ID command

Question

Level 1

5 points

ID command

Not sure if anyone here will be able to help me with this. Trying to write a script which needs to lookup your group memberships at login.

I am using the id command in terminal (id -Gn) to show which groups I am a member of on the active directory my mac is connected to. The id command doesn't display all the groups I am a member of, it just cuts off after 3.5 lines. Anyone have any ideas? gpresult in windows shows everything and I have tested with other users here and they all get cut off at the same point.

Thanks for your time.

PowerBook G4, Mac OS X (10.4.2)

Posted on Apr 24, 2006 9:58 AM

Reply

Answer 1

Apr 24, 2006 11:50 AM in response to John Locke

John

it just cuts off after 3.5 lines

It is unusual to be a member of so many groups!

But, try this:

nireport . /groups name users | grep `id -un` | awk '{print $1}'

The interesting thing (for me) is that this shows I am a member of a group that doesn't show up with the plain id command, so maybe there's a bug here.

Reply

Answer 2

John Locke Author

Level 1

5 points

Apr 24, 2006 12:46 PM in response to Michael Conniff

Thanks for the suggestion. I tried that command and it just shows the local groups on this mac and doesn't appear to query the active directory the way the ID command does.

The employees here are a member of a number of groups, the ones with a lot of groups seem to be the issue. I agree, this many groups is unusual, and difficult to work with!

Thanks again,
John

Reply

Answer 3

Apr 24, 2006 3:47 PM in response to John Locke

How many groups is it showing? 16 used the be the max number of groups for a number of different unix system. I know of a few that now go to 32. Some systems may allow more. check sysctl.

sysctl -a -- | grep -i group
kern.ngroups = 16

Reply

Answer 4

Apr 25, 2006 2:52 AM in response to John Locke

John

it just shows the local groups on this mac

Ah, yes it would do that because of the '.'. You need to put in a 'domain' which includes your active directory stuff. Since I don't use AD, I'm not entirely sure how to do that.

Do all your groups show up in the NetInfo Manager application? If so that might give you a clue how to specify a broader domain, or I'm sure others here will leap in!

Reply

Answer 5

Apr 25, 2006 6:07 AM in response to Michael Conniff

AD groups are not stored in NetInfo. Depending on the version of OS they are either cached in a flat file, or an LDAP query is performed on the AD tree as needed. When I run id, I see all of my groups, so this could be an AD problem in how it is replying to LDAP queries.

Reply

Answer 6

Apr 25, 2006 8:06 AM in response to John Locke

You can query the Active Directory using the "dscl" command.

sudo dscl "/Active Directory/your.ad.domain" -read /Users/yourUserID

will give you a dump of the AD record for "yourUserID".

sudo dscl "/Active Directory/your.ad.domain" -read /Users/yourUserID memberOf

will list just the groups the user is a member of (although they're not listed in the same "domain\group" format that the id command gives you).

See "man dscl" for more details.

Steve

Reply

Answer 7

John Locke Author

Level 1

5 points

May 5, 2006 11:01 AM in response to Steve Herman1

Sweet! Thanks Steve, that worked!

sudo dscl "/Active Directory/your.ad.domain" -read /Users/yourUserID memberOf

That one did the trick!

Reply