Modifying the NetInfo Database

The NetInfo database is organized hierarchically, much like a file system. Each folder has properties (referenced by property keys) and values (which depend on the property). The netinfod process provides access to the database, and the database is stored at /var/db/netinfo.

The following figure illustrates how netinfod reads from the local NetInfo database and writes to, in this case, netinfo.log. When managing the NetInfo database, you can use dscl or NetInfo Manager, although Workgroup Manager is better suited to the task.

Note

While NetInfo calls them properties, Workgroup Manager calls them attributes. This book will use the universal term attributes, since the term properties is more specific to NetInfo.

Using Command-Line Utilities

For command-line access to the NetInfo database, you can use the dscl utility. It includes commands to read, create, and manage NetInfo data. If used without any commands, dscl runs in an interactive mode, reading commands from standard input. Because dscl uses the DirectoryService process, it is able to access directory data from any of the directory services that Mac OS X supports.

The nicl utility is a legacy tool that works directly with the NetInfo database. Because nicl does not go through DirectoryService, it can be used to edit the NetInfo database directly. Unlike dscl, nicl can access only NetInfo data. You can use either dscl or nicl to edit directory data from the command line, but while dscl an edit both databases, nicl can be used in single user mode, (nicl raw /var/db/netinfo/local.nidb). As a precautionary measure, you should backup your NetInfo database before editing by using the line nidump -r / . > ~/Documents/local.dump to dump a copy of the NetInfo database to your Documents folder.

Although you can use dscl to edit group information, Mac OS X includes dseditgroup for manipulating a group record. The format of the command is

dseditgroup [options] [parameters] groupname

where groupname is the group record being manipulated.

More Info

Refer to the man page for dseditgroup for a listing of valid options. Because of the new schema surrounding groups, it would be rather tedious to attempt to edit groups the way it was done in previous versions of Mac OS X. The dseditgroup command was created specifically for the purpose of managing groups, and should be used accordingly.

Using GUIs

If you prefer using a graphical user interface (GUI), you can use either Workgroup Manager or NetInfo Manager to view and change records, properties (attributes), and values in the NetInfo database. However, you should be aware of the differences between the two tools.

Workgroup Manager

Workgroup Manager ships with Mac OS X Server to enable you to administer user, group, and computer accounts; manage share points; and perform client-management functions for Mac OS X users. Workgroup Manager is also available online as part of the Server Admin Tools package (www.apple.com/downloads/macosx/apple/serveradmintools104.html).

This tool features an Inspector mode that provides an administrator full access to all of the information stored in either the Lightweight Directory Access Protocol (LDAP) or NetInfo databases. With the Inspector, you can directly manipulate the attributes and values that Workgroup Manager would have changed automatically for you. You are also able to select whether to view the raw LDAP attribute names as the LDAP server sees them, and/or the Open Directory names, after Directory Access has mapped them.

NetInfo Manager

NetInfo Manager ships as part of Mac OS X (/Applications/Utilities) and, like Workgroup Manager, it is used to view and modify directory data. However, it is limited to data in the NetInfo database. Also, it bypasses the DirectoryService process and accesses the NetInfo database directly.

Tip

Apple recommends that you use Workgroup Manager to access directory data whenever possible. It works with both LDAP and NetInfo directory domains, and provides an Open Directory view of the data and parameters.