Chapter 27. Managing user groups in IdM Web UI
Manage user groups in Identity Management (IdM) using the Web UI to organize users with common privileges, password policies, and other characteristics. User groups simplify administration by applying policies to multiple users at once.
A user group is a set of users with common privileges, password policies, and other characteristics.
A user group in IdM can include:
- IdM users
- other IdM user groups
- external users, which are users that exist outside of IdM
27.1. Different group types in IdM Copy linkLink copied to clipboard!
Identity Management (IdM) supports three types of user groups—POSIX, non-POSIX, and external—each suited to different identity store integrations and Linux attribute requirements.
- POSIX groups (the default)
POSIX groups support Linux POSIX attributes for their members. Note that groups that interact with Active Directory cannot use POSIX attributes.
POSIX attributes identify users as separate entities. Examples of POSIX attributes relevant to users include
uidNumber, a user number (UID), andgidNumber, a group number (GID).- Non-POSIX groups
Non-POSIX groups do not support POSIX attributes. For example, these groups do not have a GID defined.
All members of this type of group must belong to the IdM domain.
- External groups
Use external groups to add group members that exist in an identity store outside of the IdM domain, such as:
- A local system
- An Active Directory domain
- A directory service
External groups do not support POSIX attributes. For example, these groups do not have a GID defined.
| Group name | Default group members |
|---|---|
|
| All IdM users |
|
|
Users with administrative privileges, including the default |
|
| This is a legacy group that no longer has any special privileges |
|
| Users with privileges to manage the Active Directory trusts |
When you add a user to a user group, the user gains the privileges and policies associated with the group. For example, to grant administrative privileges to a user, add the user to the admins group.
Do not delete the admins group. As admins is a pre-defined group required by IdM, this operation causes problems with certain commands.
In addition, IdM creates user private groups by default whenever a new user is created in IdM. For more information about private groups, see Adding users without a private group.
27.2. Direct and indirect group members Copy linkLink copied to clipboard!
You can manage group membership inheritance in Identity Management (IdM) by using direct and indirect members. Nested group structures simplify policy administration by automatically applying group attributes to all member levels.
User group attributes in IdM apply to both direct and indirect members: when group B is a member of group A, all users in group B are considered indirect members of group A.
For example, in the following diagram:
- User 1 and User 2 are direct members of group A.
- User 3, User 4, and User 5 are indirect members of group A.
Figure 27.1. Direct and Indirect Group Membership
If you set a password policy for user group A, the policy also applies to all users in user group B.
27.3. Adding a user group using IdM Web UI Copy linkLink copied to clipboard!
Create user groups in the Identity Management (IdM) Web UI to organize users and manage access control policies collectively. Groups simplify administration by allowing you to assign permissions and roles to multiple users at once.
Prerequisites
- You are logged in to the IdM Web UI.
Procedure
-
Click Identity
Groups, and select User Groups in the left sidebar. - Click Add to start adding the group.
Fill out the information about the group. For more information about user group types, see Different group types in IdM.
You can specify a custom GID for the group. If you do this, be careful to avoid ID conflicts. If you do not specify a custom GID, IdM automatically assigns a GID from the available ID range.
- Click Add to confirm.
27.4. Deleting a user group using IdM Web UI Copy linkLink copied to clipboard!
You can delete user groups using the Identity Management (IdM) WebUI. Deleting a group does not delete the group members from IdM.
Prerequisites
- You are logged in to the IdM Web UI.
Procedure
-
Click Identity
Groups and select User Groups. - Select the group to delete.
- Click Delete.
- Click Delete to confirm.
27.5. Adding a member to a user group using IdM Web UI Copy linkLink copied to clipboard!
Add users and user groups as members of a user group in the Identity Management (IdM) Web UI to organize permissions and access control efficiently. Group membership simplifies user management by applying policies to multiple users simultaneously.
Prerequisites
- You are logged in to the IdM Web UI.
Procedure
-
Click Identity
Groups and select User Groups in the left sidebar. - Click the name of the group.
- Select the type of group member you want to add: Users, User Groups, or External.
- Click Add.
- Select the checkbox next to one or more members you want to add.
- Click the right arrow to move the selected members to the group.
- Click Add to confirm.
27.6. Adding users or groups as member managers to an IdM user group using the Web UI Copy linkLink copied to clipboard!
Designate users or user groups as member managers using the Identity Management (IdM) Web UI to delegate user group membership management. Member managers can add or remove group members without having full administrative privileges.
Prerequisites
- You are logged in to the IdM Web UI.
- You must have the name of the user or group you are adding as member managers and the name of the group you want them to manage.
Procedure
-
Click Identity
Groups and select User Groups in the left sidebar. - Click the name of the group.
- Select the type of group member manager you want to add: Users or User Groups.
- Click Add.
- Select the checkbox next to one or more members you want to add.
- Click the right arrow to move the selected members to the group.
Click Add to confirm.
NoteAfter you add a member manager to a user group, the update may take some time to spread to all clients in your Identity Management environment.
Verification
Verify the newly added user or user group has been added to the member manager list of users or user groups:
27.7. Viewing group members using IdM Web UI Copy linkLink copied to clipboard!
View both direct and indirect members of an Identity Management (IdM) user group in the IdM Web UI to understand group membership inheritance across nested groups.
Prerequisites
- You are logged in to the IdM Web UI.
Procedure
-
Select Identity
Groups. - Select User Groups in the left sidebar.
- Click the name of the group you want to view.
- Switch between Direct Membership and Indirect Membership.
Additional resources
27.8. Removing a member from a user group using IdM Web UI Copy linkLink copied to clipboard!
Remove users, nested groups, or external members from an Identity Management (IdM) user group in the IdM Web UI to revoke their inherited group privileges.
Prerequisites
- You are logged in to the IdM Web UI.
Procedure
-
Click Identity
Groups and select User Groups in the left sidebar. - Click the name of the group.
- Select the type of group member you want to remove: Users, User Groups, or External.
- Select the checkbox next to the member you want to remove.
- Click Delete.
- Click Delete to confirm.
27.9. Removing users or groups as member managers from an IdM user group using the Web UI Copy linkLink copied to clipboard!
Remove users or groups as member managers from an Identity Management (IdM) user group by using the IdM Web UI to revoke their ability to manage group membership. Member managers can add and remove group members but cannot change the group’s attributes.
Prerequisites
- You are logged in to the IdM Web UI.
- You must have the name of the existing member manager user or group you are removing and the name of the group they are managing.
Procedure
-
Click Identity
Groups and select User Groups in the left sidebar. - Click the name of the group.
- Select the type of member manager you want to remove: Users or User Groups.
- Select the checkbox next to the member manager you want to remove.
- Click Delete.
Click Delete to confirm.
NoteAfter you remove a member manager from a user group, the update may take some time to spread to all clients in your Identity Management environment.
Verification
Verify the user or user group has been removed from the member manager list of users or user groups: