Chapter 3: Using Open Directory - 9 Questions

Question 1

What’s the main function of directory services?

Answer 1

Directory services provide a central repository for information about the computers, applications, and users in an organization.

Question 2

What standard is used for data access with Open Directory? What version and level of support is provided for this standard?

Answer 2

Open Directory uses OpenLDAP and the Lightweight Directory Access Protocol (LDAP) standard to provide a common language for directory access. Open Directory uses LDAPv3 to provide read and write access to the directory data.

Question 3

In terms of Open Directory, what four roles can Lion Server play?

Answer 3

Lion Server can be an Open Directory master, a standalone server, connected to a directory system, and an Open Directory replica.

Question 4

What are the two methods of applying password policies, and where are they located?

Answer 4

Per-user policies are defined in Workgroup Manager, and global policies are defined in Server Admin or the Server app.

Question 5

When you create an Open Directory archive, is the sparse image created on the server that hosts the Open Directory service or on the administrator computer from which you run Server Admin?

Answer 5

The archive is created on the server that hosts the Open Directory service.

Question 6

What criteria determines the Open Directory locale with which a Lion Open Directory client associates?

Answer 6

If a Lion computer’s IPv4 address is in the range of a subnet associated with an Open Directory locale, that computer should use any of the Open Directory servers associated with that locale. Otherwise, it will use the default locale.

Question 7

What log shows successful and failed attempts to authenticate against the password service?

Answer 7

Password Service Server Log, located at /Library/Logs/ PasswordService/ApplePasswordServer.Server.log, shows successful and failed attempts to authenticate.

Question 8

What tool can you use to confirm forward and reverse DNS records?

Answer 8

You should use Network Utility to confirm forward and reverse DNS records before configuring as an Open Directory master or replica, or binding to another directory service.

Question 9

What tool can you use to check the ability to obtain a Kerberos ticket?

Answer 9

Ticket Viewer is in /System/Library/CoreServices, and you can use it to confirm the ability to obtain a Kerberos ticket.