11장. Configuring IdM for external provisioning of users

Procedure

1. Log in as IdM administrator:

   $ kinit admin

2. Create a user named provisionator with the privileges to add stage users.

   1. Add the provisionator user account:

      $ ipa user-add provisionator --first=provisioning --last=account --password

   2. Grant the provisionator user the required privileges.

      1. Create a custom role, System Provisioning, to manage adding stage users:

         $ ipa role-add --desc "Responsible for provisioning stage users" "System Provisioning"

      2. Add the Stage User Provisioning privilege to the role. This privilege provides the ability to add stage users:

         $ ipa role-add-privilege "System Provisioning" --privileges="Stage User Provisioning"

      3. Add the provisionator user to the role:

         $ ipa role-add-member --users=provisionator "System Provisioning"

      4. Verify that the provisionator exists in IdM:

         $ ipa user-find provisionator --all --raw
         --------------
         1 user matched
         --------------
           dn: uid=provisionator,cn=users,cn=accounts,dc=idm,dc=example,dc=com
           uid: provisionator
           ...

3. Create a user, activator, with the privileges to manage user accounts.

   1. Add the activator user account:

      $ ipa user-add activator --first=activation --last=account --password

   2. Grant the activator user the required privileges by adding the user to the default User Administrator role:

      $ ipa role-add-member --users=activator "User Administrator"

4. Create a user group for application accounts:

   $ ipa group-add application-accounts

5. Update the password policy for the group. The following policy prevents password expiration and lockout for the account but compensates the potential risks by requiring complex passwords:

   $ ipa pwpolicy-add application-accounts --maxlife=10000 --minlife=0 --history=0 --minclasses=4 --minlength=8 --priority=1 --maxfail=0 --failinterval=1 --lockouttime=0

6. Optional: Verify that the password policy exists in IdM:

   $ ipa pwpolicy-show application-accounts
     Group: application-accounts
     Max lifetime (days): 10000
     Min lifetime (hours): 0
     History size: 0
   ...

7. Add the provisioning and activation accounts to the group for application accounts:

   $ ipa group-add-member application-accounts --users={provisionator,activator}

8. Change the passwords for the user accounts:

   $ kpasswd provisionator
   $ kpasswd activator

   Changing the passwords is necessary because new IdM users passwords expire immediately.