Open Directory, Mac OS X's native directory service, allows users to both manage local accounts and to create shared directory domains hosted by Mac OS X Server. With shared directory domains, administrators can create network accounts that can be used to log into computers and to access server-based resources throughout an organization's network.

Open Directory leverages several powerful technologies, including OpenLDAP and Kerberos, to provide a secure and scalable environment. It provides single-sign on to services within a network, supplies powerful home directory options and sports an extremely comprehensive client management architecture. (For more details about the technologies that constitute Open Directory, see my earlier article: "Understanding Mac OS X Open Directory -- An Introduction to Directory Services in the Mac Environment.")

Despite the complex technologies that make up Open Directory, Apple has made an incredible effort to make the platform easy to set up and manage. While this article isn't a comprehensive manual for designing an Open Directory infrastructure, it is a guide to the basic configuration process.

Creating an Open Directory Master

An Open Directory Master is an organization's primary Open Directory server. It hosts the shared LDAP domain that stores network account information, a Kerberos realm and Open Directory password server for securely authenticating users. Any Mac OS X Server installation can serve as an Open Directory Master, though you will want to use a machine that is sufficiently powered to handle directory service requests. Ideally, for optimum performance and security, an Open Directory Master should not be used to provide other network services. You will also need to ensure that your DNS infrastructure is configured properly and successfully supports forward and reverse lookups.

To create an Open Directory domain and to configure domainwide settings, you will use Mac OS X Server's Server Admin utility. Launch Server Admin, connect to the appropriate server and select "Open Directory" in the "Computers and Services" list (see Figure 1).

Then click the "Settings" button at the lower right of the window to display the "Settings" pane. Choose "Open Directory Master" from the "Roles" dropdown menu. You will be asked to specify a domain administrator account -- this is the first account in the domain that will be given full administrative access to manage the domain and to create additional user accounts. This will be a separate account from the server administrator account, which is a local nonshared account for managing other aspects of the server.

You will also be asked to specify a search base for the domain and a Kerberos realm name.

Once you've entered the required information, Mac OS X Server will create an OpenLDAP configuration appropriate to Open Directory, a Kerberos realm and an Open Directory Password Server database. It will then begin the associated processes. While these are complex technologies that are being installed and configured on the server, Apple has made the setup routines extremely simple and reliable.

You can verify that the configuration was successful by checking the Open Directory "Overview" pane to see that the associated services are running. You can also check the related log files using the "Log" pane. The dscl and ldapsearch command-line tools can also be used to query the new domain.

Setting security options

There are several features built into Open Directory to create a secure infrastructure. Kerberos and the Open Directory Password Server do a very good job of limiting the number of times a password is sent over the network, and they encrypt the password as much as possible for each supported authentication method.

If you use only services that support Kerberos, a user's password will never need to be sent over the network. For nonkerberized services, the Open Directory Password Server manages authentication. Although it supports a broad range of authentication and encryption techniques, some are considered weak and should be disabled if they are not required. You can disable weaker and unused techniques by using the "Security" tab within the "Policy" pane of the Open Directory Master's "Settings" pane (see Figure 2).