WIXLIB

Chapter 1.Configuring Users and Groups1.1. Managing User AccountsThe primary activities associated with managing user accounts, such as creating and deletingaccounts, are performed by IPA Administrators. Other activities, such as editing various user accountattributes and changing group membership, can be delegated to other accounts.Refer to Section 3.1.1.1, “Delegating Administrative Privileges” for more information.You can use either the web interface or the command line to manage user accounts. Each interfaceprovides identical functionality, however the web interface displays a greater range of information foreach user in an easy to use format.The web interface displays mandatory fields in a different color. Certain other fields, such as CommonName, Display Name, Initials, Login, and E-mail Address, are populated automatically. You canchange these values as required. The UID, GID, and Home Directory are automatically generated bythe server.If you use the command line to add user accounts, you will be prompted for any required information.Refer to Section 3.2.3.2, “User Setting Attributes” for information on the attributes that apply to useraccounts, and especially for information regarding users' /home directories.1.1.1. Creating User AccountsYou can use the Add User page in the web interface, or the ipa-adduser command on thecommand line to create user accounts. These procedures are described below.NoteIPA supports a wide range of username formats, but you need to be aware of anyrestrictions that may apply to your particular environment. For example, a username thatstarts with a digit may cause problems for some UNIX systems.The range of username formats supported by IPA can be described by the followingregular expression:[a-zA-Z0-9 .][a-zA-Z0-9 .-]{0,30}[a-zA-Z0-9 . -]The trailing symbol is permitted for Samba 3.x machine support.1.1.1.1. Using the Web InterfaceProcedure 1.1. To create a user account using the web interface:1. On the IPA homepage, click Add User in the Tasks list to display the Add User page.2.Enter the required details for the user.1

Chapter 1. Configuring Users and Groups3.If required, add the user account to a group. All users are automatically added to the global groupipausers.NoteYou can configure the global group to suit your deployment. For example, you mayprefer to change its name to include your company name.4.When you have entered the required account details, click Add User.NoteIt is not essential to provide a password when you create an account. For example, youmight create an account for a service (rather than a user), and such an account may notrequire a password. For a user account, however, you need to provide an initial passwordso that the user can log in to their account. Users are required to change their initialpassword the first time they log in.The following example illustrates using the web interface to add the Identity and Account details for anew user.Figure 1.1. Using the web interface to add a new user.2

Editing User Accounts1.1.1.2. Using the Command LineUse the ipa-adduser command to add users to IPA. You can pass attributes directly on thecommand line, or run the command with no parameters to enter interactive mode. Interactive modeprompts you to enter the basic attributes required to add a new user. You can add further attributesusing the ipa-moduser command. Use the ipa-moduser --list command to view a list of theattributes that you can modify using this command.Procedure 1.2. To create the user jlamb using the command line: Open a shell and run the following command: /usr/sbin/ipa-adduser -f John -l Lamb -p secret jlambThe following example illustrates using the ipa-adduser command in interactive mode to create auser account: /usr/sbin/ipa-adduserFirst name: JinnyLast name: PattanajeeLogin name: jpattangecos[]: Jinny Pattanajeehome directory [/home/jpattan]:shell [/bin/sh]:jpattan successfully addedPress Enter at each prompt to accept the default values (enclosed in square brackets), or type analternative.Refer to the ipa-adduser man page for more information.1.1.2. Editing User Accounts1.1.2.1. Using the Web InterfaceMembers of the IPA Administrators group can edit the details of any user account. Other users canedit certain user account details, according to the delegations that have been configured.Procedure 1.3. To edit a user account using the web interface:1. Click Find Users in the Tasks list to display the Find Users page.2.Enter the name or a key word of the user that you want to edit in the search field, and click FindUsers.3.In the search results, click the name of the user that you want to edit. The user is displayed onthe View User page. If the user does not appear in the search results, try using broader searchterms.4.Click Edit User to display the Edit User page, where you can edit user attributes.5.Edit the user attributes as required, and click Update User. Note that not all fields areimmediately editable; select the Edit Protected Fields check box to edit the Password, HomeDirectory, and some other fields.3

Chapter 1. Configuring Users and GroupsWarningIt is possible to edit the UID and GID of user accounts, however this is not recommended.Changing these IDs will not cause problems internally for IPA, but it can lead to otherissues, such as changes to file ownership and security problems.1.1.2.2. Using the Command LineUse the ipa-moduser command to modify user account details, such as adding, removing orchanging attributes. The following examples illustrate the use of this command:To update the Zip code, Display Name, and Employee Type for the user jsmith: /usr/sbin/ipa-moduser --set postalCode 50211 --set displayName "JohnSmith" --set employeeType permanent jsmithTo remove the Pager and Home Phone attributes from the same user: /usr/sbin/ipa-moduser --del pager --del homePhone jsmithTo retrieve a partial list of the default attributes that you can manage with ipamoduser: /usr/sbin/ipa-moduser --listThe list of attributes corresponds to those available in the web interface, not including any customattributes that may have been defined.1.1.3. Activating and Inactivating User AccountsIPA user accounts can be set to a status of Active or Inactive. If you inactivate a user account,that user can no longer log in to IPA, change their password, or perform any other tasks. Any existingconnections will remain valid until their Kerberos TGT and other tickets expire, but they will not beable to renew them. The account and all associated information still exists, but is inaccessible by theuser.1.1.3.1. Using the Web InterfaceProcedure 1.4. To inactivate a user account using the web interface:1. Find the user that you want to inactivate as described in Section 1.1.2, “Editing User Accounts”.2.Click Edit User to display the Edit User page, where you can edit user attributes.3.In the Account Details section, select inactive in the Account Status drop-down list, and thenclick Update User.The account remains inactive and inaccessible to the user until reactivated by an IPA Administrator.1.1.3.2. Using the Command LineUse the ipa-lockuser command to activate or inactivate user accounts.4

Deleting User AccountsTo lock (inactivate) the jsmith user account: /usr/sbin/ipa-lockuser jsmithTo unlock (activate) the jsmith user account: /usr/sbin/ipa-lockuser -u jsmith1.1.4. Deleting User AccountsIf you delete an IPA user account, all of the information stored in the entry for that identity is lost. Thisincludes the user's full name, group membership, phone numbers, and passwords. The actual useraccount and home directory still exist, be they on a server, local machine, or other provider, but theyare no longer accessible via IPA.Unlike inactivation, if you delete a user account, it cannot be retrieved. If you need this user accountagain, you need to recreate it and add all of the account details manually.NoteYou cannot delete or rename the admin account, nor can you remove it from the adminsgroup.1.1.4.1. Using the Web InterfaceProcedure 1.5. To delete a user account using the web interface:1. Find the user that you want to delete as described in Section 1.1.2, “Editing User Accounts”.2.Click Edit User to display the Edit User page.3.Click Delete User, and then click OK.1.1.4.2. Using the Command LineUse the ipa-deluser command to delete user accounts. For example:To delete the jsmith user account: /usr/sbin/ipa-deluser jsmith1.2. Managing GroupsIPA uses groups to facilitate the management and administration of both users and permissions. Threegroups are created during the installation process: ipausers, admins, and editors. All of thesegroups are required for IPA operation.The IPA Administrator is a member of the admins group. You cannot delete the IPA Administrator, norcan you remove this user from this group. All other users belong to the global group ipausers, andyou can create as many additional groups as you require.5

Chapter 1. Configuring Users and GroupsNoteSome operating systems limit the number of groups that you can create. For example,Solaris and AIX allow only 16 groups per user. IPA Administrators need to be aware ofthis limitation, especially when using nested groups.The editors group is a special group used by the web interface. Members of this group have at leastone delegation, which means they can edit records apart from their own.You can create groups based on the departments within your organization, for example, Devel,Finance, and HR. You can also create groups based on the permissions, or roles, required to manageyour departmental or other groups. Refer to Section 3.1, “Configuring Access Control” for informationon using groups to define roles.Nested GroupsYou can also create nested groups. For example, you can create a group called "Documentation", andthen create sub-groups such as "Writers", "Translators", and "Editors". You can add users to each ofthe sub-groups to suit the needs of your organization.NoteAny users that you add to a sub-group automatically become members of the parentgroup.WarningAvoid the creation of cyclic groups; that is, groups that contain groups that in turn containtheir own ancestors, and avoid creating group names that contain spaces. Either of theseconditions can lead to unexpected behavior.Refer to Section 3.1, “Configuring Access Control” for information on using groups to define roles.1.2.1. Creating Groups1.2.1.1. Using the Web InterfaceProcedure 1.6. To create a group using the web interface:1. On the IPA homepage, click Add Group in the Tasks list to display the Add Group page.2.Enter a name and description for the group. The GID (Group ID) is automatically generated by theIPA server.3.Add any users that you want to include in this group:6a.Enter the login name or other search term in the To Add field, and click Find.b.Locate the users that you want to include in this group, and click add.

Creating Groups4.When you have finished adding members, click Add Group to return to the View Group page,and display details of the newly-added group.The following diagram illustrates adding members to a new group.Figure 1.2. Adding members to a new group.1.2.1.2. Using the Command LineUse the ipa-addgroup command to add groups. You can include attributes on the command-line oruse the command interactively. For example,To create a group called "Engineering" using the command line: /usr/sbin/ipa-addgroupGroup name: EngineeringDescription: All members of the engineering groupEngineering successfully addedAlternatively, include all the required attributes on the command-line: /usr/sbin/ipa-addgroup -d "All authors, editors, and translators."DocumentationDocumentation successfully added7

Chapter 1. Configuring Users and GroupsThe group name and description are mandatory fields. If either of these are not included on thecommand-line, you will be prompted to include them.NoteYou cannot add users to a newly-created group using the ipa-addgroup command. Youfirst need to create the group, and then use the ipa-modgroup command to add users.For example: /usr/sbin/ipa-modgroup -a user01,user02,user03 Engineering1.2.2. Editing GroupsYou can edit any of the attributes that define a group, as well as add or remove members. Someattributes are read-only by default, however you can edit these attributes if required.1.2.2.1. Using the Web InterfaceProcedure 1.7. To edit a group using the web interface:1. Click Find Groups in the Tasks list to display the Find Groups page.2.Enter the name or a key word of the group that you want to edit in the search field, and click FindGroups.3.In the search results, click the name of the group that you want to edit. The group is displayedon the View Group page. If the group does not appear in the search results, try using broadersearch terms.4.Click Edit Group to display the Edit Group page, where you can edit group attributes.5.Edit the group attributes as required, and click Update Group. Note that if you want to change theName or GID of the group, you need to select the Edit Protected Fields check box.WarningDo not change the Group Name or GID unless absolutely necessary, because it can haveunexpected effects on permissions, ACIs, and other aspects of IPA functionality.If you rename a group used in an ACI, the ACI itself is not updated, the result being thatthe group will fall out of the ACI scope. To avoid this issue, ensure that any changes togroup names are reflected in IPA Delegations. IPA does not currently support per-userACIs, so this issue only affects groups.1.2.2.2. Using the Command LineUse the ipa-modgroup command to edit groups. The following are some simple examples of usingthis command. Refer to the ipa-modgroup man page for more information.8

Activating and Inactivating GroupsTo add the user user01 to the admins group: /usr/sbin/ipa-modgroup -a user01 adminsTo remove the user user01 from the admins group: /usr/sbin/ipa-modgroup -r user01 adminsTo change the description of the admins group to "IPA Administrators": /usr/sbin/ipa-modgroup -d "IPA Administrators" adminsTo add the group sysadmins to the admins group: /usr/sbin/ipa-modgroup -g sysadmins adminsTo remove the Editors group from the Documentation group: /usr/sbin/ipa-modgroup -e Editors Documentation1.2.3. Activating and Inactivating GroupsIPA groups can be set to a status of Active or Inactive. If you inactivate a group, all of themembers of that group are also inactivated. This means that they cannot log in to IPA, changepasswords, or access resources controlled by IPA. The accounts within an inactivated group still exist,but they are inaccessible.This also applies to nested groups. If you inactivate a group, then any sub-groups are also inactivated,as are their members. Within these inactive groups, however, you can manually activate individualusers or groups if required.NoteYou cannot inactivate the admins group.1.2.3.1. Using the Web InterfaceProcedure 1.8. To activate a group using the web interface:1. Find the group that you want to edit as described in Section 1.2.2, “Editing Groups”.2.Click Edit Group to display the Edit Group page.3.Select inactive in the Group Status drop-down list, and then click Update Group.1.2.3.2. Using the Command LineUse the ipa-modgroup command with the nsaccountlock option

The IPA Administration Guide is intended for system administrators and those involved in the ongoing maintenance of IPA. This guide assumes a good understanding of various operating systems, including Linux, Solaris and other UNIX systems, Macintosh and Microsoft Windows. It also ass