31.6. Managing IdM roles in the CLI

Procedure

1. Add new role entries using the ipa role-add command:

   $ ipa role-add --desc="User Administrator" useradmin
   ------------------------
   Added role "useradmin"
   ------------------------
   Role name: useradmin
   Description: User Administrator

2. Add the required privileges to the role using the ipa role-add-privilege command:

   $ ipa role-add-privilege --privileges="user administrators" useradmin
   Role name: useradmin
   Description: User Administrator
   Privileges: user administrators
   ----------------------------
   Number of privileges added 1
   ----------------------------

3. Add the required members to the role using the ipa role-add-member command. Allowed member types are: users, groups, hosts and hostgroups. For example, to add the group named useradmins to the previously created useradmin role:

   $ ipa role-add-member --groups=useradmins useradmin
   Role name: useradmin
   Description: User Administrator
   Member groups: useradmins
   Privileges: user administrators
   -------------------------
   Number of members added 1
   -------------------------