Chapter 48. Enabling AD users to administer IdM

Procedure

1. As an IdM administrator, create an ID override for an AD user in the Default Trust View. For example, to create an ID override for the user ad_user@ad.example.com:

   # kinit admin
   # ipa idoverrideuser-add 'default trust view' ad_user@ad.example.com

2. Add the ID override from the Default Trust View as a member of an IdM group. This must be a non-POSIX group, as it interacts with Active Directory.

   If the group in question is a member of an IdM role, the AD user represented by the ID override gains all permissions granted by the role when using the IdM API, including both the command line interface and the IdM web UI.

   For example, to add the ID override for the ad_user@ad.example.com user to the IdM admins group:

   # ipa group-add-member admins --idoverrideusers=ad_user@ad.example.com

3. Alternatively, you can add the ID override to a role, such as the User Administrator role:

   # ipa role-add-member 'User Administrator' --idoverrideusers=ad_user@ad.example.com

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create an add-useridoverride-to-group.yml playbook with the following content:

   ---
   - name: Playbook to ensure presence of users in a group
     hosts: ipaserver
   
   
     - name: Ensure the ad_user@ad.example.com user ID override is a member of the admins group:
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: admins
         idoverrideuser:
         - ad_user@ad.example.com

   In the example:

   • Secret123 is the IdM admin password.
   • admins is the name of the IdM POSIX group to which you are adding the ad_user@ad.example.com ID override. Members of this group have full administrator privileges.
   • ad_user@ad.example.com is the user ID override of an AD administrator. The user is stored in the AD domain with which a trust has been established.
3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-useridoverride-to-group.yml

1. Destroy the current Kerberos ticket of the IdM administrator:

   # kdestroy -A

   Note

   The destruction of the Kerberos ticket is required because the GSSAPI implementation in MIT Kerberos chooses credentials from the realm of the target service by preference, which in this case is the IdM realm. This means that if a credentials cache collection, namely the KCM:, KEYRING:, or DIR: type of credentials cache is in use, a previously obtained admin or any other IdM principal’s credentials will be used to access the IdM API instead of the AD user’s credentials.

2. Obtain the Kerberos credentials of the AD user for whom an ID override has been created:

   # kinit ad_user@AD.EXAMPLE.COM
   Password for ad_user@AD.EXAMPLE.COM:

3. Test that the ID override of the AD user enjoys the same privileges stemming from membership in the IdM group as any IdM user in that group. If the ID override of the AD user has been added to the admins group, the AD user can, for example, create groups in IdM:

   # ipa group-add some-new-group
   ----------------------------
   Added group "some-new-group"
   ----------------------------
     Group name: some-new-group
     GID: 1997000011