There is more than one way to do this but this is what I do on every casper server I have.
On a separate volume from the OS I create a share called CasperShare and share it on the network. I keep the local admin account of the sever as the owner and then create two other local user accounts on that machine. They are casper admin and casper install. Casper admin has full rwx permissions and casper install has -r- via an ACL while the local admin account owns that folder and all sub folders.
That way it is kept out of my LDAP, and never authenticating against any one of my Directory servers, and if my LDAP for whatever reason goes down casper is still up and running by itself to take over.
So, lets say dooms day hits my network and like my Directory servers go down. We use PHDs so users can still log in, and they can still be managed by the casper client even if my directory servers have to go down for a few days. Worst case scenario, I know...
Then in the web interface for the JSS just set up each server by IP or FQDN and then set the read only user name and password and then the read/write user name and password and it will use those to authenticate.
This simple set up allows me to build a casper server from scratch in like under an hour. Over the summer we installed 7 new xserves for our casper deployment and we got them all up and running and our old JSS migrated to our new one in two days total time. That included the time it took to drive out to each location and install the server as well.
I am a big fan of keeping it simple.
Thomas Larkin
TIS Department
KCKPS USD500
tlarki at kckps.org
blackberry: 913-449-7589
office: 913-627-0351
