8.4. Granting sudo access to an IdM user on an IdM client using the IdM Web UI

Procedure

1. Add the /usr/sbin/reboot command to the IdM database of sudo commands:

   1. Navigate to Policy Sudo Sudo Commands.
   2. Click Add in the upper right corner to open the Add sudo command dialog box.

   3. Enter the command you want the user to be able to perform using sudo: /usr/sbin/reboot.

      
   4. Click Add.

2. Use the new sudo command entry to create a sudo rule to allow idm_user to reboot the idmclient machine:

   1. Navigate to Policy Sudo Sudo rules.
   2. Click Add in the upper right corner to open the Add sudo rule dialog box.
   3. Enter the name of the sudo rule: idm_user_reboot.
   4. Click Add and Edit.

   5. Specify the user:

      1. In the Who section, check the Specified Users and Groups radio button.
      2. In the User category the rule applies to subsection, click Add to open the Add users into sudo rule "idm_user_reboot" dialog box.
      3. In the Add users into sudo rule "idm_user_reboot" dialog box in the Available column, check the idm_user checkbox, and move it to the Prospective column.
      4. Click Add.

   6. Specify the host:

      1. In the Access this host section, check the Specified Hosts and Groups radio button.
      2. In the Host category this rule applies to subsection, click Add to open the Add hosts into sudo rule "idm_user_reboot" dialog box.
      3. In the Add hosts into sudo rule "idm_user_reboot" dialog box in the Available column, check the idmclient.idm.example.com checkbox, and move it to the Prospective column.
      4. Click Add.

   7. Specify the commands:

      1. In the Command category the rule applies to subsection of the Run Commands section, check the Specified Commands and Groups radio button.
      2. In the Sudo Allow Commands subsection, click Add to open the Add allow sudo commands into sudo rule "idm_user_reboot" dialog box.
      3. In the Add allow sudo commands into sudo rule "idm_user_reboot" dialog box in the Available column, check the /usr/sbin/reboot checkbox, and move it to the Prospective column.
      4. Click Add to return to the idm_sudo_reboot page.

      图 8.1. Adding IdM sudo rule

      

   8. Click Save in the top left corner.

      The new rule is enabled by default.

   注意

   Propagating the changes from the server to the client can take a few minutes.

Verification

1. Log in to idmclient as idm_user.

2. Reboot the machine using sudo. Enter the password for idm_user when prompted:

   $ sudo /usr/sbin/reboot
   [sudo] password for idm_user: