Restricting allowed network logins

Question

I'm hoping to find a way to restrict newtork logins.
I have an environment with both openldap on linux, and Active Directory directories available to authenticate against. These directories are synced, so it doesn't matter which directory service is used.
I have successfully authenticated using network logins with both of these directories.
My problem is that I have a group of semi-public computers, and I would like to limit the allowed network logins to a small list of users, rather than the whole directory.
On linux, I was able to do this with a hodgepodge of pam_ldap configurations, allowing login only if there was a local home directory. So I could manually add a user locally with their netowrk uid, but they would use thier network password.
Is there a method to do this with OS X? To restrict allowed network logins to a list of uids?

Answer 1

I tried the osascript line and killall -HUP loginwindow in a loginHook script without success.
If I run the loginHook script from the terminal..
"sudo /Library/Management/get-user-info.sh nghani"
it works fine but when I login as nghani..
no osascript and
no restricted login
From the debug file I know my script is running from the LoginHook and the logic is correct.
Am I missing something?
Please help!!!!
/Library/Management/debug:
nghani is not ics or root
nghani user is not in group
button returned:OK
kill -HUP 600
nghani is not ics or root
nghani user is not in group
root is ics or root
/Library/Management/get-user-info.sh:
#!/bin/sh
shortname=$1
if [ "${shortname}" = "ics" -o "${shortname}" = "root" ]
then
# local admin accounts do nothing
echo "${shortname} is ics or root" >> /Library/Management/debug
exit
else
echo "${shortname} is not ics or root" >> /Library/Management/debug
# do ldap search to get email addresses + fullname + groups
ldapsearch -H ldaps://ldapnw1.instruct.langara.bc.ca -D "cn=MacProxy,ou=ProxyUsers,o=Aves" -w `cat MacProxyPassword` -b "ou=Users,o=Aves" -s sub -x cn=${shortname} cn mail fullname groupMembership > /Library/Management/Thunderbird/user-info
# UGLabsAll
if [ -n "`cat /Library/Management/Thunderbird/user-info | grep groupMembership: | grep -e 'UGLabsMac'`" ]
then
# user is a member of the required group.
echo "${shortname} user is in group" >> /Library/Management/debug
else
# user is not in the right group LOGOUT!
echo "${shortname} user is not in group" >> /Library/Management/debug
# tell user
osascript -e 'tell application "SystemUIServer"' -e 'display dialog "You are not permitted to use this computer. You will now be logged out." buttons {"OK"} default button "OK"' -e 'end tell' >> /Library/Management/debug
# logout
/usr/bin/killall -v -HUP loginwindow 1>> /Library/Management/debug 2>> /Library/Management/debug
fi
fi
G5 Tower 1.8GHz Mac OS X (10.4.4)