19.2. Creating self-service rules using the CLI

Prerequisites

• Administrator privileges for managing IdM or the User Administrator role.
• An active Kerberos ticket. For details, see Using kinit to log in to IdM manually.

Procedure

• To add a self-service rule, use the ipa selfservice-add command and specify the following two options:

  --permissions

  sets the read and write permissions the Access Control Instruction (ACI) grants.

  --attrs

  sets the complete list of attributes to which this ACI grants permission.

  For example, to create a self-service rule allowing users to modify their own name details:

  $ ipa selfservice-add "Users can manage their own name details" --permissions=write --attrs=givenname --attrs=displayname --attrs=title --attrs=initials
  -----------------------------------------------------------
  Added selfservice "Users can manage their own name details"
  -----------------------------------------------------------
      Self-service name: Users can manage their own name details
      Permissions: write
      Attributes: givenname, displayname, title, initials