Using Centrify's DirectControl with Mac OS X - Cerberis

CENTRIFY WHITE PAPERUSING CENTRIFY’S DIRECTCONTROL WITH MAC OS X1.3 Centrify and the Enterprise Desktop AllianceAs Centrify worked with large organizations todefine requirements for Mac integration withina Windows-centric IT environment, customersfrequently also asked questions regardingadditional services that would further easedeployment and management of Macs. As a result, Centrify decided to spearhead thecreation of the Enterprise Desktop Alliance (EDA), a consortium of Macintosh vendorsthat are delivering enterprise-class software solutions for Mac integration andinteroperability with Windows environments. Along with Centrify’s identity and accessmanagement solution for the Mac, the EDA partners also offer solutions for systemslifecycle management, enterprise data protection, file and print services, andvirtualization. The EDA’s web site provides a wide range of white papers to helpcustomers research solutions, and the organization is sponsoring a series of onlinewebinars demonstrating how their solutions can be used in tandem to lower barriers toacceptance of Macs within the enterprise..The following sections describe the services provided by DirectControl, explain howDirectControl differs from Apple’s management tools, and details the unique features andbenefits of using DirectControl to manage populations of Macintosh computers, bothlarge and small.2 Active Directory Authentication and Access Control for Mac OS XWhile every Mac OS X system that Apple ships comes with a built-in repository for userand group information stored in a local NetInfo database, any time there is more than oneMac OS X system in a network where the users will need to either access sharedresources or log in to other systems, it is best to configure a directory service to centrallymanage these accounts, making them available to all the systems in the network. Appleprovides many different options for configuring a network-based directory service, fromplug-ins that allow usage of existing LDAP directories to their own Open Directoryserver. Apple also delivers an Active Directory plug-in that provides the basic functionsof establishing a trusted relationship between the computer and Active Directory, whichenables Active Directory user accounts to be used for login to the Mac OS X system.However, this plug-in requires local configuration to define how the user’s UID and GIDwill be defined based on their Active Directory account; in most cases it is configured toautomatically generate UIDs and GIDs for Active Directory users logging into thesystem. While this may be acceptable for smaller deployments where the configurationcan be manually set for each system, it does not scale well for deployment in largerenvironments with larger numbers of Mac OS X systems.© 2006-2008 CENTRIFY CORPORATION. ALL RIGHTS RESERVED. 3