Here's the procedure I have followed:
-
Install a fresh copy of macOS Mojave to an APFS volume
-
Perform initial OS configuration and create 'admin' user at first launch. Assign a static IP from 192.168.168.0/24 private network. Use a DNS server located in private network. Ensure IP resolves to a FQDN ('test.mydomain.com') and vice versa.
- Download macOS Server application (5.7) from App Store
- Open macOS Server application
- Create a new Open Directory domain with default options
- Create a new user 'testuser' to Local Network Directory
- Create a new group 'testgroup' to Local Network Directory
- Assign newly created 'testuser' to 'testgroup'
- Open System Preferences application
- Open Sharing preferences
- Enable File Sharing
- Create a Shared Folder 'myshare' and assign 'testgroup' and 'admin' Read&Write access to it
-
Select 'myshare' and click Options button to ensure SMB sharing is enabled for it
-
Attempt to connect to the file server from a client computer within the same subnet via smb://test.mydomain.com/myshare or alternatively smb://192.168.168.X/myshare either using 'admin' or 'testuser' credentials
In the last step connection fails for both 'admin' and 'testuser' accounts. If I turn Open Directory to Off, I can connect with 'admin' user. Restarts in any phase of the procedure make no difference.
Why can't I access SMB when Open Directory is enabled?
Here are the opendirectoryd log entries from creating the OD master (step 5): https://pastebin.com/uQm8b8NM
Here are the opendirectoryd and smbd log entries from login attempt (step 14): https://pastebin.com/U2RS3LYC & https://pastebin.com/7bFNfd8V
Best Answer
The issue is the ACLs are not set up in the local directory for SMB and AFP. These used to be created in the older Server apps that had File Sharing in them. I've written an AppleScript that takes care of all this. It creates the appropriate ACL groups in the directory (/Local/Default/Groups/com.apple.access_smb and com.apple.access_afp), then adds all the users to it. The script is below. I threw it together today trying to solve this very issue. Hopefully it will help others.