<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 09/13/2014 04:03 PM, Traiano Welcome
wrote:<br>
</div>
<blockquote
cite="mid:CAFKCRVLCCkf=DiTHjp50VBTXBjyuQJfqHGHW4zDbRf54XrE68g@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Hi List</div>
<div> </div>
<div>Currently I have a stable trust relationship going between
IPA and Windows AD. I create users and manage passwords in AD,
but want to manage the rest in IPA, "the rest" being default
shell, default home directory settings, RBAC, HBAC, Selinux
etc ..</div>
<div> </div>
<div>What I'm expecting it to be able to log into the FreeIPA
web interface, and see a synched list of users created in AD
appear in the interface, after which I can modify the settings
on a per user basis. </div>
<div> </div>
<div>If that level of granularity is not possible, I would then
expect to be able to at least apply an IPA-imposed set of
account defaults on and AD user group:</div>
<div> </div>
<div>- default shell</div>
<div>- HBAC rules</div>
<div>- Sudo rules</div>
<div>- SELinux rules</div>
<div>- RBAC</div>
<div> </div>
<div>Is this possible with FreeIPA? I can't find anything
coherent in the documentation that describes an effective way
of managing the POSIX attributes of AD users in FreeIPA.</div>
<div> </div>
<div>Thanks in advance!</div>
<div>Traiano</div>
<div> </div>
<div> </div>
<div> </div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
You are to some extent describing a feature that we call "views"
that is currently in works.<br>
But there are two parts:<br>
a) Ability to overwrite POSIX attributes for AD users - this is
views<br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/3318">https://fedorahosted.org/freeipa/ticket/3318</a><br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/4509">https://fedorahosted.org/freeipa/ticket/4509</a><br>
b) Ability to apply policies to AD users. It is already possible.<br>
This is done via group membership.<br>
So you create a group in IPA, make AD group an external member of
that group and then use that IPA group to apply HBAC, SUDO and
SELinux rules.<br>
<br>
As for RBAC what do you mean?<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>