Ńň
Ă#xPc @ sş d d k Td d k l Z l Z l Z l Z d d k l Z d d k l Z e d Z d e
f d YZ e i e d e
f d YZ e i e d
e f d YZ e i e d e f d
YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d S( i˙˙˙˙( t *( t apit Strt _t ngettext( t Command( t privileges\
Roles
A role is used for fine-grained delegation. A permission grants the ability
to perform given low-level tasks (add a user, modify a group, etc.). A
privilege combines one or more permissions into a higher-level abstraction
such as useradmin. A useradmin would be able to add, delete and modify users.
Privileges are assigned to Roles.
Users, groups, hosts and hostgroups may be members of a Role.
Roles can not contain other roles.
EXAMPLES:
Add a new role:
ipa role-add --desc="Junior-level admin" junioradmin
Add some privileges to this role:
ipa role-add-privilege --privileges=addusers junioradmin
ipa role-add-privilege --privileges=change_password junioradmin
ipa role-add-privilege --privileges=add_user_to_default_group junioradmin
Add a group of users to this role:
ipa group-add --desc="User admins" useradmins
ipa role-add-member --groups=useradmins junioradmin
Display information about a role:
ipa role-show junioradmin
The result of this is that any users in the group 'junioradmin' can
add users, reset passwords or add a user to the default IPA user group.
t rolec
B ső e Z d Z e i i Z e d Z e d Z d d g Z
d d d d d d
g Z h d d d
d g d 6d g d 6Z h d g d 6Z
e Z e d Z e d Z e d d d d e d d e e d d d d e d d e d f Z RS( s
Role object.
R t rolest groupofnamest nestedgroupt cnt descriptiont membert memberoft memberindirectt memberofindirectt usert groupt hostt hostgroupR t Rolest Rolet cli_namet namet labels Role namet primary_keyt desct Descriptiont docs A description of this role-group( t __name__t
__module__t __doc__R t envt container_rolegroupt container_dnR t object_namet object_name_pluralt object_classt default_attributest attribute_memberst reverse_memberst Truet rdn_is_primary_keyR t label_singularR t takes_params( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR = s.
t role_addc B s e Z e d Z e d Z RS( s Add a new role.s Added role "%(value)s"( R R R R t msg_summary( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR. d s t role_delc B s e Z e d Z e d Z RS( s Delete a role.s Deleted role "%(value)s"( R R R R R/ ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR0 l s t role_modc B s e Z e d Z e d Z RS( s Modify a role.s Modified role "%(value)s"( R R R R R/ ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR1 t s t role_findc B s& e Z e d Z e d d d Z RS( s Search for roles.s %(count)d role matcheds %(count)d roles matchedi ( R R R R R R/ ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR2 | s t role_showc B s e Z e d Z RS( s! Display information about a role.( R R R R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR3 s t role_add_memberc B s e Z e d Z RS( s Add members to a role.( R R R R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR4 s t role_remove_memberc B s e Z e d Z RS( s Remove members from a role.( R R R R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR5 s t role_add_privilegec B sz e Z e d Z d Z d Z d Z d Z e i d e i
d d e d e d e i
d
d e d e d f Z
RS( s Add privileges to a role.R3 t privilege_add_memberR R t resultt failedt typeR s Members that could not be addedt completeds Number of privileges added( R R R R t show_commandt member_commandt reverse_attrt member_attrt outputt Entryt Outputt dictt intt
has_output( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyR6 s t role_remove_privilegec B sz e Z e d Z d Z d Z d Z d Z e i d e i
d d e d e d e i
d
d e d e d f Z
RS( s Remove privileges from a role.R3 t privilege_remove_memberR R R8 R9 R: R s Members that could not be addedR; s Number of privileges removed( R R R R R< R= R> R? R@ RA RB RC RD RE ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyRF Ż s N( t ipalib.plugins.baseldapt ipalibR R R R R t ipalib.pluginsR R t
LDAPObjectR t registert
LDAPCreateR. t
LDAPDeleteR0 t
LDAPUpdateR1 t
LDAPSearchR2 t LDAPRetrieveR3 t
LDAPAddMemberR4 t LDAPRemoveMemberR5 t LDAPAddReverseMemberR6 t LDAPRemoveReverseMemberRF ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/role.pyt s2
"! $