The nisgrpadm utility is used to administer NIS+ groups. This command administers both groups and the groups' membership lists. nisgrpadm can create, destroy, or list NIS+ groups. nisgrpadm
can be used to administer a group's membership list. It can add or delete principals to the group, or test principals for membership in the group.
The names of NIS+ groups are syntactically similar to names of NIS+ objects but they occupy a separate namespace. A group named a.b.c.d. is represented by a NIS+ group object named a.groups_dir.b.c.d.; the functions described here all expect the name of the group, not the name of the corresponding group object.
There are three types of group members:
- An explicit member is just a NIS+ principal-name. For example: wickedwitch.west.oz.
- An implicit ("domain") member, written *.west.oz., means that all principals in the given domain belong to this member. No other forms of wildcarding are allowed; wickedwitch.*.oz. is invalid, as is wickedwitch.west.*.. Note that principals in subdomains of the given domain are not included.
- A recursive ("group") member, written @cowards.oz., refers to another group; all principals that belong to that group are considered to belong here.
Any member may be made negative by prefixing it with a minus sign ('-'). A group may thus contain explicit, implicit, recursive, negative explicit, negative implicit, and negative recursive members.
A principal is considered to belong to a group if it belongs to at least one non-negative group member of the group and belongs to no negative group members.
Principal names must be fully qualified, whereas groups can be abbreviated on all operations except create.