Buscar

Este contenido no está disponible en el idioma seleccionado.

27.2. Defining Self-Service Settings

download PDF
Self-service access control rules define the operations that an entity can perform on itself. These rules define only what attributes a user (or other IdM entity) can edit on their personal entries.
Three self-service rules exist by default:
  • A rule for editing some general attributes in the personal entry, including given name and surname, phone numbers, and addresses.
  • A rule to edit personal passwords, including two Samba passwords, the Kerberos password, and the general user password.
  • A rule to manage personal SSH keys.

27.2.1. Creating Self-Service Rules from the Web UI

  1. Open the IPA Server tab in the top menu, and select the Self Service Permissions subtab.
  2. Click the Add link at the top of the list of self-service ACIs.
  3. Enter the name of the rule in the pop-up window. Spaces are allowed.
  4. Select the checkboxes by the attributes which this ACI will permit users to edit.
  5. Click the Add button to save the new self-service ACI.

27.2.2. Creating Self-Service Rules from the Command Line

A new self-service rule can be added using the selfservice-add command. There are two required options, --permissions to set whether the ACI grants write, add, or delete permission and --attrs to give the full list of attributes which this ACI grants permission to.
$ ipa selfservice-add "Users can manage their own name details" --permissions=write --attrs=givenname,displayname,title,initials
-----------------------------------------------------------
Added selfservice "Users can manage their own name details"
-----------------------------------------------------------
    Self-service name: Users can manage their own name details
    Permissions: write
    Attributes: givenname, displayname, title, initials

27.2.3. Editing Self-Service Rules

In the self-service entry in the web UI, the only element that can be edited is the list of attributes that are included in the ACI. The checkboxes can be selected or deselected.
Self-Service Edit Page

Figure 27.1. Self-Service Edit Page

With the command line, self-service rules are edited using the ipa selfservice-mod command. The --attrs option overwrites whatever the previous list of supported attributes was, so always include the complete list of attributes along with any new attributes.
$ ipa selfservice-mod "Users can manage their own name details" --attrs=givenname,displayname,title,initials,surname
--------------------------------------------------------------
Modified selfservice "Users can manage their own name details"
--------------------------------------------------------------
Self-service name: Users can manage their own name details
Permissions: write
Attributes: givenname, displayname, title, initials

Important

Include all of the attributes when modifying a self-service rule, including existing ones.
Red Hat logoGithubRedditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

© 2024 Red Hat, Inc.