Chapter 30. Delegating permissions to user groups to manage users using IdM WebUI

Procedure

1. From the IPA Server>Role-Based Access Control menu, click Delegations.
2. Click Add.

3. On the Add delegation window, do the following:

   1. Name the new delegation rule.
   2. Set the permissions by selecting the checkboxes that indicate whether users will have the right to view the given attributes (read) and add or change the given attributes (write).
   3. From the User group drop-down menu, select the group who is being granted permissions to view or edit the entries of users in the member group.
   4. On the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.
   5. In the attributes box, select the checkboxes by the attributes to which you want to grant permissions.
   6. Click the Add button to save the new delegation rule.

Procedure

1. From the IPA Server>Role-Based Access Control menu, click Delegations.
2. Click the rule you want to modify.

3. Make the desired changes:

   • Change the name of the rule.
   • Change granted permissions by selecting the checkboxes that indicate whether users will have the right to view the given attributes (read) and add or change the given attributes (write).
   • In the User group drop-down menu, select the group who is being granted permissions to view or edit the entries of users in the member group.
   • In the Member user group drop-down menu, select the group whose entries can be edited by members of the delegation group.
   • In the attributes box, select the checkboxes by the attributes to which you want to grant permissions. To remove permissions to an attribute, uncheck the relevant checkbox.
   • Click the Save button to save the changes.

Procedure

1. From the IPA Server>Role-Based Access Control menu, click Delegations.
2. Select the checkbox next to the rule you want to remove.
3. Click Delete.
4. Click Delete to confirm.