Apple Open Directory 3736071 218231587 2008-06-09T19:19:48Z Singingwolfboy 402267 /* Directory Services Framework */ fixed NIS link to avoid disambiguiation page '''Open Directory''' is the [[LDAP]] [[directory service]] model implementation from [[Apple Inc.]] A directory service is [[computer software|software]] which stores and organizes information about a [[computer network]]'s users and network resources and which allows network administrators to manage users' access to the resources. In the context of Mac OS X Server, ''Open Directory'' describes a shared [[Lightweight Directory Access Protocol|LDAPv3]] directory domain based on [[OpenLDAP]] and a corresponding authentication model composed of Apple Password Server and [[Kerberos (protocol)|Kerberos]] 5 tied together using a modular Directory Services system. The term ''Open Directory'' can also be used to describe the entire directory services framework used by Mac OS X and Mac OS X Server. In this context, it describes the role of a Mac OS X or Mac OS X Server system when it is connected to an existing directory domain. ==Implementation in Mac OS X Server== [[Mac OS X Server]] can host an ''Open Directory domain'' when configured as an ''Open Directory Master''. In addition to its local directory, this OpenLDAP-based LDAPv3 domain is designed to store centralized management data, user, group, and computer accounts, which other systems can access. The directory domain is paired with the ''Open Directory Password Server'' and, optionally, a Kerberos realm. Either provides an authentication model and stores password information outside of the directory domain itself.<ref>{{cite web | title=Mac OS X Server: Open Directory Administration, page 40 | url=http://images.apple.com/server/pdfs/Open_Directory_v10.4.pdf | accessdate=2007-06-07}}</ref> For Kerberos authentication, the Kerberos realm can either be hosted by a Kerberos [[key distribution center]] (KDC) running on the server system, or the server can participate in an existing Kerberos realm. For services that are not Kerberized, the Password Server provides the following [[Simple Authentication and Security Layer]]-based authentication methods:<ref>{{cite web | title=Mac OS X Server: Open Directory Administration, page 50 | url=http://images.apple.com/server/pdfs/Open_Directory_v10.4.pdf | accessdate=2007-06-07}}</ref> * [[APOP]] * [[CRAM-MD5]] * [[Diffie-Hellman key exchange]] * [[MD5|Digest-MD5]] * [[MS-CHAPv2]] * [[NTLM]] v1 and v2 * [[NTLM|Lan Manager]] * [[WebDAV|WebDAV-Digest]] Any Mac OS X Server system configured as an Open Directory Master can act as a Windows Primary Domain Controller (PDC), providing domain authentication services to [[Microsoft Windows]] clients.<ref>{{cite web | title=Server Admin 10.4 Help: Setting Up a Server as a Primary Domain Controller | url=http://docs.info.apple.com/article.html?path=ServerAdmin/10.4/en/c2wn5.html | accessdate=2007-06-07}}</ref> ==Directory Services Framework== In a more general sense, Open Directory can describe the plugins model used by [[Directory Access]] and the directory services framework in Mac OS X and Mac OS X Server. This could be thought of as analogous to the [[Name Service Switch]] systems of some other [[Unix-like]] [[operating system]]s. When ''connected to a directory system'', a Mac OS X client or Server can authenticate users, lookup contacts, perform service discovery and name resolution with the following types of directories:<ref>{{cite web | title=Mac OS X Server: Open Directory Administration, chapter 7 | url=http://images.apple.com/server/pdfs/Open_Directory_v10.4.pdf | accessdate=2007-06-07}}</ref> * Authentication & Contacts ** Microsoft [[Active Directory]] ** [[Lightweight Directory Access Protocol|LDAPv3]], including an Open Directory domain or RFC 2307-compliant system ** Apple/NeXT [[NetInfo]] domains ** BSD flat files and [[Network Information Service|NIS]] * Service Discovery & Name Resolution ** [[AppleTalk]] ** Windows (NetBIOS and [[Windows Internet Name Service|WINS]]) ** [[Service Location Protocol|Service Location Protocol (SLP)]] ** [[Zeroconf |Multicast DNS (Bonjour/Zeroconf)]] ==History== Open Directory began with Mac OS X Server 10.2. In this initial form, Open Directory consisted of a network-visible NetInfo directory domain and a corresponding Authentication Manager service for storing passwords outside of the directory. Version 10.2 also included support for Kerberos.<ref>{{cite web | title=Apple - Mac OS X Server 10.2: How to Integrate Services With Kerberos | url=http://docs.info.apple.com/article.html?artnum=107155 | accessdate=2007-06-08}}</ref> Mac OS X versions 10.1 and 10.0 stored user password information within the directory domain using crypt password authentication authorities, but version 10.2 paved the way for the current Shadow Hash and Password Server mechanisms.<ref>{{cite web | title=Mac OS X Server: Open Directory Administration, page 41 | url=http://images.apple.com/server/pdfs/Open_Directory_v10.4.pdf | accessdate=2007-06-08}}</ref> Password Server is the successor to Authentication Manager, and was introduced in Open Directory 2 in Mac OS X Server 10.3. Open Directory 2 was also the first version to use LDAPv3 as the directory domain. Mac OS X Server 10.4 includes Open Directory 3, which introduced Active Directory domain member support, trusted directory binding, and increased robustness.<ref>{{cite web | title=Apple - Mac OS X Server - Open Directory | url=http://www.apple.com/server/macosx/opendirectory.html | accessdate=2007-06-08}}</ref> [[Mac_OS_X_Server#Mac_OS_X_Server_10.5_Leopard|Mac OS X Server 10.5]] features Open Directory 4 with support for cross-domain authorization and a built-in [[RADIUS]] server for managing [[AirPort]] base stations.<ref>{{cite web | title=Apple - Mac OS X Server - Technology - Open Directory | url=http://www.apple.com/server/macosx/technology/opendirectory.html | accessdate=2007-12-21}}</ref> Open Directory 4 no longer includes elements of NetInfo.<ref>{{cite web | title=AFP548 - Leopard Server Part 2 - Local Directory Services | url=http://www.afp548.com/article.php?story=LeopardServerReview-LocalDirectory | accessdate=2007-12-21}}</ref> == See also == * [[List of LDAP software]] ==External links== {{Wikibooks|Mac OS X Tiger Server/Open Directory}} *[http://www.apple.com/server/macosx/technology/opendirectory.html Apple's Open Directory Page] *[http://images.apple.com/server/macosx/docs/Open_Directory_Admin_v10.5.pdf Open Directory 4 Manual] *[http://www.macdevcenter.com/pub/a/mac/2007/07/18/discover-the-power-of-open-directory-part-3.html How To Set Up Open Directory] == References == <div class="references-small"> <references/> </div> <br clear="both" /> {{Mac OS X Server}} [[Category:Identity management systems]] [[Category:Mac OS X]] [[Category:Mac OS X Server]] [[Category:Mac OS X-only software made by Apple Inc.]] [[Category:Apple Inc. software]] [[it:Apple Open Directory]] [[ja:Apple Open Directory]]