- Understanding Open Directory
- What About Older Macs Running Mac OS 9?
- Replication: What to Do When One Server Isnt Enough
- Keeping Passwords and Your Infrastructure Safe and Secure
- The Basics of Setting Up an Open Directory Server
- Getting Practical About Open Directory and User Accounts
- Users in Workgroup Manager: The Mac OS X Server Tool for Account Management
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Users in Workgroup Manager: The Mac OS X Server Tool for Account Management
To create a user account, launch Workgroup Manager and connect to the master Open Directory server for the domain in which you are creating the account. Click the Accounts button in the toolbar if it is not already selected. This will display the Accounts list pane and the account information pane. Ensure that you are authenticated to the correct domain (the domain will be displayed next to the blue globe underneath the toolbar). If you see an error that you are working with a domain that is not visible on the network, you have likely selected the server’s local NetInfo domain from this list rather than the shared Open Directory domain.
)
In the accounts list pane, you will see three tabs. The first has an icon of a single user, the second a group of users, and the third an outline of a rectangle. These tabs indicate the user, group, and computer account lists, respectively. You might also see a fourth tab with a bull’s-eye, which is the Inspector tab that is used for directly editing directory data (and requires more than a basic understanding of the Open Directory schema to edit successfully).
To create or edit a user account, select the users tab. All user accounts created in the domain will be listed. Above the list are tabs for sorting based on full name or UID (you can sort ascending or descending by clicking the same tab more than once). If you select an existing user, that user’s account information is displayed in the account information pane to the right of the account list. You can edit each of the account information tabs and click the Save button to save changes. To create a new user account, click the New User button in the toolbar at the top of the window. This creates a blank user with a name such as Untitled_1. Edit the information in the various tabs and then click the Save button to create the new user account. Each tab for a user account contains specific options you can configure that account.
The Basic tab contains fields for the following pieces of information:
- Name: This is the field for entering the user’s full name attribute. The user can log in with this name, but its typical use is the name displayed in the user accounts list.
- User ID: This is the UID of the account. By default, Mac OS X Server begins numbering user accounts with 1025. UIDs below 100 are reserved for Mac OS X and server process accounts. UIDs in the 500 range are typically reserved for local accounts. A best practice, if you assign UIDs yourself, is to use numbers higher than 1025 (you can use numbers up to 2,147,483,648). You can use UIDs to define groups of users. For example, in a high school you might create faculty and staff users with UIDs in the 1000 range, students in the class of 2005 in the 2000 range, students in the class of 2006 in the 3000 range, and so on. This practice, which was common before Apple included the ability to add comments and keywords to users in the Advanced tab for user accounts. Today, using keywords can be much simpler and more effective.
- Short Names: You can enter as many shortnames as in this field as you like. Remember the first shortname cannot be changed once you hit Save for the first time, and it will be the one used by all Mac OS X processes. If you enter multiple shortnames, begin each one on a new line.
- Password and Verify: These are used to enter and then verify the password you are setting for the user. Note: if you click the Save button and then change the password type on the Advanced pane, you might be asked to re-enter the password.
- User Can: These checkboxes define administrative access levels for the user. Administer This Server gives the user administrative access to the server (but not the domain). Administer This Directory Domain gives the user admin privileges to the domain (you can use the privileges button to define what level of control the user has over the domain). Log In Or Access (depending on the version of Mac OS X Server) simply allows the user the ability to log in on a workstation and connect to resources within the domain.
The Advanced tab includes a checkbox to allow simultaneous login of the user from multiple workstations, a pop-up menu to specify the Unix shell they should use for terminal connections, and the password type (as describer earlier). You also have the option of entering comment information about the user (comments are limited to 32,676 characters and can be useful for identifying a user’s job function, location, and other information) and assigning keywords to the user.
The Keywords option has buttons to add and delete keywords to the user and a button for editing the keywords list for the domain. Keywords are searchable and can be used to identify users by job function, location, projects, status, or other relevant information. In a school, you could use this field to identify a student’s year of graduation or grade level, for example. In a company, you might use it to identify temporary workers or employee departments. You can use this information for administrative reference and for sorting users into group.
When Open Directory is selected as the password type, you can use the options button to impose password policies (which override any global policies that have been set for the domain using Server Admin’s Open Directory module) on the user, including allowing the user to log in, disabling login (by date, inactivity, or after a number of failed attempts at entering the correct password), specifying a minimum number of characters in the password, and allowing the user to change the password, and requiring the password be changed at either the next login or after a specified interval. If you allow or require users to change their passwords, they do so by launching System Preferences on whatever workstation they are logged into and selecting the Accounts pane.
The Groups tab allows you to view which groups a user belongs to and to add the user to groups. It also displays the GID and name of the user’s primary group. By default, a user’s primary group is set to staff (which contains all user accounts created in the domain or). Setting a primary group is not required, but it can speed up user access to shared files in heavily populated directory domains because the primary group ID number is automatically checked when a user attempts to access a file or folder of which he/she is not the owner, thus saving the step in which the file system consults Open Directory to see whether the user is a member of the group assigned to the file or folder.
The Home tab controls information about the user’s home directory. Home directories require some effort to configure properly. I will be discussing them in an upcoming companion piece to this article.
The Mail tab allows you to configure options for the Mac OS X Server email service. The Print tab allows you to configure printer access and print quotas for the user. Fianlly, the Windows tab allows you to configure the location of the user’s Windows profile, login script, and Windows home directory.
As a rule, you should never have to change a user’s shortname. If you have a good standard naming scheme in place and you don’t make any typos when you create user accounts, the first shortname you create for a user should be fine. So, unless a user’s actual name changes, you shouldn’t need to worry about changing a shortname. Of course, we don’t live in a perfect world, and things like typos, weddings, or office politics might require you to adjust the shortname assigned to one or more users.
If you need to make changes, Apple’s solution is to simply give you the ability to assign additional shortnames to a user and to allow you to edit the user’s full name. In some situations, this might be enough to satisfy your users. After all, they can log in with the adjusted name, and any user lists you pull out of Workgroup Manager will have the appropriate full name. If possible, my advice is to go with Apple’s solution. If, however, you are in a situation where you absolutely must change a user’s shortname, here is the best way to do it.
Delete the user’s account, noting the UID of the account. Copy all information out of the home directory (do this as root, either using the terminal or the Mac’s graphical environment) and then delete the home directory. Create the new user account and assign the original UID to the account. Create a new home directory along with the account and place the original files in it. Log in in as the user to be sure the account has access to the appropriate files (you might need to adjust permissions on the files appropriately). If you are using the Mac OS X Server email service, you might need to have the user make local copies of all emails before doing this.
You can use the Groups tab in the Accounts list pane to create and edit groups in much the same way that you create and edit user accounts. When you create groups, you have the options for specifying a group name, shortname, and GID number, as well as the ability to designate the users that will be members of the group and to create a shared group folder. In Mac OS X Server 10.4, you also have the ability to place groups within other groups, thus granting members of the nested group membership in the parent group.
You can also assign managed preferences settings to individual users or groups by selecting the user or group account in the accounts list and clicking on the Preferences button in the toolbar. This will list the available preferences settings in the right-hand pane of the Workgroup Manager window. Managed preferences allow you to tailor and restrict much of the Mac OS X user environment and they can also be enforced on lists of Mac OS X workstations.
For more information on the Macintosh, visit our Macintosh Reference Guide or sign up for our Macintosh Newsletter.