freeipa/doc/api/access_control_guide.md

Access control examples

IPA provides a way to manage delegation of rights. Permissions allows to define certain management actions, which can then be grouped in privileges. These privileges can then be added to roles, which can be assigned to users and groups.

• Access control examples
  • Managing permissions
  • Managing privileges
  • Managing roles
  • Assigning roles to users and groups

Managing permissions

Add a permission for creating users.

api.Command.permission_add("Create users", ipapermright='add', type='user')

Add a permission for managing group membership.

api.Command.permission_add("Manage group membership", ipapermright='write', type='group', attrs="member")

Managing privileges

Add a privilege for user creation process (creating user, adding it to groups, manage user certificates).

api.Command.permission_add("Create users", ipapermright='add', type='user')
api.Command.permission_add("Manage group membership", ipapermright='write', type='group', attrs="member")
api.Command.permission_add("Manage User certificates", ipapermright='write', type='user', attrs='usercertificate')

api.Command.privilege_add("User creation")
api.Command.privilege_add_permission("User creation", permission="Create users")
api.Command.privilege_add_permission("User creation", permission="Manage group membership")
api.Command.privilege_add_permission("User creation", permission="Manage User certificates")

Managing roles

Add a role with the privilege created earlier.

api.Command.role_add("usermanager", description="Users manager")
api.Command.role_add_privilege("usermanager", privilege="User creation")

Assigning roles to users and groups

Assign the role usermanager to user bob.

api.Command.role_add_member("usermanager", user="bob")

Users, groups, hosts and hostgroups may be members of a role. Assign the usermanager role to managers group.

api.Command.role_add_member("usermanager", group="managers")