27.3. Delegating Permissions over Users
Delegation is very similar to roles in that one group of users is assigned permission to manage the entries for another group of users. However, the delegated authority is much more similar to self-service rules in that complete access is granted but only to specific user attributes, not to the entire entry. Also, the groups in delegated authority are existing IdM user groups instead of roles specifically created for access controls.
27.3.1. Delegating Access to User Groups in the Web UI
- Open the IPA Server tab in the top menu, and select the Delegations subtab.
- Click the Add link at the top of the list of delegation ACIs.
- Name the new delegation ACI.
- Set the permissions by selecting the checkboxes whether users will have the right to view the given attributes (read) and add or change the given attributes (write).Some users may have a need to see information, but should not be able to edit it.
- In the User group drop-down menu, select the group who is being granted permissions to the entries of users in the user group.
- In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.
- In the attributes box, select the checkboxes by the attributes to which the member user group is being granted permission.
- Click the Add button to save the new delegation ACI.
27.3.2. Delegating Access to User Groups in the Command Line
A new delegation access control rule is added using the
delegation-add command. There are three required arguments:
--group, the group who is being granted permissions to the entries of users in the user group.--membergroup, the group whose entries can be edited by members of the delegation group.--attrs, the attributes which users in the member group are allowed to edit.
For example:
$ ipa delegation-add "basic manager attrs" --attrs=manager,title,employeetype,employeenumber --group=engineering_managers --membergroup=engineering -------------------------------------- Added delegation "basic manager attrs" -------------------------------------- Delegation name: basic manager attrs Permissions: write Attributes: manager, title, employeetype, employeenumber Member user group: engineering User group: engineering_managers
Delegation rules are edited using the
delegation-mod command. The --attrs option overwrites whatever the previous list of supported attributes was, so always include the complete list of attributes along with any new attributes.
$ ipa delegation-mod "basic manager attrs" --attrs=manager,title,employeetype,employeenumber,displayname ----------------------------------------- Modified delegation "basic manager attrs" ----------------------------------------- Delegation name: basic manager attrs Permissions: write Attributes: manager, title, employeetype, employeenumber, displayname Member user group: engineering User group: engineering_managers
Important
Include all of the attributes when modifying a delegation rule, including existing ones.
