There are four ways to create users in Mountain Lion Server. The first is using the Server app, the second is using Workgroup Manager, the third is using the Users & Groups System Preference pane and the fourth is using the command line. In this article we will look at creating users in the Server app.
To do so, open the Server app and connect to your server. Then click on the Users entry in the ACCOUNTS list. The list of users is displayed, based on the directory domain(s) being browsed. A directory domain is a repository of account data, which can include local users, local network users and users in a shared directory service such as Open Directory and Active Directory.
The drop-down list allows you to see objects that are stored locally as well as on a shared directory server. Therefore, clicking All Users will show all of the accounts accessible by the system. Click on the plus sign to create a new account. At this point, if the server has been promoted to an Open Directory Master, the account will be a local network account, with no way of choosing a different location to store the account in the Server app.
When prompted, provide the following information about the new user:
- Full Name: Usually the first and last name of the user.
- Account Name: A shorter representation of that name with no spaces or special characters.
- Email address: The email address to use if the account is going over quotas, has calendar invitations sent, or used for email hosted on the server, etc.
- Password: The password the user will use to access services on the server.
- Verify: The password a second time to make sure there are no spelling errors.
- Allow user to administer this server: Optional field that grants the user administrative access to the server.
- Home Folder: Optional field that by default creates local home directories for users that use the account but that also allows you to select a directory shared using the File Sharing service as a location for home folders. Each user in OS X has a home folder, this option defines whether that folder will reside on their computer or on a central server.
- Disk Quota: Define the amount of space an account can take up on servers.
Note: Optionally, you can also drag an image onto the image shown in the New User screen if you’d like the user to have an avatar.
Once the account details are as you would like, click on the Done button. The account will then be displayed in the list of available accounts. You can still create local accounts but must do so in the Users & Groups System Preference pane, through Workgroup Manager or through the command line. If the server has not been made an Open Directory server then you would be creating local users through the Server app.
Once the account is created, highlight it and click on the cog wheel icon below the list of accounts. Here, you have the option to edit the account you just created, edit their access to services hosted on the server, configure email information and change their password.
Click Edit User. Here, you have two new features. You can add the user to groups and use the checkbox for “log in” to disable the account.
Click Cancel and then using the cog wheel menu again, click on Edit Access to Services. Here, uncheck each service that the user should not have access to. If the service isn’t running then it’s not a big deal. You can highlight multiple accounts concurrently and then use this option to disable services for users en masse.
Profile Manager allows you to leave certain fields that are user-centric blank and it will prompt at the time that the profile is installed for the blank information. These are usually user-centric fields, such as short name and password. You can also create a profile in Profile Manager for each user you want to setup mail, Exchange, iCal, Address Book and other services that are tied to a specific user. You can enter the username for each and leave the password blank and the user will be prompted for the password but have the username filled in. And then there are payload variables.
Note: Before we get started on Payload Variables, it’s worth noting that many did not work well prior to 10.7.3, most notably %email%.
Profile Manager provides a number of ways to configure accounts and settings on iOS based devices. When a user logs in, the user’s name, email address, title, phone number and both the short name and GUID of the user’s account are able to be substituted using variables. These variables have a % in front of and behind the name of the variable, making them easy to identify when looking at accounts. These can easily be put into a profile’s payload. When a user logs in the contents of the payload variable are replaced with the information for the account that logged in using the /MyDevices page in the web enrollment interface. When the enrollment profile is downloaded to the device, the variable is substituted with the user’s information from directory services (for user payloads) or from the device itself (for device payloads).
Using payload variables is a really straight forward process. First, create a profile by logging into the Profile Manager web interface (the name of the server followed by /ProfileManager. When prompted, provide the username and password for an administrative account.
Click on a group or user who you would like to configure a profile for.
From the profile screen, select the payload that you’d like to configure.
Enter the variable into the field(s) you’d like the substitution to occur in. For example, here I’m using a variable everywhere currently possible.
Note: You can wrap the variable with other text. For example, if you enter krypton.com/%short_name% then for a user of cedge the variable would expand as krypton.com/cedge, useful in doing Exchange configurations.
Variables available for use include user and device variables. These user variables are as follows:
- %email% – The email address (the EMailAddress attribute)
- %first_name% – The first name (the FirstName attribute)
- %full_name% – The full name (the RealName attribute)
- %guid% The guid (the GeneratedID attribute)
- %last_name% – The last name (the LastName attribute)
- %job_title% The job title (the JobTitle attribute)
- %mobile_phone% The mobile number (the MobileNumber attribute)
- %short_name% The short name (the RecordName attribute, typically the name of the account )
The device variables are as follow:
- %BuildVersion% – Full OS version on the device
- %ICCID% – ICCID (from the SIM card)
- %IMEI% – IMEI (International Mobile Equipment Identity)
- %OSVersion% – Common version number of the device’s OS
- %ProductName% – Product name
- %SerialNumber% – Serial number
- %WIFIMAC% – MAC address of the WiFi interface
There are also 802.1x variables, which include the following: