User accounts, directory structures and selective access privileges

Question

Bought a new MacBook Pro back in April and only now am I getting down to using it. I was thinking of creating the following user accounts in the hope of creating a scheme that allows selective access to certain folders:
Root -a super user account
Admin - I don’t think I should be logged in as the administrator all the time
Jai Gill - my main account with all my work files including client information that is organised in a Workflow folder containing a Projects folder and a Clients folder (within which, each of my clients has a folder)
Show Time - a secure Simple Finder type account for when I am running a client specific presentation or workshop to ensure all data for other clients is kept secure and away from prying eyes.
When using the Show Time account, I would like to set it up so that only those files relating to the client in question are available for use. For instance, if I am running a workshop for Client G, I only want the folder for Client G available for use in this account and not any other clients. A few hours or days later, this could change to Client B or F or J etc so I need a way to easily secure the current client’s data and switch over to the other client’s data i.e., put away work and pull up new work.
Would it be possible to create a scheme using aliases placed in Show Time’s Documents folder pointing at a client folder in my documents folder to allow this to happen? Would I have to create a group with the right access privileges to enable this to happen? Or is there an alternative method based on using the Shared files folder and some sort of script or application to create a duplicate of a client folder and use a scheme to synchronise it with the original client folder?
Is this possible in Mac OSX? Any thoughts? Ideas? Applications/utilities that already enable this to happen?
MacBook Pro   Mac OS X (10.4.9)  

Answer 1

Hi Kiraly
I cracked it today. Took a couple of hours to figure out some idiosyncrasy but I'm now set.
Here's what I did:
1. Got a copies of Sharepoint, Workgroup Manager and ChronoSync.
2. Logged into the MacBook Pro as myself, went into System Preferences and used the normal approach to set up an account for a user called Show Time
3. Using Workgroup Manager, created an addition workgroup called macshow
4. Made myself and Show Time members of macshow
5. Attached the MBP to my G5 using my 2gen iPod's FireWire cable and cranked it up in target disk mode
6. Using ChronoSync, did a 'bi-directional' synchronisation of my Workflow folder into a location in the MBP's Shared folder (going to do this all the time)
7. Shut down, detached then restarted the MBP and logged on as myself.
8. Located the Workflow folder in the Shared folder and by getting information, set that folder and all it's contents to be owned by me but accessible and R/W for the group macshow
9. Went two levels into the Workflow folder [Workflow/4 Delivery/Client T] and using SharePoint, made the folder Client T accessible to the group macshow.
10. Logged in as Show Time and accessed the Shared folder to find that my scheme had worked and I had access to the folder for Client T and all it's contents.
11. Logged out and went back in under my ID and now using System Preferences, crippled the Show Time account down to Simple Finder with access limited to just a handful of applications like KeyNote, Word, Excel, Powerpoint and Safari.
12. Went back in as Show Time and it went into Simple Finder and thereafter, everything works great. Workflow showed up as did the folder for Client T plus all its contents. Opened a few documents and presentations and they wrked great.
New learning points for me:
1. I had to log out then log back in to make the access privileges stick when using the Show Time accounts
2. A number of locked Excel files prevented access privileges being set - had to locate and unlock each
3. Using both SharePoint and Workgroup Manager may be seem to be overkill but it works as these two applications helped in getting the groups sorted out as well as access to a specific folder.
The best part of the above scheme is that I can at anytime, using SharePoint, change the client folder being shared with the user Show Time through the use of the group macshow i.e., change Client T back to my group and then pick say Client J or any number of other client folders and assign them to the group macshow.
Thanks to you and the others who have posted on this and all other threads on this topic, I have sorted this out in one go.
Jai
PS in case you're wondering why it took me so long to get down to do it, it is something called client work. And may there be more of it too!
iMac G5 and MacBook Pro   Mac OS X (10.4.10)   MacUser since 1984