51.2. Using ID overrides to enable AD users to administer IdM

Procedure

1. As an IdM administrator, create an ID override for an AD user in the Default Trust View. For example, to create an ID override for the user ad_user@ad.example.com:

   # kinit admin
   # ipa idoverrideuser-add 'default trust view' ad_user@ad.example.com

2. Add the ID override from the Default Trust View as a member of an IdM group. This must be a non-POSIX group, as it interacts with Active Directory.

   If the group in question is a member of an IdM role, the AD user represented by the ID override gains all permissions granted by the role when using the IdM API, including both the command-line interface and the IdM web UI.

   For example, to add the ID override for the ad_user@ad.example.com user to the IdM admins group:

   # ipa group-add-member admins --idoverrideusers=ad_user@ad.example.com

3. Alternatively, you can add the ID override to a role, such as the User Administrator role:

   # ipa role-add-member 'User Administrator' --idoverrideusers=ad_user@ad.example.com