---

Managing Users and Groups

In the default configuration of Mac OS X, users and groups are not stored in a password file on disk. Thus, you cannot modify the password file directly.

Mac OS X supports a number of data stores for user and group information, including LDAP and flat files. Depending on the configuration, users could potentially be stored locally or remotely and accessed through any of these methods. Thus, to add users and groups through shell scripts in a general way, you must use the Directory Service command-line utility, dscl (or the Directory Service API upon which that utility is based).

Because the dscl tool is specific to Mac OS X, if you are writing scripts for cross-platform deployment, you should test for its existence and fall back to traditional password file modification if it is not there. To learn how to do this, read “The if Statement.”

For sample code that shows how to add a new user from the command line, read the Additional Features chapter of Porting UNIX/Linux Applications to Mac OS X.

To learn more about Directory Service records at a high level, read Open Directory Programming Guide. To learn how to use the Directory Service command line utility to alter those records, read the manual page for dscl.

---