How to Authenticate Mac OS X in Lion Server

In Mac OS X Lion Server, directory services also provide the authentication that allows users to access other services. The common authentication backbones of many prevalent directories are Lightweight Directory Access Protocol (LDAP) and Kerberos. These two technologies are built into Apple Open Directory and Microsoft Active Directory. The descriptions here just scratch the surface of LDAP and Kerberos.

Although directory services facilitate user authentication through passwords, the passwords are not usually stored in directories. That’s because anyone with access to the directory can usually browse its information. In Mac OS X Server, passwords can be stored either in the Open Directory Password Server database or in a Kerberos realm, which is a kind of holding place. When authenticating, Open Directory checks with the Kerberos realm first.

In Mac OS X Server, Open Directory never even reads the passwords. Each account password is stored as encrypted value called a shadow hash for each user. When the user submits a password for authentication, Open Directory runs it through the hash and compares the values of the hashes. If they match, the user is authenticated. Open Directory doesn’t read the actual password.

When authenticating a user, Open Directory checks the user account stored in the directory to determine whether to use Kerberos authentication, the Password Server, or other supported methods. You can change that setting for a user account in Workgroup Manager. A user account can also specify both Kerberos and Password Server. In this case, Open Directory will try Kerberos first.

dummies

Source:http://www.dummies.com/how-to/content/how-to-authenticate-mac-os-x-in-lion-server.html