id command only returning 20 groups

[Dale Renton]

HP-UX 11.23 Itanium

The following command is only returning a user's first 20 groups. We use ldapux to connect to an openldap server. Any suggestions?

/usr/bin/id -G -n

Thanks

[Bill Hassell]

That's all you can have for HP-UX. See man getconf, or specifically:

getconf NGROUPS_MAX
20

[Dale Renton]

Ok, thanks.

Any suggestions on how I can determine if a user belongs to a certain group? Right now my script does this :

for var in `/usr/bin/id -G -n` ; do
if [ "$var" = "groupname" ]; then
TZ=EST5EDT
export TZ
break
fi
done

[James R. Ferguson]

Hi Dale:

> how I can determine if a user belongs to a certain group?

# groups user

...shows the group(s) to which user belongs. For example:

# groups root
adm bin daemon lp mail other root sys users

See the manpages for 'groups(1)' for more information.

Regards!

...JRF...

[Dale Renton]

Yes, but that only shows me the first 20 groups. The group I want to determine if the user is a member of is the 23rd.

Thanks,
Dale

[Bill Hassell · Accepted solution]

For HP-UX, it won't matter. The user may be associated with 23 groups but only the first 20 are meaningful. The user will not have any group rights for the 23rd group (or any group beyond the first 20). If you create a file with 660 permissions, owned by someone else with group = group23, the user (with group23 membership) cannot read or write the file. This is a system wide limitation. Various flavors of Unix have different group membership limitations.

[Dale Renton]

Ok thanks. I guess I will have to move the groups in question up in the list.

[Dale Renton]

closed