Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I need to assign a secondary group membership to a user on a client machine running 10.7.4. In CLI

edit3:~ admin$ sudo su -
edit3:etc root# dseditgroup -o edit -a userA -t user QC
edit3:etc root# dseditgroup -o edit -a userB -t user QC
edit3:etc root# dsmemberutil checkmembership -U userA -G QC
user is a member of the group
edit3:etc root# dsmemberutil checkmembership -U userB -G QC
user is a member of the group

When userA or userB logs in to my Isilon cluster, he is denied access (does not have QC privileges)

So I try this:

edit3:~ root# cd /etc/
edit3:etc root# dscl . append /Groups/QC GroupMembership userA
edit3:etc root# dscl . append /Groups/QC GroupMembership userB

edit3:etc root# dsmemberutil checkmembership -U userA -G QC
user is a member of the group
edit3:etc root# dsmemberutil checkmembership -U userB -G QC
user is a member of the group

Again, users denied access.

Getting more details:

edit3:~ root# dscacheutil -q group | grep QC -B 10 -A 10

name: groupX
password: 
gid: 1009

name: QC
password: 
gid: 1021
users: scook dfarley 

name: groupZ
password: 
gid: 1012

Funny that QC group lists members with secondary membership but no primaries listed in any group (except system groups)

Again digging for more info:

edit3:~ root# dscl . readall /users | grep Secondary -B 10 -A 10
edit3:~ root#

Questions: Why is the system not presenting a secondary group membership correctly, since we verified that userA and userB do in fact belong to QC group? Can I list secondary membership along with primary membership?

Doing the exact same steps on another client running same version of OS works. I've done the reboots, following changes. I then reinstalled clean OS , and repeated the entire cycle, twice. Still no joy.

Anybody?

share|improve this question
add comment

2 Answers 2

Superfical answer but perhaps it may help:

groups username 

tells me that this command is deprecated, and I should be using

id -Gn 

or

id -p

I then get the list of groups that i belong to in its entirety.

man id 

dsmemberutil seems more like a way to query the data store, which I was actually looking for,so I hope this helps you. Thanks.
share|improve this answer
    
id just confirms that the userA and userB do in fact belong to the QC group. It's how the OSX presents the secondary group membership to the cluster that seems to be the issue –  Tom S Nov 9 '12 at 17:22
add comment
up vote 0 down vote accepted

After examining the pcaps from my session with Wireshark, I discovered that under OSX 10.6.8 the Auxiliary GIDs list my QC group (#1021) (one that was added manually) in the handshake, whereas under OSX 10.7.4 the Auxiliary GIDs do not include that info.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.