Chapter 19. Delegating permissions over users using IdM WebUI

Delegation is one of the access control methods in IdM, along with self-service rules and role-based access control.

Delegation is similar to roles in that one group of users is assigned permission to manage the entries for another group of users. However, the delegated authority is limited to editing the values of specific attributes; it does not grant the ability to add or remove whole entries or control over unspecified attributes. Also, the groups in delegated authority are existing IdM user groups instead of roles specifically created for access controls.

This chapter covers the following topics:

19.1. Delegation rules

You can delegate permissions over users by creating delegation rules.

Delegation rules allow a specific user group to perform write (edit) operations on specific attributes for users in another user group. This form of access control rule is limited to editing the values of specific attributes; it does not grant the ability to add or remove whole entries or control over unspecified attributes.

Delegation rules use existing user groups in IdM. You can use delegation to, for example, allow the managers user group to manage selected attributes of users in the employees user group.

19.2. Creating a delegation rule using IdM WebUI

This section describes how to create a delegation rule using the IdM WebUI.

Prerequisites

  • You are logged in to the IdM Web UI as a member of the admins group.

Procedure

  1. From the IPA Server menu, click Role-Based Access ControlDelegations.
  2. Click Add.

    delegation list add
  3. In the Add delegation window, do the following:

    1. Name the new delegation rule.
    2. Set the permissions by selecting the check boxes that indicate whether users will have the right to view the given attributes (read) and add or change the given attributes (write).
    3. In the User group drop-down menu, select the group who is being granted permissions to view or edit the entries of users in the member group.
    4. In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.
    5. In the attributes box, select the check boxes by the attributes to which you want to grant permissions.

      delegation add UPDATED
    6. Click the Add button to save the new delegation rule.

19.3. Viewing existing delegation rules using IdM WebUI

This section describes how to view existing delegation rules using the IdM WebUI.

Prerequisites

  • You are logged in to the IdM Web UI as a member of the admins group.

Procedure

  1. From the IPA Server menu, click Role-Based Access ControlDelegations.

    delegation list

19.4. Modifying a delegation rule using IdM WebUI

This section describes how to modify an existing delegation rule using the IdM WebUI.

Prerequisites

  • You are logged in to the IdM Web UI as a member of the admins group.

Procedure

  1. From the IPA Server menu, click Role-Based Access ControlDelegations.

    delegation list
  2. Click on the rule you want to modify.
  3. Make the desired changes:

    • Change the name of the rule.
    • Change granted permissions by selecting the check boxes that indicate whether users will have the right to view the given attributes (read) and add or change the given attributes (write).
    • In the User group drop-down menu, select the group who is being granted permissions to view or edit the entries of users in the member group.
    • In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.
    • In the attributes box, select the check boxes by the attributes to which you want to grant permissions. To remove permissions to an attribute, uncheck the relevant check box.

      delegation modify
    • Click the Save button to save the changes.

19.5. Deleting a delegation rule using IdM WebUI

This section describes how to delete an existing delegation rule using the IdM WebUI.

Prerequisites

  • You are logged in to the IdM Web UI as a member of the admins group.

Procedure

  1. From the IPA Server menu, click Role-Based Access ControlDelegations.
  2. Select the check box next to the rule you want to remove.
  3. Click Delete.

    delegation delete
  4. Click Delete to confirm.