Big Sur: OD: More than 1 Primary Group being reported for a Mobile Login account.

Question

Created Mar ’21

Replies 2

Boosts 0

Participants 1

Hello,

I am running into a strange issue with the ODQueryCreateWithNode() call on an account that has Mobile Login switched on a Mac OS Big Sur system.

AFAIK, the issue does not occur on Mac OS Catalina or below.

Somehow, OD/DS are reporting more than 1 Primary Group for the account.

The setup is,

Mac OS Big Sur.
Machine bound to AD Server.
Mobile Login checkbox checked in Directory Services.

The tool queries via ODQueryCreateWithNode() call passing in the given uid_t and next on its results, it iterates and ask for items with Attribute kODAttributeTypePrimaryGroupID via the ODRecordCopyValues() call for each item.

Strangely, the result is more than 1 unique Primary Group being reported among the results of ODQueryCreateWithNode call.

The tool reports:
user belongs to primary Group: 20
user belongs to primary Group: 110233109

Also, the id command when run from Terminal on the same system reports,
>id -gn
staff

> id
uid=110233109 gid=20(staff) .....

The tool links OpenDirectory Framework and Directory Services Framework.
#import <OpenDirectory/OpenDirectory.h>
#import <DirectoryService/DirectoryService.h>

QUESTION
As per the internet, a user can belong to ONLY 1 primary group.

Even if this is theoretically possible, why is the code reporting the issue only on Big Sur ?

Also, if there are multiple values reported for Primary group, which is the value that should take effect ? Is it the first reported value in the Array of results ?

Regards,
Vikram.

Boost

Answer 1

Vikram_SW OP

Mar ’21

More Information:

I just now Observed the issue when the Primary group for the Mobile Login User on the AD Server is switched to a different Group on the AD Server.

I don't know why MacOS implements it this way, but there seem to be 2 instances of that user in 2 different NODES in DirectoryServices. These instances have the EXACT SAME UniqueID.

One of these NODES is the /Local/Default node, which I assume is for the scenario when the Mobile Login user is not connected.

The other NODE is the /ActiveDirectory/domain node, which might be referred to for the when-connected-to AD scenario.

After switching the Primary group on the AD Server for that user, only one of the above NODE is getting updated.

The above results in the account getting 2 Instances of Primary Group when the Tool is querying via the OpenDirectory/DirectoryServices Framework.

It is unclear to me if this behavior is a Big Sur issue OR occurs on earlier MacOSes OR is by Design this way.

0

Answer 2

Vikram_SW OP

Mar ’21

More Information.

We are seeing identical behavior on Catalina.

There are 2 Primary Groups being reported for Mobile Login users.

Can someone please Answer if this behavior is by Design ?

0