Chapter 5. Managing Users and Roles

To Create a User:

1. Navigate to Administer > Users.
2. Click Create User.
3. In the Username field, enter the user name for this user to log in to the web UI.
4. In the First name and Surname fields, enter the real first name and surname of the user.
5. In the Email address field, enter the user’s email address.
6. In the Description field, insert a description of the new user.
7. Optionally, select a specific language for the user from the Language drop-down menu. The default is to attempt to use the language settings of the user’s browser.
8. Optionally, select a specific time zone for the user from the Timezone drop-down menu. The default is to use the time zone settings of the user’s browser.

9. Set a password for the user:

   • From the Authorized by drop-down menu, select the source by which the user is authenticated. You can select INTERNAL to enable the user to be managed inside Satellite Server, or configure an external authentication, such as LDAP or IdM as described in Chapter 11, Configuring External Authentication.
   • Enter an initial password for the user in the Password field and verify it in the Verify field.
10. Click Submit to create the user.
11. Select the user name to continue configuring the user.
12. On the Email Preferences tab, select the Mail enabled check box to enable email notifications for the user. Depending on the roles assigned, notifications options can be configured here.
13. On the Locations tab, select locations to be made accessible for this user. If you assign multiple locations to the user, you can select the default location for user login from the Default on login drop-down menu. Otherwise, when the user logs in, the location selection is set to Any Location.
14. On the Organizations tab, select organizations to be made accessible to this user. If you assign multiple organizations to the user, you can select the default organization for user login from the Default on login drop-down menu. Otherwise, when the user logs in, the organization selection is set to Any Organization.
15. On the Roles tab, select the required roles for this user.
16. On the SSH Keys tab you can add SSH public keys but not until the user has been saved.
17. Click Submit to save the changes.

To Edit an Existing User:

1. Navigate to Administer > Users.
2. Click the user name of the user to be altered. General information about the user appears on the right.
3. In the User tab, you can modify the user’s user name, first name, surname, email address, default location, default organization, language, and password.
4. In the Locations tab, you can modify the user’s assigned locations.
5. In the Organizations tab, you can modify the user’s assigned organizations.
6. In the Roles tab, you can modify the user’s assigned roles.
7. Click Save to save your changes.

To Assign a Role to a User:

1. Navigate to Administer > Users. If a user account created is not listed, check that you are currently viewing the right organization. To list all users in Satellite, click Default Organization and then Any Organization. The organization view is changed to Any Context.
2. Click the user name of the user that you want to modify. General information about the user appears on the right.
3. Click the Locations tab, and select a location if none is assigned.
4. Click the Organizations tab, and check that an organization is assigned.
5. Click the Roles tab to display the list of available role assignments.
6. Select role you want to assign to the user in the Roles list. The list contains the predefined roles, as well as any custom roles, see Table 5.1, “Predefined Roles Available in Red Hat Satellite”. Alternatively, select the Administrator check box to assign all available permissions to the selected user.
7. Click Save.

To Add SSH Keys to a User:

1. Prepare the content of the public SSH key in a clipboard.
2. Navigate to Administer > Users.
3. From the Username column, click on the username.
4. Select the SSH Keys tab.
5. Click Create SSH Key.
6. In the Key field, paste the content of the public SSH key.
7. In the Name field, enter a name for the SSH key.
8. Click Submit. A confirmation notification is displayed if your key submission was successful.

To Delete SSH Keys from a User:

1. Log in to the Satellite web UI as Admin or as a user with the destroy_ssh_key permission enabled.
2. Navigate to Administer > Users.
3. Click on the username from the Username column.
4. Select the SSH Keys tab.
5. Click Delete on the row of the SSH key to be deleted.
6. Click OK in the confirmation prompt. A confirmation appears to indicate the deletion was successful.

To Configure Email Notifications:

1. Navigate to Administer > Users.
2. Click the Username of the user you want to edit.
3. On the User tab, check the Email address field. Ensure that it contains a valid email address. The address is associated with the user account, and the notifications selected in the following steps are sent there.
4. Click the Email Preferences tab and select Mail enabled to enable email notifications.

5. Select the notifications you want the user to receive.

   • Audit summary is a summary of all activity audited by the Satellite Server. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates. Enter a query in the associated query field to narrow the audit activity included.
   • Host built is a notification sent when a host is built. To enable these notifications, select Subscribe from the drop-down menu.
   • Host errata advisory is a summary of applicable and installable errata for hosts managed by the user. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • OpenSCAP policy summary is a summary of OpenSCAP policy reports and their results. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • Promote errata is a notification sent only after a Content View promotion. It contains a summary of errata applicable and installable to hosts registered to the promoted Content View. This allows you to monitor what updates have been applied to which hosts. To enable these notifications, select Subscribe from the drop-down menu.
   • Puppet error state is a notification sent after a host reports an error related to Puppet. To enable these notifications, select Subscribe from the drop-down menu.
   • Puppet summary is a summary of Puppet reports. To enable these notifications, select the frequency of emails from the drop-down list that offers Daily, Weekly, or Monthly updates.
   • Sync errata is a notification sent only after synchronizing a repository. It contains a summary of new errata introduced by the synchronization. To enable these notifications, select Subscribe from the drop-down menu.
6. Click Submit.

To Remove a User:

1. On the main menu, click Administer > Users to open the Users page.
2. Click the Delete link to the right of the user name you want to delete.
3. In the alert box, click OK to delete the user.

To Create a User Group:

1. Navigate to Administer > User groups.
2. Click Create User Group.

3. On the User group tab, specify the name of the new user group and select group members:

   • Select the previously created user groups from the User Groups list.
   • Select users from the Users list.
4. On the Roles tab, select the roles you want to assign to the user group. Alternatively, select the Administrator check box to assign all available permissions.
5. Click Submit.

To Remove a User Group:

1. Navigate to Administer > User groups.
2. Click Delete to the right of the user group you want to delete.
3. In the alert box that appears, click OK to delete a user group.

To Create a Role:

1. Navigate to Administer > Roles.
2. Click New Role.
3. Provide a Name for the role.
4. Click Submit to save your new role.

To Add Permissions to a Role:

1. Navigate to Administer > Roles.
2. Select Add Filter from the drop-down list to the right of the required role.
3. Select the Resource type from the drop-down list. The (Miscellaneous) group gathers permissions that are not associated with any resource group.
4. Click the permissions you want to select from the Permission list.
5. Depending on the Resource type selected, you can select or deselect the Unlimited and Override check box. The Unlimited checkbox is selected by default, which means that the permission is applied on all resources of the selected type. When you disable the Unlimited check box, the Search field activates. In this field you can specify further filtering with use of the Red Hat Satellite 6 search syntax. See Section 5.4, “Granular Permission Filtering” for details. When you enable the Override check box, you can add additional locations and organizations to allow the role to access the resource type in the additional locations and organizations; you can also remove an already associated location and organization from the resource type to restrict access.
6. Click Next.
7. Click Submit to save changes.

To View Permissions Associated with a Role:

1. Navigate to Administer > Roles.
2. Click Filters to the right of the required role to get to the Filters page.

To Create a Complete Permission Table:

1. Ensure that the required packages are installed. Execute the following command on the Satellite Server:

   # yum install tfm-rubygem-foreman*

2. Start the Satellite console with the following command:

   # foreman-rake console

   Insert the following code into the console:

   f = File.open('/tmp/table.html', 'w')
   
   result = Foreman::AccessControl.permissions {|a,b| a.security_block <=> b.security_block}.collect do |p|
   
         actions = p.actions.collect { |a| "<li>#{a}</li>" }
         "<tr><td>#{p.name}</td><td><ul>#{actions.join('')}</ul></td><td>#{p.resource_type}</td></tr>"
   end.join("\n")
   
   f.write(result)

   The above syntax creates a table of permissions and saves it to the /tmp/table.html file.

3. Press Ctrl + D to exit the Satellite console. Insert the following text at the first line of /tmp/table.html:

   <table border="1"><tr><td>Permission name</td><td>Actions</td><td>Resource type</td></tr>

   Append the following text at the end of /tmp/table.html:

   </table>

4. Open /tmp/table.html in a web browser to view the table.

To Remove a Role:

1. Navigate to Administer > Roles.
2. Select Delete from the drop-down list to the right of the role to be deleted.
3. In an alert box that appears, click OK to delete the role.