Chapter 28. Managing role-based access controls in IdM using the CLI Learn more about role-based access control in Identity Management (IdM) and the following operations which are run in the command-line interface (CLI): Managing permissions Managing privileges Managing roles 28.1. Role-based access control in IdM Role-based access control (RBAC) in IdM grants a very different kind of authority to users compared to self-service and delegation access controls. Role-based access control is composed of three parts: Permissions grant the right to perform a specific task such as adding or deleting users, modifying a group, and enabling read-access. Privileges combine permissions, for example all the permissions needed to add a new user. Roles grant a set of privileges to users, user groups, hosts or host groups. 28.1.1. Permissions in IdM Permissions are the lowest level unit of role-based access control, they define operations together with the LDAP entries to which those operations apply. Comparable to building blocks, permissions can be assigned to as many privileges as needed. One or more rights define what operations are allowed: write read search compare add delete all These operations apply to three basic targets : subtree : a domain name (DN); the subtree under this DN target filter : an LDAP filter target : DN with possible wildcards to specify entries Additionally, the following convenience options set the corresponding attribute(s): type : a type of object (user, group, etc); sets subtree and target filter memberof : members of a group; sets a target filter Note Setting the memberof attribute permission is not applied if the target LDAP entry does not contain any reference to group membership. targetgroup : grants access to modify a specific group (such as granting the rights to manage group membership); sets a target With IdM permissions, you can control which users have access to which objects and even which attributes of these objects. IdM enables you to allow or block individual attributes or change the entire visibility of a specific IdM function, such as users, groups, or sudo, to all anonymous users, all authenticated users, or just a certain group of privileged users. For example, the flexibility of this approach to permissions is useful for an administrator who wants to limit access of users or groups only to the specific sections these users or groups need to access and to make the other sections completely hidden to them. Note A permission cannot contain other permissions. 28.1.2. Default managed permissions Managed permissions are permissions that come by default with IdM. They behave like other permissions created by the user, with the following differences: You cannot delete them or modify their name, location, and target attributes. They have three sets of attributes: Default attributes, the user cannot modify them, as they are managed by IdM Included attributes, which are additional attributes added by the user Excluded attributes, which are attributes removed by the user A managed permission applies to all attributes that appear in the default and included attribute sets but not in the excluded set. Note While you cannot delete a managed permission, setting its bind type to permission and removing the managed permission from all privileges effectively disables it. Names of all managed permissions start with System: , for example System: Add Sudo rule or System: Modify Services . Earlier versions of IdM used a different scheme for default permissions. For example, the user could not delete them and was only able to assign them to privileges. Most of these default permissions have been turned into managed permissions, however, the following permissions still use the scheme: Add Automember Rebuild Membership Task Add Configuration Sub-Entries Add Replication Agreements Certificate Remove Hold Get Certificates status from the CA Read DNA Range Modify DNA Range Read PassSync Managers Configuration Modify PassSync Managers Configuration Read Replication Agreements Modify Replication Agreements Remove Replication Agreements Read LDBM Database Configuration Request Certificate Request Certificate ignoring CA ACLs Request Certificates from a different host Retrieve Certificates from the CA Revoke Certificate Write IPA Configuration Note If you attempt to modify a managed permission from the command line, the system does not allow you to change the attributes that you cannot modify, the command fails. If you attempt to modify a managed permission from the Web UI, the attributes that you cannot modify are disabled. 28.1.3. Privileges in IdM A privilege is a group of permissions applicable to a role. While a permission provides the rights to do a single operation, there are certain IdM tasks that require multiple permissions to succeed. Therefore, a privilege combines the different permissions required to perform a specific task. For example, setting up an account for a new IdM user requires the following permissions: Creating a new user entry Resetting a user password Adding the new user to the default IPA users group Combining these three low-level tasks into a higher level task in the form of a custom privilege named, for example, Add User makes it easier for a system administrator to manage roles. IdM already contains several default privileges. Apart from users and user groups, privileges are also assigned to hosts and host groups, as well as network services. This practice permits a fine-grained control of operations by a set of users on a set of hosts using specific network services. Note A privilege may not contain other privileges. 28.1.4. Roles in IdM A role is a list of privileges that users specified for the role possess. In effect, permissions grant the ability to perform given low-level tasks (such as creating a user entry and adding an entry to a group), privileges combine one or more of these permissions needed for a higher-level task (such as creating a new user in a given group). Roles gather privileges together as needed: for example, a User Administrator role would be able to add, modify, and delete users. Important Roles are used to classify permitted actions. They are not used as a tool to implement privilege separation or to protect from privilege escalation. Note Roles can not contain other roles. 28.1.5. Predefined roles in Identity Management Red Hat Identity Management provides the following range of pre-defined roles: Table 28.1. Predefined Roles in Identity Management Role Privilege Description Enrollment Administrator Host Enrollment Responsible for client, or host, enrollment helpdesk Modify Users and Reset passwords, Modify Group membership Responsible for performing simple user administration tasks IT Security Specialist Netgroups Administrators, HBAC Administrator, Sudo Administrator Responsible for managing security policy such as host-based access controls, sudo rules IT Specialist Host Administrators, Host Group Administrators, Service Administrators, Automount Administrators Responsible for managing hosts Security Architect Delegation Administrator, Replication Administrators, Write IPA Configuration, Password Policy Administrator Responsible for managing the Identity Management environment, creating trusts, creating replication agreements User Administrator User Administrators, Group Administrators, Stage User Administrators Responsible for creating users and groups 28.2. Managing IdM permissions in the CLI Follow this procedure to manage Identity Management (IdM) permissions using the command-line interface (CLI). Prerequisites Administrator privileges for managing IdM or the User Administrator role. An active Kerberos ticket. For details, see Using kinit to log in to IdM manually . Procedure Create new permission entries with the ipa permission-add command. For example, to add a permission named dns admin : Specify the properties of the permission with the following options: --bindtype specifies the bind rule type. This option accepts the all , anonymous , and permission arguments. The permission bindtype means that only the users who are granted this permission via a role can exercise it. For example: If you do not specify --bindtype , then permission is the default value. Note It is not possible to add permissions with a non-default bind rule type to privileges. You also cannot set a permission that is already present in a privilege to a non-default bind rule type. --right lists the rights granted by the permission, it replaces the deprecated --permissions option. The available values are add , delete , read , search , compare , write , all . You can set multiple attributes by using multiple --right options or with a comma-separated list inside curly braces. For example: Note add and delete are entry-level operations (for example, deleting a user, adding a group, and so on) while read , search , compare and write are more attribute-level: you can write to userCertificate but not read userPassword . --attrs gives the list of attributes over which the permission is granted. You can set multiple attributes by using multiple --attrs options or by listing the options in a comma-separated list inside curly braces. For example: The attributes provided with --attrs must exist and be allowed attributes for the given object type, otherwise the command fails with schema syntax errors. --type defines the entry object type to which the permission applies, such as user, host, or service. Each type has its own set of allowed attributes. For example: --subtree gives a subtree entry; the filter then targets every entry beneath this subtree entry. Provide an existing subtree entry; --subtree does not accept wildcards or non-existent domain names (DNs). Include a DN within the directory. Because IdM uses a simplified, flat directory tree structure, --subtree can be used to target some types of entries, like automount locations, which are containers or parent entries for other configuration. For example: Note The --type and --subtree options are mutually exclusive: you can see the inclusion of filters for --type as a simplification of --subtree , intending to make life easier for an admin. --filter uses an LDAP filter to identify which entries the permission applies to. IdM automatically checks the validity of the given filter. The filter can be any valid LDAP filter, for example: --memberof sets the target filter to members of the given group after checking that the group exists. For example, to let the users with this permission modify the login shell of members of the engineers group: Note Setting the memberof attribute permission is not applied if the target LDAP entry does not contain any reference to group membership. --targetgroup sets target to the specified user group after checking that the group exists. For example, to let those with the permission write the member attribute in the engineers group (so they can add or remove members): Optionally, you can specify a target domain name (DN): --target specifies the DN to apply the permission to. Wildcards are accepted. --targetto specifies the DN subtree where an entry can be moved to. --targetfrom specifies the DN subtree from where an entry can be moved. 28.3. Command options for existing permissions Use the following variants to modify existing permissions as needed: To edit existing permissions, use the ipa permission-mod command. You can use the same command options as for adding permissions. To find existing permissions, use the ipa permission-find command. You can use the same command options as for adding permissions. To view a specific permission, use the ipa permission-show command. The --raw argument shows the raw 389-ds ACI that is generated. For example: The ipa permission-del command deletes a permission completely. Additional resources See the ipa man page on your system. See the ipa help command. 28.4. Managing IdM privileges in the CLI Follow this procedure to manage Identity Management (IdM) privileges using the command-line interface (CLI). Prerequisites Administrator privileges for managing IdM or the User Administrator role. An active Kerberos ticket. For details, see link: Using kinit to log in to IdM manually . Existing permissions. For details about permissions, see Managing IdM permissions in the CLI . Procedure Add privilege entries using the ipa privilege-add command For example, to add a privilege named managing filesystems with a description: Assign the required permissions to the privilege group with the privilege-add-permission command For example, to add the permissions named managing automount and managing ftp services to the managing filesystems privilege: 28.5. Command options for existing privileges Use the following variants to modify existing privileges as needed: To modify existing privileges, use the ipa privilege-mod command. To find existing privileges, use the ipa privilege-find command. To view a specific privilege, use the ipa privilege-show command. The ipa privilege-remove-permission command removes one or more permissions from a privilege. The ipa privilege-del command deletes a privilege completely. Additional resources See the ipa man page on your system. See the ipa help command. 28.6. Managing IdM roles in the CLI Follow this procedure to manage Identity Management (IdM) roles using the command-line interface (CLI). Prerequisites Administrator privileges for managing IdM or the User Administrator role. An active Kerberos ticket. For details, see Using kinit to log in to IdM manually . Existing privileges. For details about privileges, see Managing IdM privileges in the CLI . Procedure Add new role entries using the ipa role-add command: Add the required privileges to the role using the ipa role-add-privilege command: Add the required members to the role using the ipa role-add-member command. Allowed member types are: users, groups, hosts and hostgroups. For example, to add the group named useradmins to the previously created useradmin role: 28.7. Command options for existing roles Use the following variants to modify existing roles as needed: To modify existing roles, use the ipa role-mod command. To find existing roles, use the ipa role-find command. To view a specific role, use the ipa role-show command. To remove a member from the role, use the ipa role-remove-member command. The ipa role-remove-privilege command removes one or more privileges from a role. The ipa role-del command deletes a role completely. Additional resources See the ipa man page on your system See the ipa help command.

Commands:
ipa permission-add "dns admin"
ipa permission-add "dns admin" --bindtype=all
ipa permission-add "dns admin" --right=read --right=write
ipa permission-add "dns admin" --right={read,write}
ipa permission-add "dns admin" --attrs=description --attrs=automountKey
ipa permission-add "dns admin" --attrs={description,automountKey}
ipa permission-add "manage service" --right=all --type=service --attrs=krbprincipalkey --attrs=krbprincipalname --attrs=managedby
ipa permission-add "manage automount locations" --subtree="ldap://ldap.example.com:389/cn=automount,dc=example,dc=com" --right=write --attrs=automountmapname --attrs=automountkey --attrs=automountInformation
ipa permission-add "manage Windows groups" --filter="(!(objectclass=posixgroup))" --right=write --attrs=description
ipa permission-add ManageShell --right="write" --type=user --attr=loginshell --memberof=engineers
ipa permission-add ManageMembers --right="write" --subtree=cn=groups,cn=accounts,dc=example,dc=test --attr=member --targetgroup=engineers
ipa permission-show <permission> --raw
ipa privilege-add "managing filesystems" --desc="for filesystems"
ipa privilege-add-permission "managing filesystems" --permissions="managing automount" --permissions="managing ftp services"
ipa role-add --desc="User Administrator" useradmin ------------------------ Added role "useradmin" ------------------------ Role name: useradmin Description: User Administrator
ipa role-add-privilege --privileges="user administrators" useradmin Role name: useradmin Description: User Administrator Privileges: user administrators ---------------------------- Number of privileges added 1 ----------------------------
ipa role-add-member --groups=useradmins useradmin Role name: useradmin Description: User Administrator Member groups: useradmins Privileges: user administrators ------------------------- Number of members added 1 -------------------------