Sperate login scripts based on AD user type.

[Sean_M_Harper]

In short (yes, I mean that...):

I have a Fortigate web filter, and my networking team requires me to mount a share called "macfix" on each apple OS X machine. However, there is a student and staff one, allowing for student or staff clearance through the web filter.

I just re-imaged an entire LMC and need to find a way to mount these shares based on user. I can not simply blanket scope them all to mount the staff share (or the student one), because then if the other user type sits down and logs in they are filtered at the incorrect level.

The old way: The last Admin created a student and a staff login script that he turned into executables via Automator. These two "applications" would run simultaneously at login using a variable $user set by the "whoami" unix command. Which ever login script did not fail (based on that users actual AD access level) would mount the proper share (and yes, some teachers mount both) as a no browse invisible share allowing them access.

I want to use a config profile to mount this share at login based on user, but I can not run both at once like was done in the past for two main reasons:
1. Its horrible, never works right, and automator processes seem to fail more often than they work.
2. If you run two profiles containing the same type of payload on one machine, the MOST restrictive one takes hold. Running two separate profiles was my first try, but that would default to whichever was more restrictive.

I am open to all ideas anyone may have. For a look at my original login script, just see my prior postings.

Thank you everyone in advance.

[nicktong]

Cool. How about using dsmemberutil checkmembership in the context of a loginhook:

#!/bin/bash

user=$(ls -ltr /dev/console | awk '{print $3}')

statusStudent=$(dsmemberutil checkmembership -U $user -G student | awk '{print $4}')
statusFaculty=$(dsmemberutil checkmembership -U $user -G faculty | awk '{print $4}')

if [[ $statusStudent == "member" && $statusFaculty == "member" ]]; then
    mount -o nobrowse -t smbfs //$user@cra-it-01/macfix$ /Volumes/facultyInternet
elif [[ $statusStudent == "member" ]]; then
    mount -o nobrowse -t smbfs //$user@cra-it-01/macfix$ /Volumes/studentInternet
elif [[ $statusFaculty == "member" ]]; then
    mount -o nobrowse -t smbfs //$user@cra-it-01/macfix$ /Volumes/facultyInternet
else
    echo "$user" 'is neither faculty nor student.'
fi