<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/17/2015 12:11 PM, Ash Alam wrote:<br>
</div>
<blockquote
cite="mid:CAMdkwX6ZUQsDPOJ2Qzkzs_60UkYJahdkyNtT6V4AdEzz4cfKQw@mail.gmail.com"
type="cite">
<div dir="ltr">Hello
<div><br>
</div>
<div>I wanted to get some input on what your approach is for
admin accounts. In the past i approached it where you have a
user `John Doe` he has a normal user account for everyday
tasks (wifi, anything that talks ldap). He also has an admin
account for when he needs to administer ipa, active directory
etc.</div>
<div><br>
</div>
<div>There are few groups of thought around this. Mine being
that admin permissions should not be granted to accounts that
are not specifically create to administer ipa/ad. I have
worked at places where admin and user accounts were one in the
same and others where they were separated. </div>
<div><br>
</div>
<div>Currently i have an opportunity to start fresh and wanted
to get some input as to what the best approach would be.
Freeipa and its developers are security conscious and its
built around security so getting your though on this would be
great.</div>
<div><br>
</div>
<div>Thank You</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
I do not think there is a clear cut rule you can follow. This is why
you have the experience with both approaches. <br>
The question that I would ask is how significantly the
administrative activity is logically segregated from end user
activity in your environment.<br>
If there are a lot of areas that only special accounts can get to
and no end user can routinely access then probably having a logical
separation of the accounts would be better.<br>
If admins and users can access the same systems and applications and
just have different privileges then you need to focus on access
control anyways so having separate accounts would be more overhead
than gain.<br>
<br>
But this is just my take on this. Others might disagree. <br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>