TweetFollow Us on Twitter

Directory Service Recipes

Volume Number: 22 (2006)
Issue Number: 11
Column Tag: Mac In The Shell

Directory Service Recipes

More Directory Services manipulation via the Command Line

by Edward Marczak

Introduction

Directory Services: used every day by users of OS X - whether they know it or not. Last month, this column covered the basics of directory services, and gave a few sample ideas. This month, I'll trot out some very practical uses of the command-line directory service tools.

Power Station

As I've alluded to in the past, command-line tools and scripting - shell based or GUI based AppleScript - can be much more powerful than GUI tools. Also, while I pointed out that LDAP is not a database, people still tend to think of it as one. The confusion is understandable: Directory Services protocols allow you to retrieve information via lookups. Depending on the protocol and your access, it may allow you to be the one to store information, too. Like any database, the retrieval of information is key: it would be useless if you could put information into the store without being able to access it. Combined with scripting, not only can we access data, but we can perform actions using the results.

Let's start out with reading and reporting on values. OS X Server using Open Directory stores just about everything for a given user in a record in LDAP. Sometimes, you'll want to know which users have some attribute. I do a lot of work with OS X e-mail systems, and a common request is an easy way to report on which users have mail enabled (or, conversely, which users are not mail enabled). Here's a handy little script that will do just that - show which users are set up for OS X e-mail:

mail-enabled.sh

#!/bin/sh
for user in $(dscl /LDAPv3/127.0.0.1 -list /Users)
do
        me=$(dscl /LDAPv3/127.0.0.1 -read /Users/$user MailAttribute)
        if [ "$me" !=  "No such key: MailAttribute"  ]; then
                echo "$user"
        fi
done

Do notice here that we're relying on the failure to find the attribute as a way to make our determination. If you want to find users who do not have mail enabled, just change the test from not equal ("!=") to equal ("=="). If you're a Kerio Mail Server user, and are using the Open Directory extensions, rather than "MailAttribute", you want to look for "kerio-Mail-Active: 1". Run this right on your OD master or replica to get your results. This can be extended to run from cron every night and produce a report via e-mail. You could even redirect the results to a file and use diff to report on new mail users, and users that have been disabled.

Everything but the Girl

Let's even go easier, but potentially more useful. Hierarchies on a network are useful. People tend to think in that manner, and like to press them into service. If you're using OD based logins, with or without network home directories, you have a handy tool at your disposal: your user list. More than once, I've been asked to create a sharepoint on the network, and then fill it with a directory for each user in the system. On a large system, this could be incredibly tedious. So, you script it. Or, in this case, you can even one-line it:

dscl /LDAPv3/127.0.0.1/ -list /Users | xargs mkdir

Of course, that will create directories at your current place in the structure. This means that you'll want to cd to the location you want them before running this command.

While handy, you probably need a little bit more, like setting the correct permissions, or even copying some default information into each folder. An easy framework for that is:

#!/bin/bash
dscl /LDAPv3/127.0.0.1/ -list /Users | while read user
do
  #Do your work here
done

Quick results from little work!

(Don't Burn the) Midnight Oil

Another really handy scenario crops up with OS X 10.4 in an all OD network. Using a tool like Apple Remote Desktop, you can certainly create local admin users on all machines in your network very easily. However, that can become a small management headache: If you want to change the password for the admin user, then you have to remember to get every box. It also doesn't allow for any fine-grained control. One great solution to this is to create admin groups in OpenDirectory. You can then nest these groups inside of the local NetInfo admin group. From there, simply moving users in and out of the OD admin groups will give them the correct permissions on a given machine. Let's look at an example.

Imagine that a company (or school) has two open labs: one for word processing/presentation development, and another for 3-D graphics. Each lab has a local support team that need admin rights to the Macs. You would create three groups in OpenDirectory: WPLabAdmins, 3DLabAdmins, and UberAdmins - the final group being able to administer both labs. Assign users to the appropriate groups. You'll then need the OD group's UUID, which of course can be scripted. Create the script as update-admin-group.sh:

update-admin-group.sh

#!/bin/bash
theUUID=$(dscl /Search -read /Groups/$1 apple-generateduid | sed 's/apple-generateduid: //g')
dscl /NetInfo/root -create /Groups/admin NestedGroups $theUUID

Then, run it on each group of machines as appropriate:

On all machines:

update-admin-group.sh UberAdmins

On the word processing machines:

update-admin-group.sh WPLabAdmins

Finally, on the 3D machines:

update-admin-group.sh 3DLabAdmins

Now, as people need admin access to a given machine, they can simply use their own OD ID. Very, very cool. Once this is set, you can just move people in and out of OD groups, rather than futz with anything on any local machine. Much better, right?

Ah Ha!

dscl: incredibly useful. However, I'd be remiss if I didn't mention its counterpart that appeared in 10.4: dseditgroup. dseditgroup appeared to make it easier to work with groups, especially with the new ability to have nested groups.

By default, dseditgroup operates on NetInfo data, but, as the 'ds' suggests, will work with any Directory Service plug-in. This includes anything you can set up in Directory Utility, such as LDAP and Active Directory. So, while we're speaking about admin accounts, let's see examples of dseditgroup in action.

To read all information about a NetInfo group, simply use dseditgroup groupname. So, to see your admin group:

# dseditgroup admin
Recordname <admin>
10 attribute(s) found
Attribute[1] is <dsAttrTypeStandard:AppleMetaNodeLocation>
        Value[1] is </NetInfo/DefaultLocalNode>
Attribute[2] is <dsAttrTypeStandard:RecordType>
        Value[1] is <dsRecTypeStandard:Groups>
Attribute[3] is <dsAttrTypeStandard:RecordName>
        Value[1] is <admin>
Attribute[4] is <dsAttrTypeStandard:PrimaryGroupID>
        Value[1] is <80>
Attribute[5] is <dsAttrTypeStandard:Password>
        Value[1] is <*>
Attribute[6] is <dsAttrTypeStandard:GroupMembership>
        Value[1] is <root>
        Value[2] is <localadmin>
Attribute[7] is <dsAttrTypeStandard:GeneratedUID>
        Value[1] is <ABCEEFAB-CDEF-ABCD-ECAB-CDEF00000050>
Attribute[8] is <dsAttrTypeStandard:SMBSID>
        Value[1] is <S-1-5-32-544>
Attribute[9] is <dsAttrTypeStandard:RealName>
        Value[1] is <Administrators>
Attribute[10] is <dsAttrTypeStandard:GroupMembers>
        Value[1] is <43C93B6A-CFB9-4C24-A464-EA51320B62D2>
        Value[2] is <F047F2F1-F5A9-4B73-BBB4-454550B09CB4>

The same thing can be accomplished for an OD group, using the -n switch:

# dseditgroup -n /LDAPv3/127.0.0.1 admin

dseditgroup also has operations to manipulate groups, either local (NetInfo), or other datastore. To remove a user from an OD admin group, you could handle it this way:

dseditgroup -o edit -n /LDAPv3/127.0.0.1 -u admin-user -p -d user-to-delete -t user admin

Note that sensitive operations against Directory Services will require authentication, as seen here with the -u and -p flag.

Conclusion

Directory services in general are an incredibly powerful way to maintain a central store for objects on a network, easing administration. The usefulness of these services wouldn't be diminished if only GUI tools were available. I do hope, though, that I've illustrated how powerful scripting and command-line tools can be, and what they bring to the process.

Media of the month: Michael Bartosh's posthumously released Mac OS X Tiger Administration. A surprise follow-up to his Panther Server Administration after being told that the Tiger version was cancelled. This PDF-only version of the book was started by Michael, and completed by several of his good friends after Michael passed away. It's available from <http://www.orielly.com>.

Again, it's time to make your plans for MacWorld! Hope to see people on the show floor, or at either of the sessions I'll be presenting (old news to long-time readers of my column, though!). In any case, I'll see you in print next month.

References:

dscl man page

dseditgroup man page


Ed Marczak owns and operates Radiotope, a technology consulting practice with a focus on business process enhancement, network and system integration, and, more generally, all things Mac.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

WebSnapperPro 2.0.5 - $20.00
WebSnapperPro lets you capture full web pages exactly as they appear in your browser, with a single mouse click, without the need to "stitch" or cut-and-paste. Save the page as an image file or as... Read more
VOX 3.2.1 - Music player that supports m...
VOX just sounds better! The beauty is in its simplicity, yet behind the minimal exterior lies a powerful music player with a ton of features and support for all audio formats you should ever need.... Read more
Evernote 7.0 - Create searchable notes a...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
Hopper Disassembler 4.3.16- - Binary dis...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32- and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about its... Read more
VOX 3.2.1 - Music player that supports m...
VOX just sounds better! The beauty is in its simplicity, yet behind the minimal exterior lies a powerful music player with a ton of features and support for all audio formats you should ever need.... Read more
Evernote 7.0 - Create searchable notes a...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
Hopper Disassembler 4.3.16- - Binary dis...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32- and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about its... Read more
Default Folder X 5.2.2 - Enhances Open a...
Default Folder X attaches a toolbar to the right side of the Open and Save dialogs in any OS X-native application. The toolbar gives you fast access to various folders and commands. You just click on... Read more
EtreCheck 4.0.1 - For troubleshooting yo...
EtreCheck is an app that displays the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to... Read more
Carbon Copy Cloner 5.0.9 - Easy-to-use b...
Carbon Copy Cloner backups are better than ordinary backups. Suppose the unthinkable happens while you're under deadline to finish a project: your Mac is unresponsive and all you hear is an ominous,... Read more

Latest Forum Discussions

See All

Our top 5 characters from casual RPG Cre...
Creature Quest definitely lives up to its name with a host of collectible creatures based on fantasy tales and world mythologies. To celebrate Creature Quest’s first birthday, we’re going to lay out what we think are the five best characters in the... | Read more »
Around the Empire: What have you missed...
Did you know that Steel Media has a whole swathe of other sites dedicated to all aspects of mobile gaming? Sure you'll get the very best iPhone news, reviews, and opinions right here at 148Apps, but we don't want you missing out on a single piece... | Read more »
All the best games on sale for iPhone an...
Oh hi there, and welcome to our round-up of the best games that are currently on sale for iPhone and iPad. You thought I didn't see you there, did you, skulking behind the bushes? Trust me though, the bushes aren't where the best deals are. The... | Read more »
The Battle of Polytopia Guide - How to H...
A new update just released for The Battle of Polytopia (formerly Super Tribes), which introduces online multiplayer. For all the fans of Midjiwan’s lite take on Civilization, this is certainly welcome news, but playing online isn’t as easy and... | Read more »
Here are the very best mobile games to p...
It's Valentine's Day! Did you get loads of cards and chocolates and other tacky, simple expressions of human affection? Did you send out tat because you find it almost impossible to express emotion unless there's a section dedicated to it at your... | Read more »
Florence (Games)
Florence 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: Florence is an interactive storybook from the award-winning lead designer of Monument Valley about the heart-racing highs and... | Read more »
Purrfect Date (Games)
Purrfect Date 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: Cats are a lil’ like marmite. Either you absolutely head-over-heels love’ em, or… nahhh, who are we kidding?! Everyone... | Read more »
More monsters to collect and evolve in C...
A laid-back mix of RPG and TCG, Creature Quest is all about building your deck, evolving your creatures and winning in battle. It’s the creation of VC Mobile, set up by Might and Magic producer Jon Van Caneghem. There are elements of that classic... | Read more »
Check out this awesome hands-on with the...
Well, PlayerUnknown's Battlegrounds has come out on mobile. This isn't a clone, this isn't a riff on the battleroyale mechanics of the game, it's the official mobile port by Tencent. But there's a little bit of a hitch. [Read more] | Read more »
Hostage Negotiator (Entertainment)
Hostage Negotiator 1.1.0 Device: iOS Universal Category: Entertainment Price: $3.99, Version: 1.1.0 (iTunes) Description: Official app of the board game by AJ Porfirio and Van Ryder Games. In Hostage Negotiator, you play the part of... | Read more »

Price Scanner via MacPrices.net

13″ 3.1GHz/256GB Silver Touch Bar MacBook Pro...
Amazon has the Silver 13″ 3.1GHz/256GB Touch Bar MacBook Pro (MPXX2LL/A) on sale for $1649.99 including free shipping. Their price is $150 off MSRP, and it’s the lowest price available for a new 13″... Read more
Saturday Sale: Amazon offers 13″ 1.8GHz/256GB...
Amazon has the 13″ 1.8GHz/256B Apple MacBook Air on sale today for $250 off MSRP including free shipping: – 13″ 1.8GHz/256GB MacBook Air (MQD42LL/A): $949.99, $250 off MSRP Their price is the lowest... Read more
Roundup of Apple Certified Refurbished 12″ Ma...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more
Apple offers Certified Refurbished 10″ and 12...
Apple is now offering Certified Refurbished 2017 10″ and 12″ iPad Pros for $100-$190 off MSRP, depending on the model. An Apple one-year warranty is included with each model, and shipping is free: –... Read more
Apple Canada offers Certified Refurbished Mac...
 Canadian shoppers can save up to $560 on the purchase of a 2017 current-generation MacBook Pro, MacBook, or MacBook Air with Certified Refurbished models at Apple Canada. Apple’s refurbished prices... Read more
Sale! 13″ MacBook Airs for up to $180 off MSR...
B&H Photo has 13″ MacBook Airs on sale for $50-$120 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 13″ 1.8GHz/128GB MacBook Air (MQD32LL/A): $899, $... Read more
Sale! New 8-core iMac Pro for $4799, $200 off...
Adorama has the 8-core iMac Pro on sale for $4799 including free shipping plus NY & NJ sales tax only. Their price is $200 off MSRP, and it’s the currently lowest price available for an iMac Pro. Read more
Sale! Walmart lowers prices even more on 9″ i...
Walmart has lowered their sale price on 9.7″ Apple iPads to $80 off MSRP for a limited time. Sale prices are for online orders only, in-store prices may vary: – 9″ 32GB iPad: $249.99 $80 off – 9″... Read more
Roundup of 13″ MacBook Pro sales, models avai...
B&H Photo has 13″ MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only. Their prices are the lowest available for these... Read more
Roundup of 15″ MacBook Pros sale, models up t...
B&H Photo has 15″ MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 15″ 2.8GHz Touch Bar MacBook Pro Space Gray (... Read more

Jobs Board

*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Solutions Consultant - Apple (United...
# Apple Solutions Consultant Job Number: 113501424 Norman, Oklahoma, United States Posted: 15-Feb-2018 Weekly Hours: 40.00 **Job Summary** Are you passionate about Read more
Senior Program Manager - *Apple* Music - Ap...
# Senior Program Manager - Apple Music Job Number: 113393020 Seattle, Washington, United States Posted: 02-Feb-2018 Weekly Hours: 40.00 **Job Summary** Apple is Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.