Red Hat Training
A Red Hat training course is available for Red Hat Enterprise Linux
10.3. Delegating Permissions over Users
Delegation is very similar to roles in that one group of users is assigned permission to manage the entries for another group of users. However, the delegated authority is much more similar to self-service rules in that complete access is granted but only to specific user attributes, not to the entire entry. Also, the groups in delegated authority are existing IdM user groups instead of roles specifically created for access controls.
10.3.1. Delegating Access to User Groups in the Web UI
- On the IPA Server tab in the top menu, select the → subtab.
- Click the Add link at the top of the list of the delegation access control instructions.
Figure 10.4. Adding a New Delegation
- Name the new delegation ACI.
- Set the permissions by selecting the check boxes whether users will have the right to view the given attributes (read) and add or change the given attributes (write).Some users may have a need to see information, but should not be able to edit it.
- In the User group drop-down menu, select the group who is being granted permissions to the entries of users in the user group.
Figure 10.5. Form for Adding a Delegation
- In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.
- In the attributes box, select the check boxes by the attributes to which the member user group is being granted permission.
- Click the Add button to save the new delegation ACI.
10.3.2. Delegating Access to User Groups in the Command Line
A new delegation access control rule is added using the delegation-add command. There are three required arguments:
--group, the group who is being granted permissions to the entries of users in the user group.--membergroup, the group whose entries can be edited by members of the delegation group.--attrs, the attributes which users in the member group are allowed to view or edit.
For example:
$ ipa delegation-add "basic manager attrs" --attrs=manager --attrs=title --attrs=employeetype --attrs=employeenumber --group=engineering_managers --membergroup=engineering -------------------------------------- Added delegation "basic manager attrs" -------------------------------------- Delegation name: basic manager attrs Permissions: write Attributes: manager, title, employeetype, employeenumber Member user group: engineering User group: engineering_managers
Delegation rules are edited using the delegation-mod command. The
--attrs option overwrites whatever the previous list of supported attributes was, so always include the complete list of attributes along with any new attributes.
[jsmith@server ~]$ ipa delegation-mod "basic manager attrs" --attrs=manager --attrs=title --attrs=employeetype --attrs=employeenumber --attrs=displayname ----------------------------------------- Modified delegation "basic manager attrs" ----------------------------------------- Delegation name: basic manager attrs Permissions: write Attributes: manager, title, employeetype, employeenumber, displayname Member user group: engineering User group: engineering_managers
Important
Include all of the attributes when modifying a delegation rule, including existing ones.
