Mac OSX: Determing whether user account is an Active Directory user vs. local user using objective-c

active-directory, macos, objective-c

Solution

I was looking to how to detect if user has local account or ANY network directory account (ActiveDir or OpenDir). So what I have done using Open Directory framework is like this:

- get default ODSession session

- get local node – kODNodeTypeLocalNodes (I don't want to send queries to server all the time)

- query node for kODAttributeTypeNFSHomeDirectory with querying value set to current user's home directory

- if found then it means user is local if not (bacause we query local node ony) – user has network account

so something like this:

static BOOL  isLocalUser = NO;
static BOOL shouldKeepRunning = YES;        // global

-(BOOL)isLocalUser
{
    isLocalUser = NO;   // set default to NO here
    NSError* err;
    ODSession *mySession = [ODSession defaultSession];
    ODNode *myNode = [ODNode nodeWithSession:mySession type:kODNodeTypeLocalNodes error:&err];
    ODQuery *myQuery = [ODQuery  queryWithNode: myNode
                                forRecordTypes: kODRecordTypeUsers
                                     attribute: kODAttributeTypeNFSHomeDirectory
                                     matchType: kODMatchEqualTo
                                   queryValues: NSHomeDirectory()
                              returnAttributes: kODAttributeTypeStandardOnly
                                maximumResults: 0
                                         error: &err];

    [myQuery retain];
    [myQuery setDelegate: self];
    [myQuery scheduleInRunLoop: [NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode];

    NSRunLoop *theRunLoop = [NSRunLoop currentRunLoop];
    while (shouldKeepRunning && [theRunLoop runMode:NSDefaultRunLoopMode beforeDate:[NSDate distantFuture]]);

    return isLocalUser;
}

- (void)query:(ODQuery *)inSearch foundResults:(NSArray *)inResults error:(NSError *)inError
{

     if (!inResults && !inError)
     {
        [inSearch removeFromRunLoop:[NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode];
        [inSearch release];
        shouldKeepRunning = NO;  // end of search
     }

     ...
     // check what you found here
     // if found any nodes, user is local so
     isLocalUser = YES;
}

Another idea is to use Identity services:

- get the current user's identity (CSIdentityQueryCreateForCurrentUser)

- get the authority from that (CSIdentityGetAuthority)

- see if it's the local authority (CSGetLocalIdentityAuthority)

Hope this helps.

Problem

Using `dsconfigad -show` it's possible to parse the output and determine whether or the computer is bound to a Active Directory domain. The problem is the Active Directory domain is returned even the user is logged on as a local user account. Note: Ideally I need a solution that works in 10.5 as well. Similar Posts that don't answer question: How can I get the domain name for a user logged into a Mac via Active Directory

Original source

Related problems