Chapter 20. Managing self-service rules using the IdM Web UI


Learn about self-service rules in Identity Management (IdM) and how to create and edit self-service access rules in the web interface (IdM Web UI).

20.1. Self-service access control in IdM

Self-service access control rules define which operations an Identity Management (IdM) entity can perform on its IdM Directory Server entry: for example, IdM users have the ability to update their own passwords.

This method of control allows an authenticated IdM entity to edit specific attributes within its LDAP entry, but does not allow add or delete operations on the entire entry.

Warning

Be careful when working with self-service access control rules: configuring access control rules improperly can inadvertently elevate an entity’s privileges.

20.2. Creating self-service rules using the IdM Web UI

Follow this procedure to create self-service access rules in IdM using the web interface (IdM Web UI).

Prerequisites

Procedure

  1. Open the IPA Server>Role-Based Access Control menu and select Self Service Permissions.
  2. Click Add at the upper-right of the list of the self-service access rules.
  3. On the Add Self Service Permission window, enter the name of the new self-service rule in the Self-service name field. Spaces are allowed.
  4. Select the checkboxes next to the attributes you want users to be able to edit.
  5. Optional: If an attribute you want to provide access to is not listed, you can add a listing for it:

    1. Click the Add button.
    2. On the Add Custom Attribute window, enter the attribute name in the Attribute text field.
    3. Click the OK button to add the attribute.
    4. Verify that the new attribute is selected.
  6. Click the Add button at the bottom of the form to save the new self-service rule.

    Alternatively, you can save and continue editing the self-service rule by clicking the Add and Edit button, or save and add further rules by clicking the Add and Add another button.

20.3. Editing self-service rules using the IdM Web UI

Follow this procedure to edit self-service access rules in IdM using the web interface (IdM Web UI).

Prerequisites

Procedure

  1. Open the IPA Server>Role-Based Access Control menu and select Self Service Permissions.
  2. Click on the name of the self-service rule you want to modify.
  3. The edit page only allows you to edit the list of attributes to you want to add or remove to the self-service rule. Select or deselect the appropriate checkboxes.
  4. Click the Save button to save your changes to the self-service rule.

20.4. Deleting self-service rules using the IdM Web UI

Follow this procedure to delete self-service access rules in IdM using the web interface (IdM Web UI).

Prerequisites

Procedure

  1. Open the IPA Server>Role-Based Access Control menu and select Self Service Permissions.
  2. Select the checkbox next to the rule you want to delete, then click on the Delete button on the right of the list.
  3. A dialog opens, click on Delete to confirm.
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat