Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

6.9.6. Configure Group Role Assignment using the Management CLI

Groups to be included or excluded from a role can be configured in the Management Console and the Management CLI. This topic only shows using the Management CLI.
The configuration of mapping users and groups to roles is located in the management API at: /core-service=management/access=authorization as role-mapping elements.
Only users in the SuperUser or Administrator roles can perform this configuration.
For easier access to the commands, in the Management CLI change to the /core-service=management/access=authorization location: 
[standalone@localhost:9999] cd /core-service=management/access=authorization
Copy to Clipboard Toggle word wrap

Procedure 6.16. Viewing Group Role Assignment Configuration

  1. Use the read-children-names operation to get a complete list of the configured roles: 
    /core-service=management/access=authorization:read-children-names(child-type=role-mapping)
    Copy to Clipboard Toggle word wrap 
    [standalone@localhost:9999 access=authorization] :read-children-names(child-type=role-mapping)
{
    "outcome" => "success",
    "result" => [
        "Administrator",
        "Deployer",
        "Maintainer",
        "Monitor",
        "Operator",
        "SuperUser"
    ]
}
    Copy to Clipboard Toggle word wrap
  2. Use the read-resource operation of a specified role-mapping to get the full details of a specific role: 
    /core-service=management/access=authorization/role-mapping=ROLENAME:read-resource(recursive=true)
    Copy to Clipboard Toggle word wrap 
    [standalone@localhost:9999 access=authorization] ./role-mapping=Administrator:read-resource(recursive=true)
{
    "outcome" => "success",
    "result" => {
        "include-all" => false,
        "exclude" => undefined,
        "include" => {
            "user-theboss" => {
                "name" => "theboss",
                "realm" => undefined,
                "type" => "USER"
            },
            "user-harold" => {
                "name" => "harold",
                "realm" => undefined,
                "type" => "USER"
            },
            "group-SysOps" => {
                "name" => "SysOps",
                "realm" => undefined,
                "type" => "GROUP"
            }
        }
    }
}
[standalone@localhost:9999 access=authorization]
    Copy to Clipboard Toggle word wrap

Procedure 6.17. Add a new role

This procedure shows how to add a role-mapping entry for a role. This must be done before the role can be configured.
  • Use the add operation to add a new role configuration. 
    /core-service=management/access=authorization/role-mapping=ROLENAME:add
    Copy to Clipboard Toggle word wrap 
    [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor:add             
{"outcome" => "success"}
[standalone@localhost:9999 access=authorization]
    Copy to Clipboard Toggle word wrap

Procedure 6.18. Add a Group as included in a role

This procedure shows how to add a Group to the included list of a role.
If no configuration for a role has been done, then a role-mapping entry for it must be done first.
  • Use the add operation to add a Group entry to the includes list of the role. 
    /core-service=management/access=authorization/role-mapping=ROLENAME/include=ALIAS:add(name=GROUPNAME, type=GROUP)
    Copy to Clipboard Toggle word wrap
    ROLENAME is the name of the role being configured.
    GROUPNAME is the name of the group being added to the include list.
    ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME. 
    [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/include=group-investigators:add(name=investigators, type=GROUP)
{"outcome" => "success"}
[standalone@localhost:9999 access=authorization]
    Copy to Clipboard Toggle word wrap

Procedure 6.19. Add a group as excluded in a role

This procedure shows how to add a group to the excluded list of a role.
If no configuration for a role has been done, then a role-mapping entry for it must be created first.
  • Use the add operation to add a group entry to the excludes list of the role. 
    /core-service=management/access=authorization/role-mapping=ROLENAME/exclude=ALIAS:add(name=GROUPNAME, type=GROUP)
    Copy to Clipboard Toggle word wrap
    ROLENAME is the name of the role being configured
    GROUPNAME is the name of the group being added to the include list
    ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME. 
    [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/exclude=group-supervisors:add(name=supervisors, type=GROUP)
{"outcome" => "success"}
[standalone@localhost:9999 access=authorization]
    Copy to Clipboard Toggle word wrap

Procedure 6.20. Remove group role include configuration

This procedure shows how to remove a group include entry from a role mapping.
  • Use the remove operation to remove the entry. 
    /core-service=management/access=authorization/role-mapping=ROLENAME/include=ALIAS:remove
    Copy to Clipboard Toggle word wrap
    ROLENAME is the name of the role being configured
    ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME. 
    [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/include=group-investigators:remove
{"outcome" => "success"}
[standalone@localhost:9999 access=authorization]
    Copy to Clipboard Toggle word wrap
    Removing the group from the list of includes does not remove the group from the system, nor does it guarantee that the role won't be assigned to users in this group. The role might still be assigned to users in the group individually.

Procedure 6.21. Remove a user group exclude entry

This procedure shows how to remove a group exclude entry from a role mapping.
  • Use the remove operation to remove the entry. 
    /core-service=management/access=authorization/role-mapping=ROLENAME/exclude=ALIAS:remove
    Copy to Clipboard Toggle word wrap
    ROLENAME is the name of the role being configured.
    ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME. 
    [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/exclude=group-supervisors:remove
{"outcome" => "success"}
[standalone@localhost:9999 access=authorization]
    Copy to Clipboard Toggle word wrap
    Removing the group from the list of excludes does not remove the group from the system. It also does not guarantee the role will be assigned to members of the group. Roles might still be excluded based on group membership.
Report a bug
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat