complex (?) screensaver unlock configuration

[Anonymous]

I would like to configure the screensaver such that:

1) If a regular user is logged in:
a) Admin can unlock
b) Users in a particular group can unlock
2) If an admin is logged in:
a) only admin can unlock

I know I can do 1) by modifying /etc/authorization and changing (or adding) the authorization rule system.login.screensaver such that the group is my specified group, and I just need to manually add the users to that group. Optimally, I would like not to have to remember to add users (especially admins!) to that group, but it doesn’t seem to be possible to use multiple groups in the key (i.e. I can’t just add group “foo”, leaving group “admin” as allowed)

Also, if I make the changes above, any member of that group can ALSO unlock the screen if an admin account locks it! No good!

Ideas?

[Author]

Posts