15.3. Delegating Permissions over Users

Delegation is very similar to roles in that one group of users is assigned permission to manage the entries for another group of users. However, the delegated authority is much more similar to self-service rules in that complete access is granted but only to specific user attributes, not to the entire entry. Also, the groups in delegated authority are existing IPA user groups instead of roles specifically created for access controls.

15.3.1. Delegating Access to User Groups in the Web UI

Open the IPA Server tab in the top menu, and select the Delegations subtab.
Click the Add link at the top of the list of delegation ACIs.
Name the new delegation ACI.
In the User group drop-down menu, select the group whose entries can be edited by members of the delegation group.
In the Member user group drop-down menu, select the group who is being granted permissions to the entries of users in the user group.
In the attributes box, select the checkboxes by the attributes to which the member user group is being granted permission.
Click the Add button to save the new delegation ACI.

15.3.2. Delegating Access to User Groups in the Command Line

A new delegation access control rule is added using the delegation-add command. There are three required arguments:

--group, the group who is being granted permissions to the entries of users in the user group.
--membergroup, the group whose entries can be edited by members of the delegation group.
--attrs, the attributes which users in the member group are allowed to edit.

For example:

$ ipa delegation-add "basic manager attrs" --attrs=manager,title,employeetype,employeenumber --group=engineering_managers --membergroup=engineering
--------------------------------------
Added delegation "basic manager attrs"
--------------------------------------
  Delegation name: basic manager attrs
  Permissions: write
  Attributes: manager, title, employeetype, employeenumber
  Member user group: engineering
  User group: engineering_managers

Delegation rules are edited using the delegation-mod command. The --attrs option overwrites whatever the previous list of supported attributes was, so always include the complete list of attributes along with any new attributes.

$ ipa delegation-mod "basic manager attrs" --attrs=manager,title,employeetype,employeenumber,displayname
-----------------------------------------
Modified delegation "basic manager attrs"
-----------------------------------------
  Delegation name: basic manager attrs
  Permissions: write
  Attributes: manager, title, employeetype, employeenumber, displayname
  Member user group: engineering
  User group: engineering_managers

IMPORTANT

Include all of the attributes when modifying a delegation rule, including existing ones.