Chapter 30. Delegating permissions to user groups to manage users using IdM WebUI

Procedure

1. From the IPA Server menu, click Role-Based Access Control Delegations.

2. Click Add.

   

3. In the Add delegation window, do the following:

   1. Name the new delegation rule.
   2. Set the permissions by selecting the check boxes that indicate whether users will have the right to view the given attributes (read) and add or change the given attributes (write).
   3. In the User group drop-down menu, select the group who is being granted permissions to view or edit the entries of users in the member group.
   4. In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.

   5. In the attributes box, select the check boxes by the attributes to which you want to grant permissions.

      
   6. Click the Add button to save the new delegation rule.

Procedure

1. From the IPA Server menu, click Role-Based Access Control Delegations.

   
2. Click on the rule you want to modify.

3. Make the desired changes:

   • Change the name of the rule.
   • Change granted permissions by selecting the check boxes that indicate whether users will have the right to view the given attributes (read) and add or change the given attributes (write).
   • In the User group drop-down menu, select the group who is being granted permissions to view or edit the entries of users in the member group.
   • In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.

   • In the attributes box, select the check boxes by the attributes to which you want to grant permissions. To remove permissions to an attribute, uncheck the relevant check box.

     
   • Click the Save button to save the changes.

Procedure

1. From the IPA Server menu, click Role-Based Access Control Delegations.
2. Select the check box next to the rule you want to remove.

3. Click Delete.

   
4. Click Delete to confirm.