Red Hat SummitEste conteúdo não está disponível no idioma selecionado.
Chapter 30. Delegating permissions to user groups to manage users using IdM CLI
Delegation is one of the access control methods in Identity Management (IdM), along with self-service rules and role-based access control (RBAC). You can use delegation to assign permissions to one group of users to manage entries for another group of users.
30.1. Delegation rules
You can delegate permissions to user groups to manage users by creating delegation rules in Identity Management (IdM).
Delegation rules allow a specific user group to perform write (edit) operations on specific attributes for users in another user group. This form of access control rule is limited to editing the values of a subset of attributes you specify in a delegation rule; it does not grant the ability to add or remove whole entries or control over unspecified attributes.
Delegation rules grant permissions to existing user groups in IdM. You can use delegation to, for example, allow the managers user group to manage selected attributes of users in the employees user group.
30.2. Creating a delegation rule using IdM CLI
Create delegation rules using the Identity Management (IdM) CLI to grant specific user groups permission to manage other users. You can distribute administrative tasks across your organization while maintaining centralized oversight.
Prerequisites
-
You are logged in as a member of the
adminsgroup.
Procedure
Enter the
ipa delegation-addcommand. Specify the following options:-
--group: the group who is being granted permissions to the entries of users in the user group. -
--membergroup: the group whose entries can be edited by members of the delegation group. -
--permissions: whether users will have the right to view the given attributes (read) and add or change the given attributes (write). If you do not specify permissions, only the write permission will be added. --attrs: the attributes which users in the member group are allowed to view or edit.For example:
$ ipa delegation-add "basic manager attributes" --permissions=read --permissions=write --attrs=businesscategory --attrs=departmentnumber --attrs=employeetype --attrs=employeenumber --group=managers --membergroup=employees ------------------------------------------- Added delegation "basic manager attributes" ------------------------------------------- Delegation name: basic manager attributes Permissions: read, write Attributes: businesscategory, departmentnumber, employeetype, employeenumber Member user group: employees User group: managers-
30.3. Viewing existing delegation rules using IdM CLI
View delegation rules by using the Identity Management (IdM) CLI to review which user groups have permissions to modify attributes of other groups.
Prerequisites
-
You are logged in as a member of the
adminsgroup.
Procedure
Enter the
ipa delegation-findcommand:$ ipa delegation-find -------------------- 1 delegation matched -------------------- Delegation name: basic manager attributes Permissions: read, write Attributes: businesscategory, departmentnumber, employeenumber, employeetype Member user group: employees User group: managers ---------------------------- Number of entries returned 1 ----------------------------
30.4. Modifying a delegation rule using IdM CLI
Update delegation rules using the Identity Management (IdM) CLI to adjust which groups can manage which attributes of a target group.
The --attrs option overwrites whatever the previous list of supported attributes was, so always include the complete list of attributes along with any new attributes. This also applies to the --permissions option.
Prerequisites
-
You are logged in as a member of the
adminsgroup.
Procedure
Enter the
ipa delegation-modcommand with the desired changes. For example, to add thedisplaynameattribute to thebasic manager attributesexample rule:$ ipa delegation-mod "basic manager attributes" --attrs=businesscategory --attrs=departmentnumber --attrs=employeetype --attrs=employeenumber --attrs=displayname ---------------------------------------------- Modified delegation "basic manager attributes" ---------------------------------------------- Delegation name: basic manager attributes Permissions: read, write Attributes: businesscategory, departmentnumber, employeetype, employeenumber, displayname Member user group: employees User group: managers
30.5. Deleting a delegation rule using IdM CLI
Delete delegation rules using the Identity Management (IdM) CLI to revoke user group permissions for managing other users. Removing unnecessary delegation rules helps maintain proper access control.
Prerequisites
-
You are logged in as a member of the
adminsgroup.
Procedure
-
Enter the
ipa delegation-delcommand. When prompted, enter the name of the delegation rule you want to delete:
$ ipa delegation-del Delegation name: basic manager attributes --------------------------------------------- Deleted delegation "basic manager attributes" ---------------------------------------------
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}