6.9.6. Configure Group Role Assignment using the Management CLI

Procedure 6.16. Viewing Group Role Assignment Configuration

1. Use the read-children-names operation to get a complete list of the configured roles:

   /core-service=management/access=authorization:read-children-names(child-type=role-mapping)

   [standalone@localhost:9999 access=authorization] :read-children-names(child-type=role-mapping)
   {
       "outcome" => "success",
       "result" => [
           "Administrator",
           "Deployer",
           "Maintainer",
           "Monitor",
           "Operator",
           "SuperUser"
       ]
   }
   

2. Use the read-resource operation of a specified role-mapping to get the full details of a specific role:

   /core-service=management/access=authorization/role-mapping=ROLENAME:read-resource(recursive=true)

   [standalone@localhost:9999 access=authorization] ./role-mapping=Administrator:read-resource(recursive=true)
   {
       "outcome" => "success",
       "result" => {
           "include-all" => false,
           "exclude" => undefined,
           "include" => {
               "user-theboss" => {
                   "name" => "theboss",
                   "realm" => undefined,
                   "type" => "USER"
               },
               "user-harold" => {
                   "name" => "harold",
                   "realm" => undefined,
                   "type" => "USER"
               },
               "group-SysOps" => {
                   "name" => "SysOps",
                   "realm" => undefined,
                   "type" => "GROUP"
               }
           }
       }
   }
   [standalone@localhost:9999 access=authorization]
   

Procedure 6.17. Add a new role

• Use the add operation to add a new role configuration.

  /core-service=management/access=authorization/role-mapping=ROLENAME:add

  [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor:add             
  {"outcome" => "success"}
  [standalone@localhost:9999 access=authorization]
  

Procedure 6.18. Add a Group as included in a role

• Use the add operation to add a Group entry to the includes list of the role.

  /core-service=management/access=authorization/role-mapping=ROLENAME/include=ALIAS:add(name=GROUPNAME, type=GROUP)

  ROLENAME is the name of the role being configured.
  GROUPNAME is the name of the group being added to the include list.
  ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME.

  [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/include=group-investigators:add(name=investigators, type=GROUP)
  {"outcome" => "success"}
  [standalone@localhost:9999 access=authorization]
  

Procedure 6.19. Add a group as excluded in a role

• Use the add operation to add a group entry to the excludes list of the role.

  /core-service=management/access=authorization/role-mapping=ROLENAME/exclude=ALIAS:add(name=GROUPNAME, type=GROUP)

  ROLENAME is the name of the role being configured
  GROUPNAME is the name of the group being added to the include list
  ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME.

  [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/exclude=group-supervisors:add(name=supervisors, type=GROUP)
  {"outcome" => "success"}
  [standalone@localhost:9999 access=authorization]
  

Procedure 6.20. Remove group role include configuration

• Use the remove operation to remove the entry.

  /core-service=management/access=authorization/role-mapping=ROLENAME/include=ALIAS:remove

  ROLENAME is the name of the role being configured
  ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME.

  [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/include=group-investigators:remove
  {"outcome" => "success"}
  [standalone@localhost:9999 access=authorization]
  

  Removing the group from the list of includes does not remove the group from the system, nor does it guarantee that the role won't be assigned to users in this group. The role might still be assigned to users in the group individually.

Procedure 6.21. Remove a user group exclude entry

• Use the remove operation to remove the entry.

  /core-service=management/access=authorization/role-mapping=ROLENAME/exclude=ALIAS:remove

  ROLENAME is the name of the role being configured.
  ALIAS is a unique name for this mapping. Red Hat recommends that you use a naming convention for your aliases such as group-GROUPNAME.

  [standalone@localhost:9999 access=authorization] ./role-mapping=Auditor/exclude=group-supervisors:remove
  {"outcome" => "success"}
  [standalone@localhost:9999 access=authorization]
  

  Removing the group from the list of excludes does not remove the group from the system. It also does not guarantee the role will be assigned to members of the group. Roles might still be excluded based on group membership.