<div dir="ltr">Hi,<div><br>thank you for answering.<br><br>I this case i need to create multiple group in AD side. like user1 have only "<a href="http://server1.example.com">server1.example.com</a>" and "<a href="http://server2.example.com">server2.example.com</a>" access and some other user have some other server access. Then only the my <span style="color:rgb(31,73,125);font-family:calibri,sans-serif;font-size:11pt">HBAC</span></div><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">rule will be </span><font color="#500050"><span style="font-size:12.8px">implemented to particular group </span></font>and every time i need to add user in AD side on <span style="color:rgb(80,0,80);font-size:12.8px">particular </span>group if I want to give some other server access to user. And i don't want do like this.<div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 12, 2016 at 11:05 AM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On ke, 12 loka 2016, rajat gupta wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
Normally HBAC for AD users should be done through an external group.<br>
</blockquote></span>
You should use freeipa-users@ mailing list for these questions.<br>
<br>
And start with documentation: <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html-single/Linux_Domain_Identity_Authentication_and_Policy_Guide/index.html" rel="noreferrer" target="_blank">https://access.redhat.com/docu<wbr>mentation/en-US/Red_Hat_Enterp<wbr>rise_Linux/7/html-single/<wbr>Linux_Domain_Identity_Authenti<wbr>cation_and_Policy_Guide/index.<wbr>html</a><br>
<a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html-single/Windows_Integration_Guide/index.html" rel="noreferrer" target="_blank">https://access.redhat.com/docu<wbr>mentation/en-US/Red_Hat_Enterp<wbr>rise_Linux/7/html-single/<wbr>Windows_Integration_Guide/<wbr>index.html</a><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
<br>
So for example if we have 500+ users on AD and only 100 user are<br>
administrator and they have Linux server access.<br>
<br>
I want to set the HBAC and sudo rules for users. So user have correct<br></span>
access server access and sudo rights and I am using the *Active Directory<br>
trust setup*<span class=""><br>
<br>
In this case i need to add all of the 100 users on in Freeipa as external<br>
group.<br>
<br>
for example :- user1 user name in AD<br>
<br></span>
*user1-external* external group in IPA for trusted domain users<br>
*user1 :- *POSIX group for external<br>
</blockquote>
No, you don't need to do that. All you need to do is to create a group<br>
on AD side where your users to access Linux systems would be added and<br>
then add that group to the external group on IPA side.<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Do we have document for implementing the HBAC and Sudo Rules for external<br>
group.<br>
</blockquote></span>
See above documentation and discussions on freeipa-users@ mailing list.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Rajat Gupta<br>
</b><b><img style="margin:0pt 0.2ex;vertical-align:middle" src="http://../1/e/330"></b></div></div>
</div>