objective-c - (Objective-c/Mac OSX) 如何在 Mac OSX 上区分托管 AD 用户(AD 用户创建移动卡)和本地用户

Question

<\RESOLVED>，请看第一条回复

我的 mac(10.9) 已加入 AD 域。在我的程序中，我尝试识别当前登录用户是本地帐户还是AD用户。我可以通过使用以下代码成功区分它们。

+ (bool)isLocalUser:(NSString*)user
{
    NSError *dirSearchError = nil;
    ODRecord *foundUser = findUser(user, &dirSearchError);
    if(foundUser !=nil)
    {
        return YES;
    }else
    {
        return NO;
    }
}

ODRecord *findUser(NSString *user, NSError **error)

{
    NSLog(@"[MacLogonUI] findUser");
    ODNode *searchNode = [ODNode nodeWithSession: [ODSession defaultSession]
                                        type: kODNodeTypeLocalNodes
                                       error: error];

    if (searchNode == nil) {
        return nil;
    }

    NSDictionary *nodeInfo = [searchNode nodeDetailsForKeys:nil error:error];

    /* query this node for the user record we're interested in.
     * We only need one result, which is why maximumResults is set to 1.
     */
    ODQuery *userSearch = [ODQuery queryWithNode: searchNode
                              forRecordTypes: kODRecordTypeUsers
                                   attribute: kODAttributeTypeRecordName
                                   matchType: kODMatchEqualTo
                                 queryValues: user
                            returnAttributes: kODAttributeTypeStandardOnly
                              maximumResults: 1
                                       error: error];

    if (userSearch == nil) {
        return nil;
    }

    /* For this example we'll use a synchronous search. This could take a while
     * so asynchronous searching is preferable.
     */

    NSArray *foundRecords = [userSearch resultsAllowingPartial: NO error: error];

    if (foundRecords == nil || [foundRecords count] == 0) {
        return nil;
    }

    ODRecord *userRecord = [foundRecords objectAtIndex: 0];
   return [[userRecord retain] autorelease];
}

而当 AD 用户创建移动卡时，它被视为受管用户(从系统首选项 -> 用户和组)。该代码还将这种 AD 用户识别为本地用户。遇到这种情况怎么办？

大家对这个问题有什么想法吗？

Answer 1

我自己解决了这个问题。希望以下代码有帮助:

#import "DasUser.h"
#import <OpenDirectory/OpenDirectory.h>
#import <Collaboration/Collaboration.h>

@implementation DasUser


+ (bool)isLocalUser:(NSString*)user
{
    NSError *dirSearchError = nil;
    ODRecord *foundUser = findUser(user, &dirSearchError);
    if(foundUser !=nil)
    {
        return YES;
    }else
    {
        return NO;
    }
}

ODRecord *findUser(NSString *user, NSError **error)

{
    NSLog(@"[MacLogonUI] findUser");

    CSIdentityAuthorityRef defaultAuthority = CSGetManagedIdentityAuthority();
    CSIdentityClass identityClass = kCSIdentityClassUser;

    CSIdentityQueryRef query = CSIdentityQueryCreate(NULL, identityClass,                defaultAuthority);

    CFErrorRef err = NULL;
    CSIdentityQueryExecute(query, 0, &err);

    CFArrayRef results = CSIdentityQueryCopyResults(query);

    int numResults = CFArrayGetCount(results);

    NSMutableArray * managedUsers = [NSMutableArray array];
    for (int i = 0; i < numResults; ++i) {
        CSIdentityRef identity = (CSIdentityRef)CFArrayGetValueAtIndex(results, i);
        CBIdentity * identityObject = [CBIdentity identityWithCSIdentity:identity];
        NSString* posixName = [identityObject posixName];
        [managedUsers addObject:posixName];
    }

    CFRelease(results);
    CFRelease(query);

    ODNode *searchNode = [ODNode nodeWithSession: [ODSession defaultSession]
                                        type: kODNodeTypeLocalNodes
                                       error: error];

    if (searchNode == nil) {
        return nil;
    }

    /* query this node for the user record we're interested in.
     * We only need one result, which is why maximumResults is set to 1.
     */
    ODQuery *userSearch = [ODQuery queryWithNode: searchNode
                              forRecordTypes: kODRecordTypeUsers
                                   attribute: kODAttributeTypeRecordName
                                   matchType: kODMatchEqualTo
                                 queryValues: user
                            returnAttributes: kODAttributeTypeStandardOnly
                              maximumResults: 1
                                       error: error];

    if (userSearch == nil) {
        return nil;
    }

    /* For this example we'll use a synchronous search. This could take a while
     * so asynchronous searching is preferable.
     */

    NSArray *foundRecords = [userSearch resultsAllowingPartial: NO error: error];

    if([foundRecords count]>0)
    {
        NSString *nameStr = [foundRecords[0] recordName];

        NSLog(@"[MacLogonUI] findUser nameStr %@", nameStr);

        int j;
        for( j = 0; j<[managedUsers count]; j++)
        {
            if([nameStr isEqualToString:managedUsers[j]])
            {
                break;
            }
        }

        if(j<[managedUsers count])
        {
            foundRecords = nil;
        }
    }

    if (foundRecords == nil || [foundRecords count] == 0) {
        return nil;
    }

    ODRecord *userRecord = [foundRecords objectAtIndex: 0];
    return [[userRecord retain] autorelease];
}    

@end

而当mac的网络断开时。无法列出受管用户。有没有人对此有任何想法？