People who have managed Open Directory and will be moving to Synology will note that directory services really aren’t nearly as complicated was we’ve made them out to be for years. This is because Apple was protecting us from doing silly things to break our implementations. It was also because Apple bundled a number of seemingly disparate technologies into ldap. It’s worth mentioning that LDAP on a Synology is LDAP. We’re not federating services, we’re not kerberizing services, we’re not augmenting schemas, etc. We can leverage the directory service to provide attributes though, and have that central phone book of user and group memberships we’ve come to depend on directory services to provide.
To get started, open the Package Center and search for Directory. Click Install for the Directory Server and the package will be installed on the Synology.
When the setup is complete, open the Directory Server from the launcher available in the upper right hand corner of the screen.
The LDAP server isn’t yet running as you need to configure a few settings before starting. At the Settings screen, you can enable the LDAP service by checking the box to “Enable LDAP Service” and providing the hostname (FQDN) of the service along with a password.
Once the service is configured, you’ll have a base DN and a bind DN. These are generated based on the name provided in that FQDN field. For example, if the FQDN is “synology.krypted.com”, its Base DN will be “dc=synology,dc=krypted,dc=com”. And the Bind DN would add a lookup starting a root, then moving into the users container and then the hostname: uid=root,cn=users,dc=synology,dc=krypted,dc=com
If this is for internal use, then it’s all setup. If you’ll be binding external services to this LDAP instance, make sure to open ports 389 (for LDAP) and/or 636 (for LDAP over SSL) as well.
Once you have information in the service, you’ll want to back it up. Click on Backup and Restore. Then click on Configure.
At the Configure screen, choose a destination.
I prefer using a directory I can then backup with another tool. Once you have defined a place to store your backups using the Destination field, choose a maximum number of backups and configure a schedule for the backups to run (by default backups run at midnight). Then click OK. You now have a functional LDAP service. To create Groups, click on the Group in the left sidebar.
Here, you can easily create groups by clicking on the Create button. At the wizard, provide a group name and then enter the name of a group (accounting in this example).
Click Next, then Apply to finish creating the group. One you have created your groups, click on User to start entering your users. Click Create. At the User Information screen, enter the name, a description if needed, and the password for a user. You can also restrict password changes and set an expiration for accounts. Click Next to create the user.
At the next screen, choose what groups the new user will be in and click Next.
Enter any extended attributes at the next screen, if you so choose (useful for directories).
Click Next and then Apply.
For smaller workgroups, you now have a functional LDAP service! If you’d like a nice gui to access more options, look at FUM (
https://github.com/futurice/futurice-ldap-user-manager ), LAM ( https://www.ldap-account-manager.org/lamcms/ ), LinID ( http://www.linid.org/welcome/index.html )or other tools. I wrote an article on LDAP SACLs awhile back, so I’ll try and track that down and update it for Synology soon!
krypted April 5th, 2018
Posted In: Mac OS X Server, Synology
Apple, MAC, macos, macos server, migrate, move open directory to openldap, OpenLDAP, SACL, setup, users
When using Podcast Producer, the Podcast Capture client application will ask each user for a username and password. Armed with the authentication credentials. Once a podcast has been captured then the user will be provided with a list of workflows that they have access to. But where are these configured? They can be added and removed from Server Admin. And each can have a user, users, a group or groups that have access to use them. By limiting access to each workflow, based on the Workflow ACL, you can then limit who can access to different blogs, who can use various automations and even who can publish to an iTunes U account, or a different third party service if you’ve scripting against a given API.
In order to set these Workflow ACLs, open Server Admin and choose the Podcast Producer entry in the Server Admin sidebar, from the appropriate server. Then click on the workflow you would like to limit access to. By default, all users have access to all workflows. Click on the Allow Access to…for the following users and groups radio button and then click on the plus sign (+). Then from the floating list of users and groups, choose the object you would like to grant access to and then drag it into the list. Then click on the Save button and you will save your changes.
krypted August 21st, 2009
Posted In: Mac OS X Server
acl, Control, limit access, Podcast Producer, podcasting, restrict, SACL, Workflow