dsidentity(1)

NAME
dsidentity - Add or remove identity user accounts.

SYNOPSIS
dsidentity [-vix] -a identity [-s password] [-d displayname] [-j picture] [-c comment] [-u username] [-p password]

dsidentity [-vix] -r identity [-u username] [-p password]

options:
-v  verbose logging to stdout
-i  prompt for password as required
-x  use only authorization right for authentication
-h  display usage statement

parameters:
-a identity
    add identity username
-r identity
    remove identity username
-s password
    identity user's password
-d displayname
    display name
-j picture
    user picture
-c comment
    comment
-u username
    admin username
-p password
    admin password

DESCRIPTION
dsidentity is a setuid tool that allows addition or removal of identity user accounts in Directory Services. The dsidentity tool creates a partial but valid system identity in the local Directory System. This identity is created with the intent to support remote sharing capabilities. Version 1.00 supports local shadowhash passwords as regular local user records. Kerberos support is planned to be added in a later version. By default the identity created will contain a new and unique UID and assigned Globally Unique ID (GUID). The identity created will have no privileges on the local system and will not be recognized by login window, ssh, or other unix programs. This identity will have no assigned home directory and shell will be set to /usr/bin/false to prevent remote logins. It is expected that after running dsidentity additional administration will be required to add the newly created identity to appropriate application access control lists in order to actually grant access to a system service. How this newly created identity is added to application access control lists may be application specific and therefore dsidentity does not perform this function. The authorization to use this tool will be obtained from either the authorization right "com.apple.allowidentityedit", the effective uid of the user running the tool, or the provided admin name and password. Only the authorization right will be used if the option "x" is provided. The password will be prompted for if either the admin username is provided with no password, no auth right is set and the euid is not zero, or the option "i" is specified. When adding a identity user, default values for displayname, picture, and comment will be provided as detailed below. Presented below is a discussion of possible parameters. Usage has three intents: add identity, remove identity, or display help.

Options list and their descriptions:

-v  This enables the logging to stdout of the details of the operations. This can be redirected to a file.

-i  You will be prompted for a password to use in conjunction with the specified identity and admin usernames.

-x  This enforces using only the authorization right "com.apple.allowidentityedit" for authentication.

-h  Display usage statement.

Parameters list and their descriptions:

-a identity
    This is the defined recordname of the identity user that is to be added to the local Directory system.

-r identity
    This is the defined recordname of the identity user that is to be removed from the local Directory system.

-s password
    Password for the identity user record. Default value is empty string.

-d displayname
    Display (full) name of the identity user record. Default value is the identity value.

-j picture
    Picture used to represent the identity user record. Default value is "/Library/User Pictures/Animals/Dragonfly.tif".

-c comment
    Comment on the identity user usually given by the creator of the record. Default value is "Identity User".

-u username
    Username of a local administrator.

-p password
    Password for the local administrator. If this is not specified, you will be prompted for a password if required.

EXAMPLES

-add a identity user account
    dsidentity -v -a buddy The identity user account "buddy" will be added. The following parameters displayname, picture, and comment will be set to their default values.

-remove a identity user account
    dsidentity -v -r buddy -u admin The identity user account "buddy" will be removed given the correct authentication is supplied either through the auth rights, the euid of the user running the tool is zero, or the password provided interactively was correct and the user is indeed an admin user.