Specifications

116 Chapter 8 Managing User and Group Accounts
To create a nested group:
$ dseditgroup -o edit [-a childgroup ] [-t group] [-u username ] [-P password ]
[-n /LDAPv3/
ipaddress ] parentgroup
To verify a nested group:
1 Start the dscl tool in interactive mode, specifying the computer you are using as the
source of directory service data:
$ dscl localhost
>
2 Change the current folder to /LDAPv3/ipaddress/Groups by entering the path at the
prompt:
> cd /LDAPv3/ ipaddress /Groups
Replace ipaddress with the IP address of your directory server.
3 Authenticate as an administrator by entering the following command, replacing
adminusername with your administrator user name, and entering your administrator
password when prompted:
> auth adminusername
4 View the members of the group by entering the following (replacing parentgroup with
the group account’s short name):
> read parentgroup
dscl displays the settings for the group account, similar to the following output where
the group named parentgroup is shown as nested:
dsAttrTypeNative:apple-generateduid:4B3A5678-E9C1-2EC3-4567-891D234E5678
dsAttrTypeNative:apple-group-nestedgroup:1A2B3456-C7D8-9EF1-2345-
678G912H3456
dsAttrTypeNative:cn: parentgroup
dsAttrTypeNative:gidNumber: 700
dsAttrTypeNative:objectClass: posixGroup apple-group extensibleObject top
AppleMetaNodeLocation: /LDAPv3/ipaddress
GeneratedUID:4B3A5678-E9C1-2EC3-4567-891D234E5678
NestedGroups:1A2B3456-C7D8-9EF1-2345-678G912H3456
PasswordPlus:********
PrimaryGroupID: 700
RecordName: parentgroup
RecordType: dsRecTypeStandard:Groups
Parameter Description
childgroup The name of the child group you are adding to the parent group
username The short name of a user with LDAP directory service access
password The user password
ipaddress The IP address of your directory server
parentgroup The name of the parent group that the child group is being added to