Binding to Active Directory with Munki01 Apr 2014
Many organisations need to bind their Macs to AD. There are quite a few options however, that need to be changed. It’s quite a straightforward process to automate this with Munki, although you do have a few options to consider.
First off, how are you going to deliver the actual bind script? You have the option of a no-pkg pkginfo file, with the script directly in the pkginfo plist. Whilst the script is now easily editable in the pkginfo, it does pose a security issue in that the catalog is kept in /Library/Managed Installs/catalogs, which will contain your script. Along with your AD bind account’s details. Whoops!
Prepare the Bind!
My preferred way of deploying the bind script is with a payload-free package made with The Luggage. My bind script is nothing special, it was originally borrowed from DeployStudio. You can find the script and the Makefile on my macscripts repo. If you need a primer on The Luggage, I wrote about it in August 2013. You just need to edit the variables at the top of the script to suit your environment and build the package.
So you’ve got the machine bound to AD. Great. What happens if the binding doesn’t go to plan? Or a well meaning tech manages to unbind the machine, but can’t manage to re-bind it? Or even worse, the user manages to unbind it themselves? We need to make Munki check that the Mac is still bound to AD.
You should save this as install
check_script.sh in the same directory as your binding package. This script is querying the Active Directory domain the Mac is on and checking it’s the one you want.
Not quite finished
The main issue with using an
installcheck_script is that we’re bypassing every other mechanism that Munki uses to check if an item needs to be installed, which means that if we ever need to update our AD bind package and install it, or if the Mac was previously bound to AD, Munki will cheerfully ignore the package because as far as it’s concerned, if it passes the installcheck_script, everything’s fine and dandy.
installcheck_script.sh take 2
This is a little more complicated, but not much. First off we’re doing the same check as before, making sure we’re actually bound to the domain. If we aren’t, we obviously need to install the package, so that’s the end of that. If we are bound, we next need to check which version of the package we have. As previously mentioned, Munki would usually do this for us, but by using the installcheck_script, we’ve engaged the “leave me alone, I know what the fuck I’m doing” mode in Munki, so we’re implementing that check ourselves. If the version or package identifier don’t match, we want our bind script installed, screw those other guys with their not-as-good-as-our-way of binding.
All that’s left now is to
munkiimport your package with your script as an
There you have it, how to keep a Mac bound to AD with Munki. You may wish to change some other settings later on (particularly if you have to do battle with a .local domain), but this will get you going with a basic AD bind.