
Learning About the Active Directory Plug-in
You can configure Mac OS X to access basic user account information in an Active Directory domain of a Windows 2000 or Windows 2003 server. What makes this possible is an Active Directory plug-in for Directory Access. This Active Directory plug-in is listed on the Services pane of Directory Access.
You do not need to make any schema modifications to the Active Directory domain to get basic user account information. You may need to change the default Access Control List (ACL) of specific attributes so that computer accounts will have the ability to read the properties. The Active Directory plug-in generates all attributes required for Mac OS X authentication from standard attributes in Active Directory user accounts. The plug-in also supports Active Directory authentication policies, including password changes, expiration, and forced change.
The Active Directory plug-in dynamically generates a unique user ID and a primary group ID based on the user account's Globally Unique ID (GUID) in the Active Directory domain. The generated user ID and primary group ID are always the same for each user account even if the account is used to log in to different Mac OS X computers. Alternatively, you can force the Active Directory plug-in to map the user ID to an Active Directory attribute that you specify.
When someone logs in to Mac OS X with an Active Directory user account, the Active Directory plug-in creates a home directory on the startup volume of the Mac OS X computer. The plug-in also tells Mac OS X to mount the user's Windows home directory (as specified in the Active Directory user account) to mount on the desktop as a share point. Using the Finder, the user can copy files between the Windows home directory in the Network globe and the Mac OS X home directory.
Each time a user logs in to Mac OS X with an Active Directory user name and password, the Active Directory plug-in can cache the authentication credentials on the Mac OS X computer. The user can log in again on the same computer when the computer is not connected to the network. You can enable or disable caching of credentials.
If the Active Directory schema has been extended to include Mac OS X record types (object classes) and attributes, the Active Directory plug-in automatically detects and accesses them. For example, the Active Directory schema could be modified using Windows administration tools to include Mac OS X Server managed client attributes. This schema modification would enable the Active Directory plug-in to support managed client settings made in the Preferences module of Workgroup Manager. Mac OS X clients assume full read access to attributes that are added to the directory. Therefore, it may be necessary to modify the ACL of those attributes to allow Computer accounts to read these added attributes.
The Active Directory plug-in automatically discovers all domains in an Active Directory forest. You can configure the plug-in to allow users from any domain in the forest to authenticate on a Mac OS X computer. The multi-domain authentication can also be disabled to allow only specific domains to be authenticated on the client.
The Active Directory plug-in fully supports Active Directory replication and failover. It discovers multiple domain controllers and determines the closest one. If a domain controller becomes unavailable, the plug-in automatically falls back to another nearby domain controller.
The Active Directory plug-in uses LDAP to access the Active Directory user accounts and Kerberos to authenticate them. The Active Directory plug-in does not use Microsoft's proprietary Active Directory Services Interface (ADSI) to get directory or authentication services.