Script guidance

Hi May - hope this helps. -t-

#!/bin/sh
userid=`id -u`
if [ $userid -lt 1024 ]; then
    echo "Non AD user - stopping script"
    exit 1
fi   #fi ends, not elif to end

#install cert from tmp
security add-trusted-cert -d -r trustAsRoot -k "/Users/$username/Library/Keychains/login.keychain" "/private/var/tmp/ourserver.ourdomain.com.cer"

certExists=`security find-cert -c ourserver.ourdomain.com`
if [ -z $certExists ]; then   #-z means if variable is empty
    echo "Cert not installed"
else
    echo "Cert is installed"
fi

Try taking out the double quotes around $username in the first if statement.

Edit: And yeah, you need the UID, not the username (as mentioned below this).

You are trying to compare a string to an integer. You need to add another step where you take the logged in user and get the their uid.

userID=$(id $username | awk '{print $1}' | sed 's/[^0-9]//g')

Then do your TEST on that.

EDIT: Or you could just do id -u :)

As already mentioned, you have to get the user ID or UID of the account, not the name.
However, its been pointed out on other threads that technically that info can be spoofed under a local account fairly easily, so its not a 100% guarantee that its catching all local accounts. It should be safe, but I personally look for the OriginalAuthenticationAuthority key in the dscl record of the account, since only AD cached local accounts seem to contain that, and its far less likely to be spoofed over the UID.

#!/bin/sh

username=$(stat -f%Su /dev/console)

if [[ $(dscl . read /Users/$username OriginalAuthenticationAuthority 2>/dev/null) == "" ]]; then
    echo "Non AD user - stopping script"
    exit
else
    <rest of script>.....

You can take out the "S" from the stat format string
Then you get the numeric value of the user (not the String)

consoleUserID=$(stat -f %u /dev/console)
if [ "$consoleUserID" -lt 1024 ]; then
...

BTW @yr_joelbruner has been retired - long live @brunerd :]

Thank you all for the input

This one now works

#!/bin/sh

username=$(stat -f%Su /dev/console)

if [[ $(dscl . read /Users/$username OriginalAuthenticationAuthority 2>/dev/null) == "" ]]; then
    echo "Non AD user - stopping script"
    exit

else

security add-trusted-cert -d -r trustAsRoot -k "/Users/$username/Library/Keychains/login.keychain" "/private/var/tmp/ourserver.ourdomain.com.cer"

#Check cert is installed

cert_name="ourserver.ourdomain.com"
desired_keychain="/Users/$username/Library/Keychains/login.keychain"

if [[ `security find-certificate -c "$cert_name" $desired_keychain 2>/dev/null` ]]; then

echo "installed $cert_name to $username keychain"


else

    echo "certificate not installed"

    exit 1
fi

fi

Vive @brunerd