Profile Manager with Active Directory - profiles not applying?

[localzuk]

Now that I have profile manager enrolling devices, I am on to the next stage - which is getting Active Directory auth working too.

 

I have AD auth enabled on both the server and client, and I can log in to the client with an AD username. In Profile Manager, all the AD groups are listed, and users I log in to a client with appear in the user list too. However, if I edit a profile for a group the user is a member of (eg. JSmith is a member of the DOMAIN\Students group), the settings appear on the server but don't get applied when a user in the group logs in.

 

If I edit a profile for that individual user, the user disappears and a task appears in Active Tasks and just sits there.

 

In the logs I'm getting:

 

[font=arial]Jul 10 10:03:32 [/font][url="http://8014042-apple.schools.bristolbsf.net/"]8014042-apple.schools.bristolbsf.net[/url][font=arial] ProfileManager[357] : Failed auth, od_user_guid=0B5E0F18-9C20-[/font][font=arial]4FAF-9D39-33A657C01779, device.user.guid=118E60B4-[/font][font=arial]3933-4073-8DD9-54ED7A8788FB, auth_token=[FILTERED], incoming_request=[/font][font=arial]UserID0B5E0F18-9C20-4FAF-9D39-[/font][font=arial]33A657C01779UDID63B8917B-E050-[/font][font=arial]5E84-8AE4-[/font][font=arial]F31F1F290D70MessageTypeUserAut[/font][font=arial]henticate[/font][font=arial]Jul 10 10:03:32 [url="http://8014042-apple.schools.bristolbsf.net/"]8014042-apple.schools.bristolbsf.net[/url] ProfileManager[357] : Completed in 27ms (View: 0, DB: 11) | 200 OK [[url]https://8014042-apple.schools.bristolbsf.net/device/checkin[/url]][/font]
[font=arial]Jul 10 10:03:32 [url="http://8014042-apple.schools.bristolbsf.net/"]8014042-apple.schools.bristolbsf.net[/url] ProfileManager[362] : Processing DeviceController#checkin (for 10.16.49.113 at 2012-07-10 10:03:32) [PUT][/font]
[font=arial]Jul 10 10:03:32 [url="http://8014042-apple.schools.bristolbsf.net/"]8014042-apple.schools.bristolbsf.net[/url] ProfileManager[362] : Failed auth, od_user_guid=0B5E0F18-9C20-4FAF-9D39-33A657C01779, device.user.guid=118E60B4-3933-4073-8DD9-54ED7A8788FB, auth_token=[FILTERED], incoming_request=UDID63B8917B-E050-5E84-8AE4-F31F1F290D70UserID0B5E0F18-9C20-4FAF-9D39-33A657C01779MessageTypeUserAuthenticateDigestResponseDigest username="lbrady670",realm="[url="http://8014042-apple.schools.bristolbsf.net/"]8014042-apple.schools.bristolbsf.net[/url]",nonce="SZg1I0k+Jp7GwAwEodNIGcWVVAPog+LPfyVXnLpstdHDDMdx",nc="00000001",cnonce="232spr/FmYPB9w8qfGo8EGxXIeyrh/k4J061Kp1d7tdwGna/",qop="auth",uri="/",response="f81d627263894a62a041c1d9f9a54d1d"[/font]
[font=arial]Jul 10 10:03:32 [url="http://8014042-apple.schools.bristolbsf.net/"]8014042-apple.schools.bristolbsf.net[/url] ruby[362] : SCEP_HELPER: /SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-704.9/scep_helper/ScepHelperExtension.c:431 'SCEPHELPER_ValidateDigestChallenge(serverCon, outgoing_uuid, outgoing_uuidCnt, outgoing_response, outgoing_responseCnt)' = -1

[/font]

[localzuk]

And now, 78 random accounts have populated into the user list in Server.app (ie. as if they've been imported)... Why!?

[Rozzer]

Did you join your server to active directory before you setup profile manager?

 

Ross

[X-13]

And now, 78 random accounts have populated into the user list in Server.app (ie. as if they've been imported)... Why!?

 

I'm not saying it's aliens... But, it's totally aliens.

[localzuk]

Did you join your server to active directory before you setup profile manager?

 

Ross

 

No. I set up Profile Manager first, then did the AD bit, thinking it made more sense to get the Apple bit working, then the bells and whistles afterwards.

[maark]

Would like to resurrect this thread instead of opening a new one - did you ever get it working?

I have same issue:

server running mac os x lion 10.7.5 (latest update)

tried on a client running 10.6 and another with 10.7

client and server are bound to active directory.

client is linked to mac server as well - get green light indicating it is connected.

can logon to client ok with active directory accounts but no profile settings are picked up.

Got list of users and groups from AD on the server - however it does not show the users as being in any groups.

 

tried settings in profile manager on server for individual users and groups but nothing is picked up?

Anyone help - is there something i am missing?