Mac® Security Bible

25.3. Understanding Open Directory

A single Mac can have an account for just one user — or a handful of accounts or dozens. Each user, in turn, can have an address book that provides names and email addresses for any number of people, and that address book data is stored on a part of the disk dedicated to that user's account. This arrangement works perfectly well in situations where a person has just one Mac and even in environments where several Macs are in use.

However, there comes a point at which maintaining individual user accounts on each computer and individual address books for each user is more effort than it's worth. For example, suppose you're the administrator of a company with 50 employees, each with his or her own Mac. In order to set up everyone's user accounts, passwords, permissions, network configurations, and other details, you must go through a similar series of steps on each of those 50 computers — and when something changes, you must again carry out your updating tasks 50 times. And what if someone needs to switch computers for some reason? Ah, too bad: The new computer doesn't know who he or she is and must have all his or her account information added again by hand!

Meanwhile, every employee wants his or her address book to contain the names and email addresses of all the others, so that means a tremendous duplication of effort to keep them all accurate, up to date, and in sync. Now, imagine that it's not a company of 50 people but a university of 50,000, ...