Dockutil script

[Araneta]

Hi All,

I need help everyone, I'm trying to use this script(adaptation from @bentoms scripts w/ dockutil) to map my Network share but I'm getting a dscl not found on the ADGroups variable. Thanks in advance.

#!bin/bash
loggedInUser="$3"
accounType="dscl -u /Active Directory/Domainname/All Domains -read /Users/$loggedInUser | grep UniqueID | cut -c 11-"
ADGroups="dscl -u /Active Director/Domainname/All Domains -read /Users/$loggedInUser | awk '/^dsAttrTypeNative:memberOf:/'"

if [$ADGroups = groupname]; then /usr/local/bin/dockutil --add cifs://FQDN/path/to/share
else exit 1
fi

[mm2270]

All your variables need to have either tick marks surrounding them, or enclose them with $(command) The way you have them set up now the script thinks they are strings, not commands to run.
So, either:

accounType=`dscl…….`

or

accounType=$(dscl……..)

In addition, assuming the script above was copied/pasted, there's a misspelling in the "ADGroups" variable. You have Active Director, not Active Directory.
And your if/then statement needs to be changed to look like this-

if [ "$ADGroups" == "groupname" ]; then

IOW, two equal signs, if you want to compare strings and find a match, space between the brackets and the strings and I would quote them since there's no certainty the variables won't contain non escaped spaces.
On the other hand, if you wanted to do a "like" comparison, use =~ instead of ==

Lastly, the awk at the end of the ADGroups variable isn't making sense to me. Seems to be missing a {print $<number>}' at the end, or something. It can't just end with /^dsAttrTypeNative:memberOf:/

Hope that helps.

[Araneta]

Thanks @mm2270! I edited my script as you suggested and I'm having a script exit code : 0.
But it is not applying the dock item. Any ideas?

#!bin/bash
loggedInUser="$3"
accounType=$(dscl /Active Directory/Domain/All Domains -read /Users/$loggedInUser | grep UniqueID | cut -c 11-)
ADGroups=$(dscl /Active Directory/Domain/All Domains -read /Users/$loggedInUser dsAttrTypeNative:memberOf)

if [ "$ADGroups" == "Helpdesk Support" ]; then /usr/local/bin/dockutil --add cifs://fqdn/path/to/share
fi

[mm2270]

Just curious, but what version of dockutil are you applying this against? What OS version(s) is it being deployed to? I ask because with 10.8 and up, dockutil 1.1.4 should be pretty reliable. The previous 1.1.2 version had some difficulty getting around the more aggressive preference caching that Mountain Lion brought and then Mavericks raised the bar on. I never personally saw issues when using 1.1.2 and Mountain Lion, but as soon as we moved to Mavericks, that version no longer worked, at least not immediately.
In your case, if you restart the Dock a few times, or if you log out and then back in, does the icon appear?

[krichterjr]

Looks like you have ```

!bin/bash

I believe you need to have ```
#!/bin/bash

[mm2270]

Good catch Kenny. it does need to be #!/bin/bash. If the script pasted above was the actual script, I'm not clear how it could have even run at all, or exited with a 0 exit status.

[Araneta]

oh missed that!(#!/bin/bash) Thanks @krichterjr and @mm2270. I'm running this on Maverick and dockutil version 1.1.4. I log out and log back in to test the script, tried including killall cfprefsd;killall dock under processes still nothing showing up on the dock. :(
There must be something wrong with the if statement not returning the value expected.

[mm2270]

@Araneta, change the "==" in the if/then to "=~"
I suspect that the dsAttrTypeNative:memberOf is returning lots of group memberships and by doing == the script is expecting an exact match. Using =~ will do a partial match, meaning if the "Helpdesk Support" group is anywhere in the results, it will pass the test and move on to the rest of your script.

[Araneta]

@mm2270, changed it to =~ and still nothing. :(

[sean]

You should change:

if [ "$ADGroups" =~ "Helpdesk Support" ]; then

to

if [[ "$ADGroups" =~ "Helpdesk Support" ]]; then

Notice the double square brackets. The following may help: http://mywiki.wooledge.org/BashFAQ/031

Also, you are unnecessarily using grep. Like the membership, you can get the UniqueID directly. Consider changing:

accounType=$(dscl /Active Directory/Domain/All Domains -read /Users/$loggedInUser | grep UniqueID | cut -c 11-)

to

accounType=$(dscl /Active Directory/Domain/All Domains read /Users/$loggedInUser UniqueID  | awk '{print $NF}'

and at the same time, you can use cut that way, but you are trying to match exact points based on character position. Id suggest you'd be better off either using awk as above and printing the last field or using cut with a delimiter and specifying the field you want:

accounType=$(dscl /Active Directory/Domain/All Domains read /Users/$loggedInUser UniqueID  |  cut -d " " -f 2)

[mm2270]

Spot on @sean! I'll admit that I use double brackets in my tests in bash scripts so habitually (even when its not necessary to) that I didn't even notice the script Araneta was using wasn't already set up that way. That was obviously the issue.

@Araneta, if you're not already doing this, I highly recommend getting a copy of the free TextWrangler from the Mac App Store for writing scripts with. In addition to color coding, basic syntax checking, and good search and replace tools, it also lets you run your scripts directly from the application to test them and get output back. If there are errors, it tells you what line of your script has the issue that needs to be corrected. Its what I use almost daily when writing scripts.

[Araneta]

Thank you guys for all the help! (@mm2270][/url][/url][/url][/url][/url @sean][/url][/url][/url][/url][/url @krichterjr][/url][/url][/url][/url][/url). Did all your suggestions and here is what I came up with. I removed accounType as it wasn't needed at all for this script. What I found out is the ADGroup process is not returning the result when being called in the if statement. I need to put two ( ( in the ADGroup variable to return the desired result.
Here's the resulting script for all those who want to use it:
(Adaptation of @bentoms][/url][/url][/url][/url][/url applescript)
#!/bin/bash

#Get the logged in user
user=$(ls -la /dev/console | cut -d " " -f 4)
#Get AD Group membership
ADGroups=$( (dscl /Active Directory/Domain/All Domains -read /Users/$user dsAttrTypeNative:memberOf) )

#Set AD security group
group="group name"
#Set FQDN server
server="fqdn.server"
#Set Share
share="Shares"

if [[ "$ADGroups" =~ "$group" ]]; then /usr/local/bin/dockutil --add cifs://$server/$share
fi

If you don't want to use dockutil here is another adaptation of @jarednichols][/url][/url][/url][/url][/url script:
#!/bin/bash

#Get the logged in user
user=$(ls -la /dev/console | cut -d " " -f 4)
#Get AD Group membership
ADGroups=$( (dscl /Active Directory/Domain/All Domains -read /Users/$user dsAttrTypeNative:memberOf) )

#Set AD security group
group="group name"
#Set FQDN server
server="fqdn.server"
#Set Share
share="Shares"
(From @jarednichols][/url][/url][/url][/url][/url)
#Set this temp string because 'defaults' is literal and won't resolve variables
tmpStr='<dict><key>tile-data</key><dict><key>file-data</key><dict><key>_CFURLString</key><string>/Volumes/'$share'</string><key>_CFURLStringType</key><integer>0</integer></dict><key>showas</key><integer>2</integer></dict><key>tile-type</key><string>directory-tile</string></dict>'

if [[ "$ADGroups" =~ "$group" ]]; then #Mount Drive sudo -u $user jamf mount -server $server -share $user -type smb #Write the drive to the dock sudo -u $user defaults write /Users/$user/Library/Preferences/com.apple.dock persistent-others -array-add $tmpStr
fi
#Kill the Dock to apply changes
killall Dock

[dstranathan]

Interesting script idea.

1) I noticed that for each time the user clicks the docutil-generated icon/mount in the Dock, another instance of that same SMB mount shows up in the Finder and in /Volumes (use the "mount" command to see them) - at least this is my observation in OS X 10.10.1 Yosemite. Its feasible that a user could end up with 100 mounts if they were "trigger happy" and not savvy users.

2) Has anyone scaled this to allow for multiple group memberships that correspond wit multiple SMB shares?

Example: A user is in (2) groups/departments and both groups have their own departmental SMB shares that need to be mounted.