Chapter 33. Managing role-based access controls in IdM using the CLI

Procedure

1. Create new permission entries with the ipa permission-add command. For example, to add a permission named dns admin:

   $ ipa permission-add "dns admin"

2. Specify the properties of the permission with the following options:

   • --bindtype specifies the bind rule type. This option accepts the all, anonymous, and permission arguments. The permission bindtype means that only the users who are granted this permission via a role can exercise it.

     For example:

     $ ipa permission-add "dns admin" --bindtype=all

     If you do not specify --bindtype, then permission is the default value.

     Note

     It is not possible to add permissions with a non-default bind rule type to privileges. You also cannot set a permission that is already present in a privilege to a non-default bind rule type.

   • --right lists the rights granted by the permission, it replaces the deprecated --permissions option. The available values are add, delete, read, search, compare, write, all.

     You can set multiple attributes by using multiple --right options or with a comma-separated list inside curly braces. For example:

     $ ipa permission-add "dns admin" --right=read --right=write
     $ ipa permission-add "dns admin" --right={read,write}

     Note

     add and delete are entry-level operations (for example, deleting a user, adding a group, and so on) while read, search, compare and write are more attribute-level: you can write to userCertificate but not read userPassword.

   • --attrs gives the list of attributes over which the permission is granted.

     You can set multiple attributes by using multiple --attrs options or by listing the options in a comma-separated list inside curly braces. For example:

     $ ipa permission-add "dns admin" --attrs=description --attrs=automountKey
     $ ipa permission-add "dns admin" --attrs={description,automountKey}

     The attributes provided with --attrs must exist and be allowed attributes for the given object type, otherwise the command fails with schema syntax errors.

   • --type defines the entry object type to which the permission applies, such as user, host, or service. Each type has its own set of allowed attributes. For example:

     $ ipa permission-add "manage service" --right=all --type=service --attrs=krbprincipalkey --attrs=krbprincipalname --attrs=managedby

   • --subtree gives a subtree entry; the filter then targets every entry beneath this subtree entry. Provide an existing subtree entry; --subtree does not accept wildcards or non-existent domain names (DNs). Include a DN within the directory.

     Because IdM uses a simplified, flat directory tree structure, --subtree can be used to target some types of entries, like automount locations, which are containers or parent entries for other configuration. For example:

     $ ipa permission-add "manage automount locations" --subtree="ldap://ldap.example.com:389/cn=automount,dc=example,dc=com" --right=write --attrs=automountmapname --attrs=automountkey --attrs=automountInformation

     Note

     The --type and --subtree options are mutually exclusive: you can see the inclusion of filters for --type as a simplification of --subtree, intending to make life easier for an admin.

   • --filter uses an LDAP filter to identify which entries the permission applies to.

     IdM automatically checks the validity of the given filter. The filter can be any valid LDAP filter, for example:

     $ ipa permission-add "manage Windows groups" --filter="(!(objectclass=posixgroup))" --right=write --attrs=description

   • --memberof sets the target filter to members of the given group after checking that the group exists. For example, to let the users with this permission modify the login shell of members of the engineers group:

     $ ipa permission-add ManageShell --right="write" --type=user --attr=loginshell --memberof=engineers

     Note

     Setting the memberof attribute permission is not applied if the target LDAP entry does not contain any reference to group membership.

   • --targetgroup sets target to the specified user group after checking that the group exists. For example, to let those with the permission write the member attribute in the engineers group (so they can add or remove members):

     $ ipa permission-add ManageMembers --right="write" --subtree=cn=groups,cn=accounts,dc=example,dc=test --attr=member --targetgroup=engineers

   • Optionally, you can specify a target domain name (DN):

     • --target specifies the DN to apply the permission to. Wildcards are accepted.
     • --targetto specifies the DN subtree where an entry can be moved to.
     • --targetfrom specifies the DN subtree from where an entry can be moved.

Procedure

1. Add privilege entries using the ipa privilege-add command

   For example, to add a privilege named managing filesystems with a description:

   $ ipa privilege-add "managing filesystems" --desc="for filesystems"

2. Assign the required permissions to the privilege group with the privilege-add-permission command

   For example, to add the permissions named managing automount and managing ftp services to the managing filesystems privilege:

   $ ipa privilege-add-permission "managing filesystems" --permissions="managing automount" --permissions="managing ftp services"

Procedure

1. Add new role entries using the ipa role-add command:

   $ ipa role-add --desc="User Administrator" useradmin
   ------------------------
   Added role "useradmin"
   ------------------------
   Role name: useradmin
   Description: User Administrator

2. Add the required privileges to the role using the ipa role-add-privilege command:

   $ ipa role-add-privilege --privileges="user administrators" useradmin
   Role name: useradmin
   Description: User Administrator
   Privileges: user administrators
   ----------------------------
   Number of privileges added 1
   ----------------------------

3. Add the required members to the role using the ipa role-add-member command. Allowed member types are: users, groups, hosts and hostgroups. For example, to add the group named useradmins to the previously created useradmin role:

   $ ipa role-add-member --groups=useradmins useradmin
   Role name: useradmin
   Description: User Administrator
   Member groups: useradmins
   Privileges: user administrators
   -------------------------
   Number of members added 1
   -------------------------