Understanding Directory Services

3
Chapter
Understanding Directory
Services
In Mac OS X, managed preferences and directory services are intertwined. Managed
preferences data is stored in directory services. Mac OS X machines use directory
services to obtain information about users, groups, computers, services, and more. In
this chapter, we’ll discuss directory services, some common directory service
configurations, and how directory services relate to managed preferences.
What Are Directory Services?
The term ‘‘directory service’’ refers to a store of information used by the operating
system. Typically, this information store contains information about users and groups. It
often contains information about computers and resources like printers and services,
and may contain information about any entity that an administrator deems necessary. If
this all sounds like a database, it effectively is. The difference is that a directory service
refers only to the
interface
that allows access to this information without specifying the
database or storage mechanism. Apple’s Directory Service framework uses plug-ins that
allow it to access many different data stores and other directory services. These include
local flat files (‘‘BSD’’), local property list files, NIS, Microsoft’s Active Directory, and
LDAPv3.
CHAPTER 3: Understanding Directory Services
18
The most common information stored in a directory service is user account information.
As an example, for each user of a machine, the computer needs to keep track of items
like the following:
 User name
 Password
 Location of the user’s home directory

The computer needs to know the names of the users allowed to log in and their
passwords, so it can verify that the person trying to log in is who he or she claims to be.
Once a person has logged in, the computer needs to know where to find the user’s data
so it can make it available to the user.
In most cases, much more information is actually stored for each user, but this should
get the basic idea across.
A directory service can, and usually does, keep track of information about things other
than users. Information about user groups, computer objects, computer groups, network
mounts, and service configurations is commonly stored in directory services.
Early in the history of computing, data like this was stored locally on each machine. This
was a reasonable arrangement if there were a small number of ‘‘mainframe’’-style
computers that were accessed via dumb terminals. In an organization, if a user needed
to be able to log in to multiple machines, the user account and other information needed
to be created on each machine, or possibly copied from one master machine to all the
others. If a user changed a password on one machine or for one server, the user would
have to remember to log in to all of the other machines and servers and change the
passwords there, or else keep track of multiple passwords. If the user were lucky, the
organization’s systems administrators might have implemented an automatic method of
copying password files between machines.
But with the growth of computer networks and the personal computer revolution,
organizations were quickly overwhelmed by the number of individual machines, each
with its own local store of user account information.
This situation led to the development of centralized systems for storing this type of data.
By storing the data in a central location that all the computers in an organization could
access, the problem of keeping user information consistent across machines went
away. With a consistent source of information about users and groups, access to shared
resources became easier and more secure.
CHAPTER 3: Understanding Directory Services
19
Central directory services granted additional advantages. With all the user account

information stored in one place, it became possible to manage user access centrally.
You could easily manage which computers and services a user had access to by making
changes in the central directory. A user’s password could be reset, or password
complexity could be enforced. Employees leaving a company could have all computer
access quickly removed.
But even today, small organizations may not use central directory services. If each
machine typically has a single user, and there are few shared resources, account
information may be local to each machine.
All Mac OS X machines have a local store of directory information, and they can be
configured to use one or more centralized stores of directory information. If you are
working in an organization that already has a central directory service, it’s likely you can
configure your OS X machines to use that service. If you don’t currently have a central
directory service, and you think your organization could benefit from one, Apple offers a
network directory service as part of Mac OS X Server. It’s probably not the best choice
for a very large organization, but it is more than serviceable for workgroups and small to
medium-sized organizations.
NOTE: Setting up a central directory service is a huge topic. We cannot possibly do it justice
within these pages. If you are interested in setting up Open Directory on Mac OS X Server,
check out Apple’s extensive documentation on the topic:


Open_Directory_Admin_v10.6.pdf

Directory Services and Managed Preferences
Mac OS X’s implementation of managed preferences relies on directory services. All of
the data required to implement a managed preference policy is stored in a directory
service.
If you have any experience with managing Microsoft Windows clients, this might sound
familiar: Windows has a management system known as ‘‘Group Policy Objects’’ or
‘‘GPO,’’ which is usually stored in Active Directory.

CHAPTER 3: Understanding Directory Services
20
On Mac OS X, to manage preferences for a given user, group, computer, or group of
computers, you’ll need to store managed preferences data in a directory service. The
directory service used for this is often a network directory service, but it can also be the
local directory store. Since Mac OS X can communicate with multiple directory services
at the same time, it’s possible to store managed preferences in any available directory,
not just the directory that contains your primary store of users and groups.
Directory Services Supported by Mac OS X
Mac OS X supports several different network directory services. It’s no surprise that
Apple’s own Open Directory is supported, but it’s also possible to use Mac OS X with
several popular third-party directory services. Every Mac OS X machine also has a local
directory service.
Open Directory
Open Directory is Apple’s native centralized directory service. Hosted on Mac OS X
Server, Open Directory is Apple’s implementation of the LDAPv3 directory service and a
secure password server, which allows OS X to store passwords in the various formats
required by different network services in a secure fashion. Open Directory also includes
a tightly integrated implementation of Kerberos 5, a popular system for providing a
‘‘single-sign-on’’ experience, where a user logs in once and is granted access to other
Kerberos-aware services without having to log in for each service. Since Open Directory
is part of Mac OS X Server, it supports Apple’s Managed Preferences out of the box; no
additional configuration is needed.
NOTE: You’ll see the term ‘‘Open Directory’’ used to mean two different things, which can lead
to some confusion. Most commonly, ‘‘Open Directory’’ refers to Apple’s network directory
system hosted on Mac OS X Server, and based on OpenLDAP and MIT Kerberos. You may also
see the term ‘‘Open Directory’’ used to refer to the flexible Directory Service framework
available on Mac OS X, which uses plug-ins to communicate with various directory services
(thus making it ‘‘open’’). This flexible framework can be thought of as similar in concept to the
NSS (Name Service Switch) modules available on other UNIX-like operating systems.

CHAPTER 3: Understanding Directory Services
21
Active Directory
Active Directory is Microsoft’s network directory service. It is probably the most
commonly implemented network directory service, especially in the commercial world.
Apple’s support for Active Directory has steadily improved with each major release of
Mac OS X. Active Directory does not natively support Apple’s Managed Preferences, but
it can be extended to do so. Later in this book, we’ll show you how.
There are also third-party directory service plug-ins that replace or augment Apple’s
Active Directory support. These include Thursby ADmitMac, Likewise Enterprise, and
Centrify DirectControl. You can use many of the techniques in this book with these
alternate Active Directory plug-ins, but these plug-ins also provide additional options.
For example, ADmitMac allows Active Directory administrators to use AD Group Policy
to manage some things on Macs, and also allows Mac administrators to use Workgroup
Manager and Apple’s Managed Preferences. Likewise and Centrify’s products are
similar in this regard.
LDAPv3
L D A P v 3 i s a d i r ec tory serv i c e p r o t o c o l -----that is, LDAPv3 describes a method for
communicating with a directory service and a format for the results. LDAP stands for
Lightweight Directory Access Protocol, so, technically, any directory service that can be
accessed via the LDAP protocol can be called an LDAP server. There are many directory
service implementations that are LDAPv3-compatible. Among them are Novell’s
eDirectory, OpenLDAP, and Red Hat Directory Server. In fact, Mac OS X uses the
LDAPv3 protocol to communicate with Apple’s own Open Directory. This shouldn’t be
surprising, since Apple’s Open Directory is based on OpenLDAP. It is even possible to
use the LDAPv3 protocol to work with Microsoft’s Active Directory. You can store

managed preferences data in any LDAPv3 directory by extending the schema. (A
schema describes the records and attributes stored in the directory, so ‘‘extending the
schema’’ refers to adding to the descriptions of records and attributes.)
NIS
NIS was one of the first popular centralized directory services. It was developed by Sun
Microsystems and was very popular with organizations that had shared
Solaris/UNIX/Linux infrastructures, especially those that used NFS as a shared file
system. It has been largely replaced by the various LDAP implementations, but it is still
supported in Mac OS X through Snow Leopard. It’s not possible to use NIS as a source
of managed preferences data, so if your organization uses NIS as its central directory
store, you’ll need to store managed preferences data in another directory. We’ll discuss
using multiple directories later in this chapter.