Role-based access control (RBAC)
Delegating administration: the permission → privilege → role layers, what the shipped roles can do, giving a help desk a reset-password-only account, and how the admins group relates to RBAC.
RBAC decides what an administrator may change in the directory; it has nothing to do with HBAC (which hosts a user may log in to). Three layers:
| Layer | Granularity | Example |
|---|---|---|
| permission | one ACI: which operation on which attributes of which object type | System: Change User password |
| privilege | a set of permissions | Modify Users and Reset passwords |
| role | a set of privileges, granted to users / groups / hosts / services | helpdesk |
The UI manages roles and privileges; permissions are CLI only (ipa permission-find), 300+ are shipped and rarely touched. Not gated by a licence module.
Shipped roles
| Role | Can |
|---|---|
| helpdesk | edit user attributes, reset passwords, change group membership |
| User Administrator | create / delete / edit users and groups |
| IT Specialist | manage hosts, host groups, services, automount, netgroups |
| IT Security Specialist | manage HBAC, sudo, SELinux maps, password policies |
| Security Architect | manage RBAC itself, replication, trusts, certificates |
| Enrollment Administrator | enrol hosts (the account ipa-client-install uses) |
| Subordinate ID Selfservice User | request one's own subordinate IDs |
The admins group bypasses RBAC: it is the directory's super-group and may change anything. Before adding someone to admins, check whether a role covers the need.
Role detail
The Privileges tab lists the privileges the role contains; Members lists the users, groups, hosts and services holding it. A help-desk account that can only reset passwords: put the help-desk group into the helpdesk role's members and leave admins alone.
Hosts and services can hold roles too: grant Enrollment Administrator to a bastion's host/ principal and automation on that machine enrols new hosts with its own keytab instead of a stored admin password.
Privileges
38 shipped, grouped by object type (DNS Administrators, Certificate Administrators, Automount Administrators…). A custom privilege = a chosen set of permissions, then placed in a role. A common one, "read-only auditor": a privilege holding only System: Read * permissions (ipa permission-find --type=user --right=read).
Self-service and delegation
Users editing their own attributes (password, phone, SSH keys) go through "self-service permissions", not roles; delegation rules let one group edit chosen attributes of another group. Both are CLI only: ipa selfservice-find, ipa delegation-find.
Boundaries
- Role membership changes take effect immediately, no console re-login; cached tickets are unaffected because RBAC is evaluated server-side per request.
- RBAC covers IPA API / LDAP writes only; filesystem, sudo and AD-side rights are separate.
- Deleting a privilege does not clean roles that referenced it; the role just has one entry fewer.
Automount locations
Requires the automount module. The location / map / key structure, the standard on-demand home directory setup, enabling clients, and why the UI stops at locations.
Trusts
Requires the ad-trust module. The Trusts page shows and fine-tunes an established AD trust: trust type, trusted domains, UPN suffixes, SID blocklists; NetBIOS name and fallback primary group in the global config. Creating the trust is CLI work.