How can I programmatically obtain (Objective-C or Swift) the list of groups a user is member of, for all the users on the Mac?

Question

I found this lovely code in this question that helps me get the list of users.

#import <OpenDirectory/OpenDirectory.h>
ODSession *s = [ODSession defaultSession];
ODNode *root = [ODNode nodeWithSession:s name:@"/Local/Default" error:nil];
ODQuery *q = [ODQuery queryWithNode:root forRecordTypes:kODRecordTypeUsers attribute:nil matchType:0 queryValues:nil returnAttributes:nil maximumResults:0 error:nil];

NSArray *results = [q resultsAllowingPartial:NO error:nil];
for (ODRecord *r in results) {
    NSLog(@"%@", [r recordName]);
}

Now in Terminal/Shell, I could simply:

id -G <username or userID>

to immediately get the list of groups that user is member of, e.g.

>id -G 501 
20 12 61 79 80 81 98 702 701 33 100 204 250 395 398 399 400

However, is looks silly to go on and spawn an NSTask running "id", then collect the output and parse, just because I don't know how to use the OpenDirectory APIs...

So I dug a little deeper, and saw I could specify one or more "attributes" in the returnAttributes: parameter of the ODQuery... and then I went through the long list of attributes and found only one that made sense in CFOpenDirectoryConstants.h:

/*!
    @const      kODAttributeTypeGroup
    @abstract   List of groups.
    @discussion List of groups.
*/
CF_EXPORT
const ODAttributeType kODAttributeTypeGroup;

However, when I add it to the "standard" or "nativeOnly" or "All" sets of returnedAttributes, or even specify it alone - the result ODRecords I receive do NOT contain that attribute.

I try to obtain it using [r valueForAttribute: kODAttributeTypeGroup]; and also when I print [r description] where I can see all the attributes returned - alas it's not there.

I tried other attributes too, which were "close to the subject" like

kODAttributeTypeGroupMembers, kODAttributeTypeGroupMembers, kODAttributeTypeNetGroups, kODAttributeTypeGroupMembership and others - but both they are more expected on "Group" records of OpenDirectory, and anyway they're not returned.

So my question: how do I persuade OD to retrieve the groups for each of the users? Any hint (or reference to helpful documentation) will be greatly appreciated. Thanks!

Answer 1

If you change your loop as follows

        for (ODRecord *r in results) {
            NSLog(@"%@", [r recordName]);
            
            // Query groups
            ODQuery * gq = [ODQuery queryWithNode:root
                           forRecordTypes:kODRecordTypeGroups
                            attribute:kODAttributeTypeGroupMembership
                            matchType:kODMatchContains
                          queryValues:r.recordName
                         returnAttributes:nil
                           maximumResults:0
                            error:NULL];
            NSArray * gr = [gq resultsAllowingPartial:NO
                                error:NULL];
            
            for ( ODRecord * g in gr ) {
                
                NSLog(@"\t%@",g.recordName);
                
            }
        }

Update

If you want something similar to id you need to query each group individually. Here is an example, just forced into your structure.

        for (ODRecord *r in results) {
            NSLog(@"%@", [r recordName]);
            
            // Query groups
            ODQuery * gq = [ODQuery queryWithNode:root
                           forRecordTypes:kODRecordTypeGroups
                            attribute:nil
                            matchType:0
                          queryValues:nil
                         returnAttributes:nil
                           maximumResults:0
                            error:NULL];
            NSArray * gr = [gq resultsAllowingPartial:NO
                                error:NULL];
            
            for ( ODRecord * g in gr ) {
                
                if ( [g isMemberRecord:r
                         error:NULL] ) {

                    NSLog(@"\t%@",g.recordName);

                }
            }
        }

This illustrates how to do it. What is wrong with it is that the groups are retrieved every time. You could e.g. easily cache that.

It is important to take note of both queries. In the first I query for group membership and in the second I query for groups and use each group to test for membership. It seems the first is more direct and the second stronger in the sense that it is more complete / accurate. I think this is more accurate because of nesting in groups.

Answer 2

Although I fully accept skaak's answer, I thought I'd provide both a refined version of his code that's a little cleaner and avoids re-fetching all the groups for every user, AND I'll provide another version the answers a more specific variant of my question (the one I need for my implementation) in the hope this code snippet will help someone.

First, a working version of skaaks answer:

-(BOOL)groupsOfAllUsers {
    NSError *error = nil;
    ODSession *s = [ODSession defaultSession];
    ODNode *root = [ODNode nodeWithSession:s name:@"/Local/Default" error:nil];
    ODQuery *q = nil;

    // fetch all user records.
    NSArray *attributesToFetch = @[kODAttributeTypeUniqueID, kODAttributeTypeRecordName];
    q = [ODQuery queryWithNode:root forRecordTypes:kODRecordTypeUsers attribute:kODAttributeTypeRecordName matchType:0 queryValues:nil returnAttributes:attributesToFetch maximumResults:0 error:&error];   //kODAttributeTypeStandardOnly
    if (error!= nil)
        return NO;
    
    NSArray *userRecords = [q resultsAllowingPartial:NO error:&error];
    if (userRecords==nil || error!= nil)
        return NO;
    
    // fetch all groups
    attributesToFetch = @[kODAttributeTypeUniqueID, kODAttributeTypePrimaryGroupID];
    q = [ODQuery queryWithNode:root forRecordTypes:kODRecordTypeGroups
                     attribute:nil matchType:nil queryValues:nil
              returnAttributes:attributesToFetch maximumResults:0 error:&error];
    if (q == nil || error!= nil)
        return NO;

    NSArray *groupRecords = [q resultsAllowingPartial:NO error:&error];
    if (groupRecords == nil || error!= nil)
        return NO;
    
    NSMutableDictionary *userGroupIDs = [[NSMutableDictionary alloc] initWithCapacity:userRecords.count];
    NSMutableDictionary *userGroupNames = [[NSMutableDictionary alloc] initWithCapacity:userRecords.count];
    
    for (ODRecord *userRecord in userRecords) {
        NSMutableSet *gids = [[NSMutableSet alloc] initWithCapacity:groupRecords.count];
        NSMutableSet *groupNames = [[NSMutableSet alloc] initWithCapacity:groupRecords.count];
        for (ODRecord *groupRecord in groupRecords) {
            BOOL isMember = [groupRecord isMemberRecord:userRecord error:&error];
            if (error != nil)
                return NO;
            if (isMember) {
                [groupNames addObject:[groupRecord recordName]];
                id gid = [[groupRecord valuesForAttribute:kODAttributeTypePrimaryGroupID error:&error] firstObject];
                if (nil == gid || error!= nil)
                    return NO;
                [gids addObject:@([gid intValue])];
            }
        }
        id uid = [[userRecord valuesForAttribute:kODAttributeTypeUniqueID error:&error] firstObject];
        if (nil == uid || error!= nil)
            return NO;
        [userGroupIDs setObject:[gids copy] forKey:@([uid intValue])];
        [userGroupNames setObject:[groupNames copy] forKey:[userRecord recordName]];
    }
    return YES;
}

But, as pointed out in skaaks answer (and my many comments) the isMemberRecord: method takes into account recursive groups (groups containing groups) and also non-primary group memberships, and it didn't fit my needs. What I wanted is to find which users participate in a predefined set of groups (say {"staff","admin"} which, for example, excludes "root" user (uid 0) whose primary group is 'root', although it also is member of 'staff'. So - my other variation (receives a set of group names) looks like this, and runs much faster:

-(BOOL)usersInGroupNames:(NSArray *)inGroupNames { // e.g.  @[@"staff", @"admin"]
    
    // stuff needed for all our OD work...
    NSError *error = nil;
    ODSession *s = [ODSession defaultSession];
    ODNode *root = [ODNode nodeWithSession:s name:@"/Local/Default" error:nil];
    ODQuery *q = nil; NSArray *results = nil;
    
    // First fetch desired groups, their names and group-ids
    NSArray *attributesToFetch = @[kODAttributeTypePrimaryGroupID, kODAttributeTypeRecordName];
    q = [ODQuery queryWithNode:root forRecordTypes:kODRecordTypeGroups
                     attribute:kODAttributeTypeRecordName matchType:kODMatchEqualTo queryValues: inGroupNames
              returnAttributes:attributesToFetch maximumResults:0 error:&error];
    if (q == nil || error!= nil)
        return NO;
    
    if (nil == (results = [q resultsAllowingPartial:NO error:&error]) || error!= nil)
        return NO;

    NSArray *groupIDs = [results valueForKeyPath: [NSString stringWithFormat:@"@unionOfArrays.%@", kODAttributeTypePrimaryGroupID]];
    
    // now fetch users whose primary group IDs are in the list
    attributesToFetch = @[kODAttributeTypeUniqueID, kODAttributeTypeRecordName, kODAttributeTypePrimaryGroupID];
    q = [ODQuery queryWithNode:root forRecordTypes:kODRecordTypeUsers
                     attribute:kODAttributeTypePrimaryGroupID matchType:kODMatchEqualTo queryValues:groupIDs
              returnAttributes:attributesToFetch maximumResults:0 error:&error];
    if (q == nil || error!= nil)
        return NO;
    
    if (nil == (results = [q resultsAllowingPartial:NO error:&error]) || error!= nil)
        return NO;
    
    NSArray *userIDs = [results valueForKeyPath: [NSString stringWithFormat:@"@unionOfArrays.%@.intValue", kODAttributeTypeUniqueID]];
    NSLog (@"userIDs:%@", userIDs);
    return YES;
}

hope this helps anyone...