Using Workgroup Manager

Workgroup Manager is another tool you'll use frequently when you're managing Mac OS X Server (Figure 2.57). The main job of Workgroup Manager is to manage users and groups; add share points such as folders and volumes; create specific network views; and edit preferences for users, groups, and computer accounts. You can access Workgroup Manager directly via Server Admin and vice versa, using the top-left icon in the Toolbar.

Figure 2.57. Workgroup Manager is another frequently used tool.

Like other tools in the Server folder, Workgroup Manager can be run locally and remotely; the authentication process is identical to that of Server Admin. The first time you launch Workgroup Manager, you'll need to connect to your server. A dialog will appear from the Workgroup Manager window. Depending on where you're physically located, you have three options:

• A direct connection to the server.
  
  If you're doing this on the server, the Address field contains the Bonjour name of the server and the logged-in administrator's name.
  
  
• A connection from another Mac OS X Server or Mac OS X computer running the Workgroup Manager tool on your local network/subnet.
  
  You can click Browse in the Workgroup Manager Connect dialog and search for your server on your local network.
  
  
• A remote connection from anywhere around the globe, provided your server has a public IP address or fully qualified domain name.
  
  You'll need to have the IP address or fully qualified domain name handy for entry into the Address field.
  
  

Enter your administrator name password, choose whether you wish to add the password to your keychain so you don't have to type it in later, and click Connect (Figure 2.58).

Figure 2.58. In the Workgroup Manager Connect dialog, enter your administrator name password, choose whether you wish to add the password to your keychain, and click Connect.

Tip

• If you're working directly on the server, you'll notice that the Workgroup Manager tool is already in the Dock. If you're working remotely, you may wish to add the Workgroup Manager tool to the Dock.

The Workgroup Manager Toolbar gives you access to the following buttons (from left to right) (Figure 2.59):

• Admin, which launches the Server Admin tool
  
  
• Buttons that narrow the focus of Workgroup Manager to three specific areas:
  
  
  • Sharing settings
    
    
  • Network view settings
    
    
  • Accounts management, which lets you manage users, groups, and computers
    
    
  • Preferences settings for user, groups, and/or computers
    
    
• New User and Delete for account management
  
  
• Connect, Disconnect, and Refresh
  
  
• New Window, which creates a new Workgroup Manager window for the server You might use this option to view users in one window and groups in another.
  
  
• Search, which when clicked displays a dialog permitting the administrator to display only users based on given set of criteria and subsequently perform batch editing on the results of the query (Figure 2.60).
  
  

Figure 2.59. The Workgroup Manager toolbar gives you access to a variety of useful buttons.

Figure 2.60. The Search button reveals the set criteria and batch editing dialog.

In the pop-up menu directly beneath the Toolbar on the left, you can select various directories you're authenticated to see (directories are discussed in the next chapter). By clicking the globe or triangle, you can see those directories (at this point you may only see the local directory) (Figure 2.61).

Figure 2.61. The Workgroup Manager Directory drop-down menu lets you select directories you're authenticated to see.

Altering Workgroup Manager preferences

Workgroup Manager has preferences that affect how you'll use this tool, regardless of the server(s) you connect to. Choose Preferences from the Workgroup Manager menu to see some of these important options (Figure 2.62):

• Resolve DNS names when possible This option is used when servers have properly configured DNS (discussed in Chapter 6).
  
  
• Use secure transactions (SSL) for Sharing (secure connections are discussed in Chapter 10, "Security").
  
  
• Show "All Records" tab and inspector You can show the Inspector tab (to be discussed in Chapter 4, "User and Group Management"), which lets you see and edit attributes for user, group, or computer accounts on both the local and LDAP databases. This tab becomes incredibly useful when you're doing such advanced editing as adding attributes to users (attributes are discussed in the next chapter). The All Records tab permits other record types to be edited (such as configuration records, printer records, or mount records, to name just a few). The All Records tab and Inspector should be shown all the time to facilitate and foster constant learning when working with Mac OS X Server.
  
  
• Limit search results to requested records and List a maximum of () records These options become important in large organizations where you have thousands of records. You may wish to show only 500 and do searches for the rest. Chapter 4 covers searching for account records.
  
  
• Auto-refresh Sharing You can auto-refresh this portion of Workgroup Manager more or less frequently.
  
  

  Figure 2.62. Choose Preferences from the Workgroup Manager menu to open the Workgroup Manager Preferences dialog.

  

  
  

Tips

• In both Workgroup Manager and Server Admin (as well as most other applications), you can use the combination of the Command and comma keys to open the Preferences window.

• You can show system users and groups, including root and those used by various services by selecting the menu View > Show System Users and Groups. These are hidden by default; you shouldn't change any parameters to the system users and groups unless you're absolutely sure of the result.

Managing Workgroup Manager

Workgroup Manager is used to enter or import user and group information. You can also use it to view and edit accounts not located on a Mac OS X Server. Although this topic is more advanced than this chapter can explore, it's useful to understand how important Workgroup Manager is in your daily dealings with Mac OS X Server.

To add the All Records tab and Inspector to your view

1.	Launch the Workgroup Manager tool located in /Applications/Server and authenticate if necessary . You don't need to authenticate, although you can.
2.	Choose Preferences from the Workgroup Manager menu.
3.	In the window that appears, select the "Show 'All Records' tab and inspector" check box (Figure 2.63). Figure 2.63. The Inspector tab check box in Workgroup Manager.
4.	Click OK to close the Preferences window.
5.	A warning dialog tells you that you can possibly lose data or make your system inoperable by editing raw attributes. Click OK to dismiss the dialog (Figure 2.64). Figure 2.64. A warning dialog tells you that you can lose data or make your system inoperable by editing raw attributes. If you click the Accounts icon , regardless of account type (user, group, computer), you'll see an additional tab at the end of the account types and an additional tab at the end of the account configuration frame . This tab will be discussed in more detail in Chapter 4.

Tip

• Add your server to the Favorites menu in Workgroup Manager by launching Workgroup Manager, entering your server information, authenticating, and choosing your server from the Add to Favorites selection from the Favorites menu.

Adding users to your Mac OS X Server

Mac OS X Server can have more than one directory database (discussed in the next chapter). However, you can quickly add users to Mac OS X Server using Workgroup Manager. You'll add users to the local database at this point, but the process of adding them to another directory database is the same.

It is important to note that on Mac OS X you use the Accounts Preference Pane of System Preferences to add users. You can also use this method on Mac OS X Server. In each case, users are added to the local NetInfo database. When a user is created with the Accounts Preference Pane, Setup Assistant (Mac OS X), or Server Assistant (Mac OS X Server), they are added to the local NetInfo database with a user ID of 501 and up. Each user has a group created just for them using the short name of the user. Subsequently, they are the only member in their group. When you use Workgroup Manager to create users on Mac OS X or Mac OS X Server, user IDs start at 1024 and users are members of the staff group and do not have a group based on their name. While this does not inherently cause issues, it is worth noting. A good rule to follow is to use the Accounts Preference Pane when dealing with Mac OS X and Workgroup Manager when dealing with Mac OS X Server.

Privileges and Permissions

For most purposes (and the purposes of this book), privileges and permissions mean the same thing: what a user is authorized to do. That may be reading the contents of a folder or opening a file. Mac OS 9 and ASIP use the term privileges. Mac OS X and Mac OS X Server largely use the term permissions. Apple does use the word privileges when dealing with administration of users, groups, and computers, as you'll see in Chapter 4, but this has nothing to do with the ability to access disks, folders, and files.

To add user accounts to Mac OS X Server

1.	Launch the Workgroup Manager tool located in /Applications/Server and authenticate if necessary.
2.	In the Toolbar, select Accounts , and in the Account Types tab, select the User tab .
3.	In the user settings frame on the right, select the Basic tab (Figure 2.65). Figure 2.65. Selecting the Basic tab of the User settings in Workgroup Manager. In the Toolbar, click New User .
4.	Enter the following information in the appropriate fields:
Name The full name of the user, such as Bob Abooie.
User ID Already entered for you in this case. A unique ID that Mac OS X Server (and Client) uses to enforce folder and file permissions.
Short Names The user's short name(s). For compatibility with older operating systems, this name should only use letters (usually lowercase) and numbers and be more than five characters, such as bobabooie or abooie. Additional short names can be longer if you wish.
Password and Verify Passwords should include a variety of characters and both uppercase and lowercase letters. Passwords can be well over 64 characters long; however, this is impractical, and not all computer software that requires authentication can accept such a long character string, such as other authentication systems that keep their own password database.
5.	In the Workgroup Manager window, click Save . There are many other options when adding users, as you'll see in Chapter 4.

Tip

• Both Server Admin and Workgroup Manager will be used to manage Mac OS X Server for the remainder of this book. You might want to take the time to click the various icons in their respective Toolbars and familiarize yourself with these buttons.

Account Types

To switch between user, group, and computer lists, click the Accounts button in the Toolbar and then select the icon that corresponds to the account type.

When you choose each account type, you'll notice the settings (tabs) for those account types change (in the settings frame to the right in Workgroup Manager) based on the account type:

• User account settings tabs (Figure 2.66)
  
  

  Figure 2.66. User account settings tabs.

  
  
  
• Group account settings tabs (Figure 2.67)
  
  

  Figure 2.67. Group account settings tabs.

  

  
  
• Computer account settings tabs (Figure 2.68)
  
  

  Figure 2.68. Computer account settings tabs.