Creating a Unix user from an application

Question

I'm working on a home-grown user database tied to a larger sustainment application.

The idea has been floated around to tie our users to system users, creating matching /etc/passwd entries each time a new user is generated in our program. Other interaction such as querying uid/gid for username or vice-versa, verifying filesystem ownership, etc. We've already got standard fields defined like user.uid, user.gid, user.home, internal permissions, etc and just need a way to pass these through to the system.

The trouble is, searching for any info online is a needle in a haystack scenario- I haven't been able to find any standard libraries for user account getters and setters, and I'm starting to wonder if these even exist? Is the right approach here to spawnv useradd? It seems like there must be a better way!

Note that the system this is running on is single use (virtualized), for all intents and purposes.

Final edit: It turns out that the most economical solution is:

useradd -g group -c "firstname lastname" -d /export/home/username -m -s /bin/bash username

I doubt it is a good idea to establish a 1:1 relation between db-users and system-users. This binds the db-app tightly to the underlying OS structure which might not be what you really want, at least not on the long run. You might be better off setting up a third (independent) entity doing the authentication which then could be used to authenticate db-user and/or OS-users. LDAP might be the tools of choice to do so. — alk
– alk, Commented Mar 6, 2013 at 18:32
@ColeJohnson if it is out of scope in SO, then unix.stackexchange.com would be the appropriate place for that question. — Kijewski
– Kijewski, Commented Mar 6, 2013 at 18:50

Kijewski · Accepted Answer · 2013-03-06 18:42:06Z

2

Is useradd what you are looking for?

useradd -g group -c "firstname lastname" -d /export/home/username -s /bin/ksh username
mkdir -p /export/home/username
chown username /export/home/username

edited Mar 6, 2013 at 18:42

answered Mar 6, 2013 at 18:28

Kijewski

26.1k14 gold badges108 silver badges149 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

Kijewski Over a year ago

Do not use your own implementation in production code. You will screw you system, that's for sure.

datenwolf Over a year ago

@Derek_6424246: Calling other programs is the Unix way of doing things. Doing it this way is highly encouraged and you should do it that way. Doing it in code is the worse solution, actually.

datenwolf Over a year ago

@ColeJohnson: Technically system level tools are libraries, you just use them differently. But there's another reason for doing this using separate program: SUID, which may be neccessary in certain system configuration. You don't want end user programs being SUID.

datenwolf Over a year ago

@ColeJohnson: SUID binaries, i.e. programs that are executed with the permissions of the user:group that owns the program executable file. A lot of tools related to user account management are or used to be SUID. /usr/sbin/passwd is one of them: It's SUID root, and if it were not, it could not update the system password database with a new password.

datenwolf Over a year ago

@ColeJohnson: Code that's executed SUID is security critical and hence it must be written carefully and with security in mind first and foremost. If there were a library for user management, the program that linked that binary would have to be SUID as well, implying very strong security requirements of the consumer program. Because of this, such kind of library would not be found in any well maintained Unix(-like) system, as such a library would be very dangerous by second degree.

|

fredrik · Accepted Answer · 2013-03-06 18:36:53Z

2

You could make your program into a NIS. Can't help you actually do it, but it might be worth looking at for you.

Added: You might be able to use ldap as well.

But any of those two would mean that you only need to keep the DB up to date. The passwd would take care of itself

edited Mar 6, 2013 at 18:36

answered Mar 6, 2013 at 18:32

fredrik

6,6783 gold badges40 silver badges49 bronze badges

2 Comments

Derek_6424246 Over a year ago

Given my initial question, this is probably the better answer. However, given the expense of implementing this as a solution (and the relative low priority of the problem) I had to go with external OS calls.

fredrik Over a year ago

Understandable. And I won't hold it against you. You're just being a good programmer, lazy by nature. :D

Collectives™ on Stack Overflow

Creating a Unix user from an application

2 Answers 2

10 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

10 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related