Chapter 28. Managing role-based access controls using the IdM Web UI

Procedure

1. To add a new permission, open the Role-Based Access Control submenu in the IPA Server tab and select Permissions:

   

2. The list of permissions opens: Click the Add button at the top of the list of the permissions:

   

3. The Add Permission form opens. Specify the name of the new permission and define its properties accordingly:

   

4. Select the appropriate Bind rule type:

   • permission is the default permission type, granting access through privileges and roles
   • all specifies that the permission applies to all authenticated users

   • anonymous specifies that the permission applies to all users, including unauthenticated users

     Note

     It is not possible to add permissions with a non-default bind rule type to privileges. You also cannot set a permission that is already present in a privilege to a non-default bind rule type.

5. Choose the rights to grant with this permisthsion in Granted rights.

6. Define the method to identify the target entries for the permission:

   • Type specifies an entry type, such as user, host, or service. If you choose a value for the Type setting, a list of all possible attributes which will be accessible through this ACI for that entry type appears under Effective Attributes. Defining Type sets Subtree and Target DN to one of the predefined values.
   • Subtree (required) specifies a subtree entry; every entry beneath this subtree entry is then targeted. Provide an existing subtree entry, as Subtree does not accept wildcards or non-existent domain names (DNs). For example: cn=automount,dc=example,dc=com
   • Extra target filter uses an LDAP filter to identify which entries the permission applies to. The filter can be any valid LDAP filter, for example: (!(objectclass=posixgroup))
     IdM automatically checks the validity of the given filter. If you enter an invalid filter, IdM warns you about this when you attempt to save the permission.
   • Target DN specifies the domain name (DN) and accepts wildcards. For example: uid=*,cn=users,cn=accounts,dc=com
   • Member of group sets the target filter to members of the given group. After you specify the filter settings and click Add, IdM validates the filter. If all the permission settings are correct, IdM will perform the search. If some of the permissions settings are incorrect, IdM will display a message informing you about which setting is set incorrectly.

7. Add attributes to the permission:

   • If you set Type, choose the Effective attributes from the list of available ACI attributes.

   • If you did not use Type, add the attributes manually by writing them into the Effective attributes field. Add a single attribute at a time; to add multiple attributes, click Add to add another input field.

     Important

     If you do not set any attributes for the permission, then the permissions includes all attributes by default.

8. Finish adding the permissions with the Add buttons at the bottom of the form:

   • Click the Add button to save the permission and go back to the list of permissions.
   • Alternatively, you can save the permission and continue adding additional permissions in the same form by clicking the Add and Add another button
   • The Add and Edit button enables you to save and continue editing the newly created permission.
9. Optional. You can also edit the properties of an existing permission by clicking its name from the list of permissions to display the Permission settings page.

10. Optional. If you need to remove an existing permission, click the Delete button once you ticked the check box next to its name in the list, to display The Remove permissions dialog.

    Note

    Operations on default managed permissions are restricted: the attributes you cannot modify are disabled in the IdM Web UI and you cannot delete the managed permissions completely.
    However, you can effectively disable a managed permission that has a bind type set to permission, by removing the managed permission from all privileges.

Procedure

1. To add a new privilege, open the Role-Based Access Control submenu in the IPA Server tab and select Privileges:

   

2. The list of privileges opens. Click the Add button at the top of the list of privileges:

   

3. The Add Privilege form opens. Enter the name and a description of the privilege:

   

4. Click the Add and Edit button to save the new privilege and continue to the privilege configuration page to add permissions.
5. Edit the properties of privileges by clicking on the privileges name in the privileges list. The privileges configuration page opens.

6. The Permissions tab displays a list of permissions included in the selected privilege. Click the Add button at the top of the list to add permissions to the privilege:

   

7. Tick the check box next to the name of each permission to add, and use the > button to move the permissions to the Prospective column:

   

8. Confirm by clicking the Add button.
9. Optional. If you need to remove permissions, click the Delete button after you ticked the check box next to the relevant permission: the Remove privileges from permissions dialog opens.
10. Optional. If you need to delete an existing privilege, click the Delete button after you ticked the check box next to its name in the list: the Remove privileges dialog opens.

Procedure

1. To add a new role, open the Role-Based Access Control submenu in the IPA Server tab and select Roles:

   

2. The list of roles opens. Click the Add button at the top of the list of the role-based access control instructions.

   

3. The Add Role form opens. Enter the role name and a description:

   

4. Click the Add and Edit button to save the new role and go to the role configuration page to add privileges and users.
5. Edit the properties of roles by clicking on the roles name in the role list. The roles configuration page opens.

6. Add members using the Users, Users Groups, Hosts, Host Groups or Services tabs, by clicking the Add button on top of the relevant list(s).

   

7. In the window that opens, select the members on the left and use the > button to move them to the Prospective column.

   

8. At the top of the Privileges tab, click Add.

   

9. Select the privileges on the left and use the > button to move them to the Prospective column.

   

10. Click the Add button to save.
11. Optional. If you need to remove privileges or members from a role, click the Delete button after you ticked the check box next to the name of the entity you want to remove. A dialog opens.
12. Optional. If you need to remove an existing role, click the Delete button after you ticked the check box next to its name in the list, to display the Remove roles dialog.