Network accounts

[Tobias Alt]

I just set up my first XSAN - and to my surprise it works quite well.

But there is one thing i don´t get:

During SAN setup i created an ODM on the first MDC. On every client i created the same admin account for authentification.

Until know every editor worked localy on his machine, using his own local account. If they use these local accounts to write to the SAN then the rights are messed up. Everyone can read - but only the creators of the files can write.

The solution to this seems to be network accounts. When i create an ldap account with workgroup manager and use that acount to log in on the client i can read and write everything - because i´m a member of "Workgroup".

my question is: is this really the solution? Is everybody out there using network accounts to connect to their XSAN

[rstasel]

Tobias,

Are the clients setup to look at the ODM in Directory Utility (I think this might be the big issue)?

I wouldn't think you'd have any issues if all the users are uid 501 on the servers and clients... but if that admin account isn't the first account on all the machines, then it could cause issues. I guess they could all be the second account, or similar (basically, they all need the same UID).

What version of Xsan and OS X Server are you using? Clients?

I haven't had any issues with multiple machines all reading/writing to the SAN while logged in as the same local user (they're all uid 501).

[abstractrude]

Tobias. Network accounts are the solution. You should start from scratch when it comes to permissions. Come up with a plan to use access control lists with users and groups. Create users and put them into groups, set permissions with groups when possible. Coming up with a good permissions model from the start makes things easier in the end.

This makes adding in additional clients easy too. This is the right way to setup Xsan. Also, its normal to run your OD master on your secondary controller.

[chrisadam]

Until know every editor worked localy on his machine, using his own local account. If they use these local accounts to write to the SAN then the rights are messed up. Everyone can read - but only the creators of the files can write.

The solution to this seems to be network accounts. When i create an ldap account with workgroup manager and use that acount to log in on the client i can read and write everything - because i´m a member of "Workgroup".



___________________________________


Want to get-on Google's first page and loads of traffic to your website? Hire a SEO specialist from Ocean Groups[url=http://oceangroups.org/] seo specialist [/url]

[Mister Googlehea]

haha. yes!!!