In the past I came up with a little EA that would look into AD and see all of the SG's that a user was a part of. I could then scope access to that based on the result. This worked great, but now that we are migrating away from bound mobile accounts and into standard local accounts, I see that accessing AD is not working.
Does anyone know if there is a way to still poll AD to see what groups a user might be apart of if they are on the network and on a local account? I've tried "ID" and "DSCL", but it says that the data source is no longer valid.
Here is the script I used to use. It pretty much lists all SG's a user is a member of and then I GREP out the one that I am looking for.
#!/bin/bash
# Let's set some variables
CURRENTUSER=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }')
SG=$(comm -23 <(id -Gn $CURRENTUSER | sed 's/ /
/g' | sort) <(dscl . search /Groups GroupMembership USERNAME | grep = | awk '{print $1}' | sort))
COMPARE="SG_ACCOUNT"
if echo "$SG" | grep -q "$COMPARE"; then
echo "<result>Yes</result>"
else
echo "<result>No</result>"
fi
