
That would be an instance where you'd want to use a directory service in your OS 10 server from scratch.
And so what Apple uses, they use an open held app that they call open directory.
So to access this, it's actually not on the tools used to be over here.
And with a lot of the other things, it was demoted.
It's now available only in the View menu and under advanced open directory.
So we will open it from here.
And the first thing we have to do is turn it on.
So you can see once I've gone and done this, it's added it to my advance and now it's over here on
the left hand side.
But initially it is not visible because it's just not used that much.
Honestly, a lot of folks already have a directory service that that they're using on their network
and there more or less not going to set up a new one on their Mac server.
But we're going to go ahead and turn it on.
And now it's going to give us some options here.
So in our example, we're going to just go ahead and do a new open directory domain.
But I do want to point out a couple of other options here.
If I did have an open directory master is what it's called, I'll put it on the network already.
And I wanted to make this a second open directory server that will share that domain with the existing
master.
These are called replicas.
And if you're familiar with windows, they used to be primary domain controllers and backup domain controllers.
It's the same idea.
You have an open directory master and then you have replicas and the replicas are you can have up to
thirty two of them.
And basically, you know, they will work as load balancing servers.
You can put them at various different locations if you have multiple locations, very similar to the
way that active directory works, where you have distributed domain controllers in your organization,
you can do the same thing with open directory.
But since we don't already have an open directory master on our network at all, we're going to choose
the first option here, which is to create a new one.
So the first thing we have to do is create a username and password for the directory administrator.
So this would be like the main this would be considered like the domain admin.
So it automatically fills out a dire admin or admin for directory administrator of the account name.
We'll keep that.
I'll just go ahead and put in a password here and next.
So now they want to know the name of the organization, so we'll just use you dummy as the example here
again and then that's fine for the email address.
You'll want to make that specific to your organization, obviously, and then we'll set up.
All right, now you'll see that we've got the open directory status of the button or the light is turned
on here, green, I've got the button flipped over on.
You can see the server here.
It shows that it's a master, shows my IP address, my IP address.
I had set up in a previous lesson and I have my local here set and as the default.
So basically this means that our open directory is up and running and that is our server and our domain.
Now that I've got my open directory domain set up, I need to create some users and groups.
So we're going to go in here to the groups option here.
I've got a few groups I've already created.
I want to point out here that there are some options here for directory so I can see local directory
as well.
And we just move these over here and see the members of the groups as well.
So local network directory, you can see I've also got options for local groups and local network groups.
So if you have local groups, those would be groups that are local to this machine only on this particular
Mac server or otherwise.
That's the local group basically by created users and groups on the actual machine through the system,
preferences, accounts, system preference.
And then there's local network groups which are really the network piece is the key that it's part of
my open directory domain.
So we're just going to say all groups here, let's go ahead and make a new one, make one for the administration.
So you can see right off the bat I can choose my directory here.
I want to make sure our local network directory is listed because I want added to my open directory
full name here when going call it administration.
And that's fine for a short name and then mailing list.
I'm to leave that blank for right now.
OK.
And you can see I've got my accounting department, my administration, my technology department all
listed here.
Now let's go over here to the accounts.
Now, I'm real quick.
I'm going to mention when you're creating permissions for different resources on your server, you really
want to assign those at the group level where at all possible, unless there's an exception with one
particular user or two, it's really a best practice to basically create your groups, assign permissions
on a group level to resources and then add users to those groups.
So with that said, let me go back to users.
And I've got a couple of users here.
I've got my own local account and you can see here that this is actually the local directory, that's
the local account that I use to log into my server.
And then I've got my local network directory.
So just like groups, I have these separated as well.
I want to make sure when I'm creating new accounts, new user accounts, that I'm creating them in the
network directory because that will be part of my open directory.
So to add a new user, I just hit the plus down here.
The faults in this case are defaulted to local directory, so I really want to make sure I double check
that local network directory full name.
And I'm going to put my username in here.
We've email address is off for now, put a temporary password in for them.
And then no key words, and I don't want them to administrate the server so that I can be part of that
domain admin group and you can see here, there is no place here to add a group.
So I'm going to hit create here first, create an account for Ida.
Now, I need to let her go back into edit user, and now I have the option to add a group from the hip,
plus I'm going to put her in the administration group.
I am actually going to also put her in the accounting group.
She also works in the Accounting Office.
And I say, OK, to both of those, and I see the glass is here.
I go back to groups, you can see I have a member of the accounting department and a member of administration,
so I was actually a member of both groups.
So if I had resources that were assigned to administration and then other resources that were assigned
to accounting, I'd I would be able to access all of those resources because she's in both of those
groups.
One other quick thing I want to show is some of the different service options, so we've talked already
about Ida and Brain here having two different accounts.
So one is absolutely and then an administrator on the server, the other one is not.
So you can see there is something else that you should know.
If I go in here and do edit user.
As you can see here, I have the option to administer the server and that's unchecked here.
But if I go into added access to services.
You'll see that I actually do have access for it to set so that they can use stage and screen sharing.
Now, I may not want that, so I'm going to probably uncheck those things.
I really don't want to be able to access into my server, and I probably don't want them to screen share
either are just a regular accounting user in the office.
So uncheck both of those.
The other item I want to point out to while we're in here is when you do go to edit user and you can
do that or you can double tap, double click on them, you can also go in and disable their account
by checking the login button.
So if I wanted to disable Ida's ability to log in, let's say she's on administrative leave, I want
to disable her access for now, but I don't want to delete her account.
I can hit OK.
And you can see here now I've got disabled listed.
So that means that that user would not be able to log in until I re-enable their account.
So I'm going to edit the user again and I'm going to recheck log in and hit, OK?
The last thing I want to show is how to use account templates to simplify and better manage your your
the consistency of your user environment.
So we've got IRA Glass here and Ida will double click on here.
Just as a reminder, it is in our accounting department.
She's part of the accounting department group and the administration group.
And Ida is not an administrator on the server and Ida does not have the ability to S.H. or screen share
my server.
So I've basically got her set exactly how I want every user in the accounting department to be set up.
So I have the ability here to create a template of her access so that as we on board other colleagues
in his department, they all have the consistent same access across the board.
Now, I only have one or two groups here in this example and a real production environment.
You're going to have several groups who may have other email addresses, distribution lists and other
kinds of access privileges that will make this a little more complicated.
And you'll have to keep track of all these different groups for each of these departments.
And you can get away from all of that by using user groups and then have these templates created to
on board new users.
So to do that, you go down here and you'll see I've got create template from user as an option.
But strangely enough, it's great out.
It's one of the oddities of Ostende servers interface.
We're actually going to go in here to network users and then we'll click on Eita.
And here I'll have the ability here now to create the template from the user.
So I'm going to go ahead and select that.
And the template name is here.
I'm going to actually call this one accounting template.
And I have the ability to make any of these changes, obviously, the groups are already in here and
I'm going to go ahead and get done to this.
Now, what this allows me to do when I go to create a new user.
I have the ability to choose local directory template, I've got my accounting template in here now
and I'll just do.
Username in here.
And put in the password real quick.
And it's already brought over the fact that it can't administer the server.
Of course, I can't see my groups here, but I'll show you in a minute.
It actually does create them.
Now, when I go into Lisa's group here, you'll see the accounting department and administration are
both added.
So that's how you create a user template and then create new users from a user template, which can
be very simple, very simplified if you have a lot of different groups of users that all have to have
the same access across multiple different departments.
And you're onboarding a lot of new users, a very frequent amount of times.