Chapter 17. Automating group membership using IdM CLI Using automatic group membership allows you to assign users and hosts to groups automatically based on their attributes. For example, you can: Divide employees' user entries into groups based on the employees' manager, location, or any other attribute. Divide hosts based on their class, location, or any other attribute. Add all users or all hosts to a single global group. This chapter covers the following topics: Benefits of automatic group membership Automember rules Adding an automember rule using IdM CLI Adding a condition to an automember rule using IdM CLI Viewing existing automember rules using IdM CLI Deleting an automember rule using IdM CLI Removing a condition from an automember rule using IdM CLI Applying automember rules to existing entries using IdM CLI Configuring a default automember group using IdM CLI 17.1. Benefits of automatic group membership Using automatic membership for users allows you to: Reduce the overhead of manually managing group memberships You no longer have to assign every user and host to groups manually. Improve consistency in user and host management Users and hosts are assigned to groups based on strictly defined and automatically evaluated criteria. Simplify the management of group-based settings Various settings are defined for groups and then applied to individual group members, for example sudo rules, automount, or access control. Adding users and hosts to groups automatically makes managing these settings easier. 17.2. Automember rules When configuring automatic group membership, the administrator defines automember rules. An automember rule applies to a specific user or host target group. It cannot apply to more than one group at a time. After creating a rule, the administrator adds conditions to it. These specify which users or hosts get included or excluded from the target group: Inclusive conditions When a user or host entry meets an inclusive condition, it will be included in the target group. Exclusive conditions When a user or host entry meets an exclusive condition, it will not be included in the target group. The conditions are specified as regular expressions in the Perl-compatible regular expressions (PCRE) format. For more information about PCRE, see the pcresyntax(3) man page on your system. Note IdM evaluates exclusive conditions before inclusive conditions. In case of a conflict, exclusive conditions take precedence over inclusive conditions. An automember rule applies to every entry created in the future. These entries will be automatically added to the specified target group. If an entry meets the conditions specified in multiple automember rules, it will be added to all the corresponding groups. Existing entries are not affected by the new rule. If you want to change existing entries, see Applying automember rules to existing entries using IdM CLI . 17.3. Adding an automember rule using IdM CLI Follow this procedure to add an automember rule using the IdM CLI. For information about automember rules, see Automember rules . After adding an automember rule, you can add conditions to it using the procedure described in Adding a condition to an automember rule . Note Existing entries are not affected by the new rule. If you want to change existing entries, see Applying automember rules to existing entries using IdM CLI . Prerequisites You must be logged in as the administrator. For details, see Using kinit to log in to IdM manually . The target group of the new rule must exist in IdM. Procedure Enter the ipa automember-add command to add an automember rule. When prompted, specify: Automember rule . This is the target group name. Grouping Type . This specifies whether the rule targets a user group or a host group. To target a user group, enter group . To target a host group, enter hostgroup . For example, to add an automember rule for a user group named user_group : Verification You can display existing automember rules and conditions in IdM using Viewing existing automember rules using IdM CLI . 17.4. Adding a condition to an automember rule using IdM CLI After configuring automember rules, you can then add a condition to that automember rule using the IdM CLI. For information about automember rules, see Automember rules . Prerequisites You must be logged in as the administrator. For details, see Using kinit to log in to IdM manually . The target rule must exist in IdM. For details, see Adding an automember rule using IdM CLI . Procedure Define one or more inclusive or exclusive conditions using the ipa automember-add-condition command. When prompted, specify: Automember rule . This is the target rule name. See Automember rules for details. Attribute Key . This specifies the entry attribute to which the filter will apply. For example, uid for users. Grouping Type . This specifies whether the rule targets a user group or a host group. To target a user group, enter group . To target a host group, enter hostgroup . Inclusive regex and Exclusive regex . These specify one or more conditions as regular expressions. If you only want to specify one condition, press Enter when prompted for the other. For example, the following condition targets all users with any value (.*) in their user login attribute ( uid ). As another example, you can use an automembership rule to target all Windows users synchronized from Active Directory (AD). To achieve this, create a condition that that targets all users with ntUser in their objectClass attribute, which is shared by all AD users: Verification You can display existing automember rules and conditions in IdM using Viewing existing automember rules using IdM CLI . 17.5. Viewing existing automember rules using IdM CLI Follow this procedure to view existing automember rules using the IdM CLI. Prerequisites You must be logged in as the administrator. For details, see Using kinit to log in to IdM manually . Procedure Enter the ipa automember-find command. When prompted, specify the Grouping type : To target a user group, enter group . To target a host group, enter hostgroup . For example: 17.6. Deleting an automember rule using IdM CLI Follow this procedure to delete an automember rule using the IdM CLI. Deleting an automember rule also deletes all conditions associated with the rule. To remove only specific conditions from a rule, see Removing a condition from an automember rule using IdM CLI . Prerequisites You must be logged in as the administrator. For details, see Using kinit to log in to IdM manually . Procedure Enter the ipa automember-del command. When prompted, specify: Automember rule . This is the rule you want to delete. Grouping rule . This specifies whether the rule you want to delete is for a user group or a host group. Enter group or hostgroup . 17.7. Removing a condition from an automember rule using IdM CLI Follow this procedure to remove a specific condition from an automember rule. Prerequisites You must be logged in as the administrator. For details, see Using kinit to log in to IdM manually . Procedure Enter the ipa automember-remove-condition command. When prompted, specify: Automember rule . This is the name of the rule from which you want to remove a condition. Attribute Key . This is the target entry attribute. For example, uid for users. Grouping Type . This specifies whether the condition you want to delete is for a user group or a host group. Enter group or hostgroup . Inclusive regex and Exclusive regex . These specify the conditions you want to remove. If you only want to specify one condition, press Enter when prompted for the other. For example: 17.8. Applying automember rules to existing entries using IdM CLI Automember rules apply automatically to user and host entries created after the rules were added. They are not applied retroactively to entries that existed before the rules were added. To apply automember rules to previously added entries, you have to manually rebuild automatic membership. Rebuilding automatic membership re-evaluates all existing automember rules and applies them either to all user or hosts entries, or to specific entries. Note Rebuilding automatic membership does not remove user or host entries from groups, even if the entries no longer match the group's inclusive conditions. To remove them manually, see Removing a member from a user group using IdM CLI or Removing IdM host group members using the CLI . Prerequisites You must be logged in as the administrator. For details, see link: Using kinit to log in to IdM manually . Procedure To rebuild automatic membership, enter the ipa automember-rebuild command. Use the following options to specify the entries to target: To rebuild automatic membership for all users, use the --type=group option: To rebuild automatic membership for all hosts, use the --type=hostgroup option. To rebuild automatic membership for a specified user or users, use the --users= target_user option: To rebuild automatic membership for a specified host or hosts, use the --hosts= client.idm.example.com option. 17.9. Configuring a default automember group using IdM CLI When you configure a default automember group, new user or host entries that do not match any automember rule are automatically added to this default group. Prerequisites You must be logged in as the administrator. For details, see Using kinit to log in to IdM manually . The target group you want to set as default exists in IdM. Procedure Enter the ipa automember-default-group-set command to configure a default automember group. When prompted, specify: Default (fallback) Group , which specifies the target group name. Grouping Type , which specifies whether the target is a user group or a host group. To target a user group, enter group . To target a host group, enter hostgroup . For example: Note To remove the current default automember group, enter the ipa automember-default-group-remove command. Verification To verify that the group is set correctly, enter the ipa automember-default-group-show command. The command displays the current default automember group. For example:

Commands:
ipa automember-add Automember Rule: user_group Grouping Type: group -------------------------------- Added automember rule "user_group" -------------------------------- Automember Rule: user_group
ipa automember-add-condition Automember Rule: user_group Attribute Key: uid Grouping Type: group [Inclusive Regex]: .* [Exclusive Regex]: ---------------------------------- Added condition(s) to "user_group" ---------------------------------- Automember Rule: user_group Inclusive Regex: uid=.* ---------------------------- Number of conditions added 1 ----------------------------
ipa automember-add-condition Automember Rule: ad_users Attribute Key: objectclass Grouping Type: group [Inclusive Regex]: ntUser [Exclusive Regex]: ------------------------------------- Added condition(s) to "ad_users" ------------------------------------- Automember Rule: ad_users Inclusive Regex: objectclass=ntUser ---------------------------- Number of conditions added 1 ----------------------------
ipa automember-find Grouping Type: group --------------- 1 rules matched --------------- Automember Rule: user_group Inclusive Regex: uid=.* ---------------------------- Number of entries returned 1 ----------------------------
ipa automember-remove-condition Automember Rule: user_group Attribute Key: uid Grouping Type: group [Inclusive Regex]: .* [Exclusive Regex]: ----------------------------------- Removed condition(s) from "user_group" ----------------------------------- Automember Rule: user_group ------------------------------ Number of conditions removed 1 ------------------------------
ipa automember-rebuild --type=group -------------------------------------------------------- Automember rebuild task finished. Processed (9) entries. --------------------------------------------------------
ipa automember-rebuild --users=target_user1 --users=target_user2 -------------------------------------------------------- Automember rebuild task finished. Processed (2) entries. --------------------------------------------------------
ipa automember-default-group-set Default (fallback) Group: default_user_group Grouping Type: group --------------------------------------------------- Set default (fallback) group for automember "default_user_group" --------------------------------------------------- Default (fallback) Group: cn=default_user_group,cn=groups,cn=accounts,dc=example,dc=com
ipa automember-default-group-show Grouping Type: group Default (fallback) Group: cn=default_user_group,cn=groups,cn=accounts,dc=example,dc=com