Earlier this week, I outlined some changes to my Local MCX implementation. I moved all of my computer and computergroup records (that existed solely to hold MCX data) from the Default local DS store at
/var/db/dslocal/nodes/Default/ to a newly created node at
In order to make this new local node do anything useful, you have to add it to the authentication search path. In this post I used Directory Utility to perform this task. That’s great when you’re doing your initial testing, but not terribly useful when to need to roll this change out to hundreds of machines (or more!).
You need a way to mass-deploy this change. Fortunately, you have several options. The search path is stored in /
Library/Preferences/DirectoryService/SearchNodeConfig.plist. You can configure that on one machine, then distribute it to all your machines via
/usr/bin/scp, ARD, radmind, or if you bundle it into an Apple package, via Casper, LANrev, or any other package delivery mechanism.
Another option is to script the change. Apple provides some notes on manipulating the DirectoryService search path from the command line here. Specifically, you could append your new load to the search list like this:
dscl /Search -create / SearchPolicy CSPSearchPath
dscl /Search -append / CSPSearchPath /Local/MCX
You could probably get away with just appending the new /Local/MCX node to the end of the current list, but it feels wrong somehow. I wanted my MCX node to be after the default local nodes, but before any network nodes. Here’s a little more complicated script that accomplishes that result:
#!/bin/sh # first make sure /Local/MCX node exists if [ ! -d "/private/var/db/dslocal/nodes/MCX" ] ; then echo "Missing /Local/MCX node!" exit 0 fi # now make sure /Local/MCX is in the search path, after /Local/Default /BSD/local localMCXinSearchPath=`/usr/bin/dscl /Search read / CSPSearchPath | /usr/bin/grep "/Local/MCX"` if [ "$localMCXinSearchPath" == "" ] ; then currentSearchPathContainsBSDlocal=`/usr/bin/dscl /Search read / CSPSearchPath | /usr/bin/grep "/BSD/local"` if [ "$currentSearchPathContainsBSDlocal" != "" ] ; then currentSearchPathBegin="/Local/Default /BSD/local" currentSearchPathEnd=`/usr/bin/dscl /Search read / CSPSearchPath | /usr/bin/cut -d" " -f4-` else currentSearchPathBegin="/Local/Default" currentSearchPathEnd=`/usr/bin/dscl /Search read / CSPSearchPath | /usr/bin/cut -d" " -f3-` fi /usr/bin/dscl /Search create / SearchPolicy CSPSearchPath /usr/bin/dscl /Search create / CSPSearchPath $currentSearchPathBegin /Local/MCX $currentSearchPathEnd fi
What this script does:
- Checks to make sure the /Local/MCX node exists.
- Reads the current search path.
- If it doesn’t find “/Local/MCX” in the current search path, it parses the search path, splitting it into the default local nodes (usually “/Local/Default /BSD/local”, but can handle it if “BSD/local” is missing), and anything after that, which is usually a network node (or possibly nothing).
- Finally, the script writes out the new search path, inserting “/Local/MCX” between the default local node(s) and any pre-existing nodes past the default local nodes.
This script is safe to run multiple times, so you can implement it as a script that runs every startup, which would address the issue where a local admin might use Directory Utility to temporarily remove /Local/MCX from the search path. You’d be assured that this script would re-add it on the next restart.