Role-based access control (RBAC)
Delegating administration through the permission, privilege and role layers, what the shipped roles can do, giving a help desk a reset-password-only account, and how the admins group relates to RBAC.
This page covers the Role-based access control pages under IPA Server. RBAC decides what an administrator may change in the directory. It is unrelated to HBAC, which decides which hosts a user may log in to. Not gated by a licence module.
| Layer | Granularity | Example |
|---|---|---|
| Permission | One ACI: which operation on which attributes of which object type | System: Change User password |
| Privilege | A set of permissions | Modify Users and Reset passwords |
| Role | A set of privileges, granted to users, groups, hosts or services | helpdesk |
The UI manages roles and privileges. Permissions are CLI only (ipa permission-find); more than 300 are shipped and rarely changed.
Shipped roles
| Role | Can |
|---|---|
| helpdesk | Edit user attributes, reset passwords, change group membership |
| User Administrator | Create, delete and edit users and groups |
| IT Specialist | Manage hosts, host groups, services, automount, netgroups |
| IT Security Specialist | Manage HBAC, sudo, SELinux maps, password policies |
| Security Architect | Manage RBAC itself, replication, trusts, certificates |
| Enrollment Administrator | Enrol hosts; the account ipa-client-install uses |
| Subordinate ID Selfservice User | Request one's own subordinate IDs |
The admins group bypasses RBAC: it is the directory's super-group and may change anything. A role is preferred over adding someone to admins.
Role detail
The Privileges tab lists the privileges the role contains; Members lists the users, groups, hosts and services holding it. For a help-desk account that can only reset passwords, put the help-desk group into the helpdesk role's members and leave admins alone.
Hosts and services can hold roles too. Granting Enrollment Administrator to a bastion's host/ principal lets automation on that machine enrol new hosts with its own keytab instead of a stored admin password.
Privileges
38 are shipped, grouped by object type (DNS Administrators, Certificate Administrators, Automount Administrators and so on). A custom privilege is a chosen set of permissions, then placed in a role. A common one is a read-only auditor: a privilege holding only System: Read * permissions (ipa permission-find --type=user --right=read).
Self-service and delegation
Users editing their own attributes (password, phone, SSH keys) go through self-service permissions, not roles. Delegation rules let one group edit chosen attributes of another group. Both are CLI only: ipa selfservice-find, ipa delegation-find.
Boundaries
| Topic | Notes |
|---|---|
| Timing | Role membership changes take effect immediately, without a console re-login. RBAC is evaluated server-side per request, so cached tickets are unaffected |
| Scope | Covers IPA API and LDAP writes only. Filesystem, sudo and AD-side rights are separate |
| Deleting a privilege | Roles that referenced it are not cleaned up; the role has one entry fewer |
Automount locations
Requires the automount module. The location, map and key structure, the standard on-demand home directory setup, enabling clients, and why the UI stops at locations.
Trusts
Requires the ad-trust module. The Trusts page shows and fine-tunes an established AD trust, including trust type, trusted domains, UPN suffixes and SID blocklists, plus the NetBIOS name and fallback primary group in the global config. Creating the trust is CLI work.