Chapter 19. Managing self-service rules in IdM using the CLI

Prerequisites

• Administrator privileges for managing IdM or the User Administrator role.
• An active Kerberos ticket. For details, see Using kinit to log in to IdM manually.

Procedure

• To add a self-service rule, use the ipa selfservice-add command and specify the following two options:

  --permissions

  sets the read and write permissions the Access Control Instruction (ACI) grants.

  --attrs

  sets the complete list of attributes to which this ACI grants permission.

  For example, to create a self-service rule allowing users to modify their own name details:

  $ ipa selfservice-add "Users can manage their own name details" --permissions=write --attrs=givenname --attrs=displayname --attrs=title --attrs=initials
  -----------------------------------------------------------
  Added selfservice "Users can manage their own name details"
  -----------------------------------------------------------
      Self-service name: Users can manage their own name details
      Permissions: write
      Attributes: givenname, displayname, title, initials

  Copy to Clipboard Toggle word wrap

Prerequisites

• Administrator privileges for managing IdM or the User Administrator role.
• An active Kerberos ticket. For details, see Using kinit to log in to IdM manually.

Verification

• Use the ipa selfservice-show command to display the self-service rule you edited.

  $ ipa selfservice-show "Users can manage their own name details"
  --------------------------------------------------------------
  Self-service name: Users can manage their own name details
  Permissions: write
  Attributes: givenname, displayname, title, initials

  Copy to Clipboard Toggle word wrap

Prerequisites

• Administrator privileges for managing IdM or the User Administrator role.
• An active Kerberos ticket. For details, see Using kinit to log in to IdM manually.

Procedure

• Use the ipa selfservice-del command to delete a self-service rule.

  For example:

  $ ipa selfservice-del "Users can manage their own name details"
  -----------------------------------------------------------
  Deleted selfservice "Users can manage their own name details"
  -----------------------------------------------------------

  Copy to Clipboard Toggle word wrap

Verification

• Use the ipa selfservice-find command to display all self-service rules. The rule you just deleted should be missing.