11.6. 将外部置备系统用于用户和组

1. 添加 provisionator 用户帐户：

   $ ipa user-add provisionator --first=provisioning --last=account --password

2. 为 provisionator 用户授予所需的特权。
   创建一个自定义角色 System Provisioning ，来管理添加 stage 用户：

   $ ipa role-add --desc "Responsible for provisioning stage users" "System Provisioning"

   将 Stage User Provisioning 特权添加到该角色。这个特权提供了添加 stage 用户的能力：

   $ ipa role-add-privilege "System Provisioning" --privileges="Stage User Provisioning"

   将 provisionator 用户添加到角色中：

   $ ipa role-add-member --users=provisionator "System Provisioning"

1. 添加 activator 用户帐户：

   $ ipa user-add activator --first=activation --last=account --password

2. 授予 activator 用户所需的特权。
   将用户添加到默认的 User Administrator 角色中：

   $ ipa role-add-member --users=activator "User Administrator"

$ ipa group-add service-accounts

$ ipa pwpolicy-add service-accounts --maxlife=10000 --minlife=0 --history=0 --minclasses=4 --minlength=20 --priority=1 --maxfail=0 --failinterval=1 --lockouttime=0

$ ipa group-add-member service-accounts --users={provisionator,activator}

$ kpasswd provisionator
$ kpasswd activator

# ipa-getkeytab -s example.com -p "activator" -k /etc/krb5.ipa-activation.keytab

#!/bin/bash

kinit -k -i activator

ipa stageuser-find --all --raw | grep "  uid:" | cut -d ":" -f 2 | while read uid; do ipa stageuser-activate ${uid}; done

# chmod 755 /usr/local/sbin/ipa-activate-all
# chown root:root /usr/local/sbin/ipa-activate-all

[Unit]
Description=Scan IdM every minute for any stage users that must be activated

[Service]
Environment=KRB5_CLIENT_KTNAME=/etc/krb5.ipa-activation.keytab
Environment=KRB5CCNAME=FILE:/tmp/krb5cc_ipa-activate-all
ExecStart=/usr/local/sbin/ipa-activate-all

[Unit]
Description=Scan IdM every minute for any stage users that must be activated

[Timer]
OnBootSec=15min
OnUnitActiveSec=1min

[Install]
WantedBy=multi-user.target

# systemctl enable ipa-activate-all.timer