I have recently setup a small Mac-only network that utilise a Mac OS X Server which also shares out the user's auto-mounted home drives (/Users) via AFP.
This is all working fine, but one of the requirements I have is the ability for an admin group (or any declared group for that matter) to have rwx access to the "Users" share.
It is also necessary to inherit and preserve the user permissions, so if you put a file in a user share as a member of this admin group, the user owning the home drive should be able to access, modify and delete this file (or folder for that matter).
I have previously been able to achieve this in a Linux + Samba environment by setting up shares with something like this:
[archive] comment = archive data path = /shares/archive admin users = @somegroup inherit permissions = yes
Obviously, AFP is not Samba, but it's been hard to find any resources on this, so not sure if I am approaching this the wrong way? However, at the end of the day I need a declared privileged group to be able to access and modify data in the home drives, so they can see and work on projects within each user folder.
I know there have been a few advances in extending acls in Linux, and I assume Mac OS X has done the same (nested groups seems to be one such feature). So, my guess is the above is solved on the POSIX level. However, it's been surprisingly difficult to find any information on what I assume would have been a fairly common requirement.
I can understand the security implications here, so if I am doing it wrong, it would be great to be provided with some guidance as to the correct procedure to achieve this.