mirror of
https://github.com/kanidm/kanidm.git
synced 2025-02-23 12:37:00 +01:00
419 lines
31 KiB
HTML
419 lines
31 KiB
HTML
<!DOCTYPE HTML>
|
|
<html lang="en" class="sidebar-visible no-js light">
|
|
<head>
|
|
<!-- Book generated using mdBook -->
|
|
<meta charset="UTF-8">
|
|
<title>Accounts and Groups - Kanidm Administration</title>
|
|
|
|
|
|
<!-- Custom HTML head -->
|
|
|
|
<meta name="description" content="">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="theme-color" content="#ffffff" />
|
|
|
|
<link rel="shortcut icon" href="favicon.png">
|
|
<link rel="stylesheet" href="css/variables.css">
|
|
<link rel="stylesheet" href="css/general.css">
|
|
<link rel="stylesheet" href="css/chrome.css">
|
|
<link rel="stylesheet" href="css/print.css" media="print">
|
|
|
|
<!-- Fonts -->
|
|
<link rel="stylesheet" href="FontAwesome/css/font-awesome.css">
|
|
<link rel="stylesheet" href="fonts/fonts.css">
|
|
|
|
<!-- Highlight.js Stylesheets -->
|
|
<link rel="stylesheet" href="highlight.css">
|
|
<link rel="stylesheet" href="tomorrow-night.css">
|
|
<link rel="stylesheet" href="ayu-highlight.css">
|
|
|
|
<!-- Custom theme stylesheets -->
|
|
|
|
</head>
|
|
<body>
|
|
<div id="body-container">
|
|
<!-- Provide site root to javascript -->
|
|
<script>
|
|
var path_to_root = "";
|
|
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "navy" : "light";
|
|
</script>
|
|
|
|
<!-- Work around some values being stored in localStorage wrapped in quotes -->
|
|
<script>
|
|
try {
|
|
var theme = localStorage.getItem('mdbook-theme');
|
|
var sidebar = localStorage.getItem('mdbook-sidebar');
|
|
|
|
if (theme.startsWith('"') && theme.endsWith('"')) {
|
|
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
|
|
}
|
|
|
|
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
|
|
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
|
|
}
|
|
} catch (e) { }
|
|
</script>
|
|
|
|
<!-- Set the theme before any content is loaded, prevents flash -->
|
|
<script>
|
|
var theme;
|
|
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
|
|
if (theme === null || theme === undefined) { theme = default_theme; }
|
|
var html = document.querySelector('html');
|
|
html.classList.remove('no-js')
|
|
html.classList.remove('light')
|
|
html.classList.add(theme);
|
|
html.classList.add('js');
|
|
</script>
|
|
|
|
<!-- Hide / unhide sidebar before it is displayed -->
|
|
<script>
|
|
var html = document.querySelector('html');
|
|
var sidebar = null;
|
|
if (document.body.clientWidth >= 1080) {
|
|
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
|
|
sidebar = sidebar || 'visible';
|
|
} else {
|
|
sidebar = 'hidden';
|
|
}
|
|
html.classList.remove('sidebar-visible');
|
|
html.classList.add("sidebar-" + sidebar);
|
|
</script>
|
|
|
|
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
|
|
<div class="sidebar-scrollbox">
|
|
<ol class="chapter"><li class="chapter-item expanded "><a href="intro.html"><strong aria-hidden="true">1.</strong> Introduction to Kanidm</a></li><li class="chapter-item expanded "><a href="installing_the_server.html"><strong aria-hidden="true">2.</strong> Installing the Server</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="choosing_a_domain_name.html"><strong aria-hidden="true">2.1.</strong> Choosing a Domain Name</a></li><li class="chapter-item expanded "><a href="prepare_the_server.html"><strong aria-hidden="true">2.2.</strong> Preparing for your Deployment</a></li><li class="chapter-item expanded "><a href="server_configuration.html"><strong aria-hidden="true">2.3.</strong> Server Configuration and Install</a></li><li class="chapter-item expanded "><a href="security_hardening.html"><strong aria-hidden="true">2.4.</strong> Platform Security Hardening</a></li><li class="chapter-item expanded "><a href="server_update.html"><strong aria-hidden="true">2.5.</strong> Server Updates</a></li></ol></li><li class="chapter-item expanded "><a href="client_tools.html"><strong aria-hidden="true">3.</strong> Client Tools</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="installing_client_tools.html"><strong aria-hidden="true">3.1.</strong> Installing client tools</a></li></ol></li><li class="chapter-item expanded "><li class="part-title">Administration</li><li class="chapter-item expanded "><a href="administrivia.html"><strong aria-hidden="true">4.</strong> Administration</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="accounts_and_groups.html" class="active"><strong aria-hidden="true">4.1.</strong> Accounts and Groups</a></li><li class="chapter-item expanded "><a href="authentication.html"><strong aria-hidden="true">4.2.</strong> Authentication and Credentials</a></li><li class="chapter-item expanded "><a href="posix_accounts.html"><strong aria-hidden="true">4.3.</strong> POSIX Accounts and Groups</a></li><li class="chapter-item expanded "><a href="backup_restore.html"><strong aria-hidden="true">4.4.</strong> Backup and Restore</a></li><li class="chapter-item expanded "><a href="database_maint.html"><strong aria-hidden="true">4.5.</strong> Database Maintenance</a></li><li class="chapter-item expanded "><a href="domain_rename.html"><strong aria-hidden="true">4.6.</strong> Domain Rename</a></li><li class="chapter-item expanded "><a href="monitoring.html"><strong aria-hidden="true">4.7.</strong> Monitoring the platform</a></li><li class="chapter-item expanded "><a href="password_quality.html"><strong aria-hidden="true">4.8.</strong> Password Quality and Badlisting</a></li><li class="chapter-item expanded "><a href="recycle_bin.html"><strong aria-hidden="true">4.9.</strong> The Recycle Bin</a></li></ol></li><li class="chapter-item expanded "><li class="part-title">Services</li><li class="chapter-item expanded "><a href="integrations/pam_and_nsswitch.html"><strong aria-hidden="true">5.</strong> PAM and nsswitch</a></li><li class="chapter-item expanded "><a href="ssh_key_dist.html"><strong aria-hidden="true">6.</strong> SSH Key Distribution</a></li><li class="chapter-item expanded "><a href="integrations/oauth2.html"><strong aria-hidden="true">7.</strong> Oauth2</a></li><li class="chapter-item expanded "><a href="integrations/ldap.html"><strong aria-hidden="true">8.</strong> LDAP</a></li><li class="chapter-item expanded "><a href="integrations/radius.html"><strong aria-hidden="true">9.</strong> RADIUS</a></li><li class="chapter-item expanded affix "><li class="part-title">Synchronisation</li><li class="chapter-item expanded "><a href="sync/concepts.html"><strong aria-hidden="true">10.</strong> Concepts</a></li><li class="chapter-item expanded "><a href="sync/freeipa.html"><strong aria-hidden="true">11.</strong> FreeIPA</a></li><li class="chapter-item expanded affix "><li class="part-title">Integration Examples</li><li class="chapter-item expanded "><a href="examples/k8s_ingress_example.html"><strong aria-hidden="true">12.</strong> Kubernetes Ingress</a></li><li class="chapter-item expanded "><a href="integrations/traefik.html"><strong aria-hidden="true">13.</strong> Traefik</a></li><li class="chapter-item expanded affix "><li class="part-title">Support</li><li class="chapter-item expanded "><a href="troubleshooting.html"><strong aria-hidden="true">14.</strong> Troubleshooting</a></li><li class="chapter-item expanded "><a href="frequently_asked_questions.html"><strong aria-hidden="true">15.</strong> Frequently Asked Questions</a></li><li class="chapter-item expanded "><a href="glossary.html"><strong aria-hidden="true">16.</strong> Glossary of Technical Terms</a></li><li class="chapter-item expanded affix "><li class="part-title">For Developers</li><li class="chapter-item expanded "><a href="DEVELOPER_README.html"><strong aria-hidden="true">17.</strong> Developer Guide</a></li><li class="chapter-item expanded "><a href="developers/faq.html"><strong aria-hidden="true">18.</strong> FAQ</a></li><li class="chapter-item expanded "><div><strong aria-hidden="true">19.</strong> Design Documents</div></li><li><ol class="section"><li class="chapter-item expanded "><a href="developers/designs/access_profiles_rework_2022.html"><strong aria-hidden="true">19.1.</strong> Access Profiles 2022</a></li><li class="chapter-item expanded "><a href="developers/designs/access_profiles_and_security.html"><strong aria-hidden="true">19.2.</strong> Access Profiles Original</a></li><li class="chapter-item expanded "><a href="developers/designs/rest_interface.html"><strong aria-hidden="true">19.3.</strong> REST Interface</a></li><li class="chapter-item expanded "><a href="developers/designs/elevated_priv_mode.html"><strong aria-hidden="true">19.4.</strong> Elevated Priv Mode</a></li><li class="chapter-item expanded "><a href="developers/designs/oauth2_refresh_tokens.html"><strong aria-hidden="true">19.5.</strong> Oauth2 Refresh Tokens</a></li></ol></li><li class="chapter-item expanded "><a href="developers/python.html"><strong aria-hidden="true">20.</strong> Python Module</a></li><li class="chapter-item expanded "><a href="developers/radius.html"><strong aria-hidden="true">21.</strong> RADIUS Integration</a></li><li class="chapter-item expanded "><a href="packaging.html"><strong aria-hidden="true">22.</strong> Packaging</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="packaging_debs.html"><strong aria-hidden="true">22.1.</strong> Debian/Ubuntu</a></li></ol></li></ol>
|
|
</div>
|
|
<div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
|
|
</nav>
|
|
|
|
<div id="page-wrapper" class="page-wrapper">
|
|
|
|
<div class="page">
|
|
<div id="menu-bar-hover-placeholder"></div>
|
|
<div id="menu-bar" class="menu-bar sticky bordered">
|
|
<div class="left-buttons">
|
|
<button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
|
|
<i class="fa fa-bars"></i>
|
|
</button>
|
|
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
|
|
<i class="fa fa-paint-brush"></i>
|
|
</button>
|
|
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
|
|
<li role="none"><button role="menuitem" class="theme" id="light">Light</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
|
|
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
|
|
</ul>
|
|
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
|
|
<i class="fa fa-search"></i>
|
|
</button>
|
|
</div>
|
|
|
|
<h1 class="menu-title">Kanidm Administration</h1>
|
|
|
|
<div class="right-buttons">
|
|
<a href="print.html" title="Print this book" aria-label="Print this book">
|
|
<i id="print-button" class="fa fa-print"></i>
|
|
</a>
|
|
<a href="https://github.com/kanidm/kanidm" title="Git repository" aria-label="Git repository">
|
|
<i id="git-repository-button" class="fa fa-github"></i>
|
|
</a>
|
|
<a href="https://github.com/kanidm/kanidm/edit/master/book/src/accounts_and_groups.md" title="Suggest an edit" aria-label="Suggest an edit">
|
|
<i id="git-edit-button" class="fa fa-edit"></i>
|
|
</a>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="search-wrapper" class="hidden">
|
|
<form id="searchbar-outer" class="searchbar-outer">
|
|
<input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
|
|
</form>
|
|
<div id="searchresults-outer" class="searchresults-outer hidden">
|
|
<div id="searchresults-header" class="searchresults-header"></div>
|
|
<ul id="searchresults">
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
|
|
<script>
|
|
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
|
|
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
|
|
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
|
|
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
|
|
});
|
|
</script>
|
|
|
|
<div id="content" class="content">
|
|
<main>
|
|
<h1 id="accounts-and-groups"><a class="header" href="#accounts-and-groups">Accounts and groups</a></h1>
|
|
<p>Accounts and Groups are the primary reasons for Kanidm to exist. Kanidm is optimised as a repository
|
|
for these data. As a result, there are many concepts and important details to understand.</p>
|
|
<h2 id="service-accounts-vs-person-accounts"><a class="header" href="#service-accounts-vs-person-accounts">Service Accounts vs Person Accounts</a></h2>
|
|
<p>Kanidm separates accounts into two types. Person accounts (or persons) are intended for use by
|
|
humans that will access the system in an interactive way. Service accounts are intended for use by
|
|
computers or services that need to identify themself to Kanidm. Generally a person or group of
|
|
persons will be responsible for and will manage service accounts. Because of this distinction these
|
|
classes of accounts have different properties and methods of authentication and management.</p>
|
|
<h2 id="groups"><a class="header" href="#groups">Groups</a></h2>
|
|
<p>Groups represent a collection of entities. This generally is a collection of persons or service
|
|
accounts. Groups are commonly used to assign privileges to the accounts that are members of a group.
|
|
This allows easier administration over larger systems where privileges can be assigned to groups in
|
|
a logical manner, and then only membership of the groups need administration, rather than needing to
|
|
assign privileges to each entity directly and uniquely.</p>
|
|
<p>Groups may also be nested, where a group can contain another group as a member. This allows
|
|
hierarchies to be created again for easier administration.</p>
|
|
<h2 id="default-accounts-and-groups"><a class="header" href="#default-accounts-and-groups">Default Accounts and Groups</a></h2>
|
|
<p>Kanidm ships with a number of default service accounts and groups. This is to give you the best
|
|
out-of-box experience possible, as well as supplying best practice examples related to modern
|
|
Identity Management (IDM) systems.</p>
|
|
<p>There are two builtin system administration accounts.</p>
|
|
<p><code>admin</code> is the default service account which has privileges to configure and administer kanidm as a
|
|
whole. This account can manage access controls, schema, integrations and more. However the <code>admin</code>
|
|
can not manage persons by default to separate the privileges. As this is a service account is is
|
|
intended for limited use.</p>
|
|
<p><code>idm_admin</code> is the default service account which has privileges to create persons and to manage
|
|
these accounts and groups. They can perform credential resets and more.</p>
|
|
<p>Both the <code>admin</code> and the <code>idm_admin</code> user should <em>NOT</em> be used for daily activities - they exist for
|
|
initial system configuration, and for disaster recovery scenarios. You should delegate permissions
|
|
as required to named user accounts instead.</p>
|
|
<p>The majority of the builtin groups are privilege groups that provide rights over Kanidm
|
|
administrative actions. These include groups for account management, person management (personal and
|
|
sensitive data), group management, and more.</p>
|
|
<h2 id="recovering-the-initial-admin-accounts"><a class="header" href="#recovering-the-initial-admin-accounts">Recovering the Initial Admin Accounts</a></h2>
|
|
<p>By default the <code>admin</code> and <code>idm_admin</code> accounts have no password, and can not be accessed. They need
|
|
to be "recovered" from the server that is running the kanidmd server.</p>
|
|
<p>You should have already recovered the admin account during your setup process. If not refer to the
|
|
<a href="server_configuration.html#default-admin-account">server configuration chapter</a> on how to recover this
|
|
account.</p>
|
|
<p>Once you have access to the admin account, it is able to reset the credentials of the <code>idm_admin</code>
|
|
account.</p>
|
|
<pre><code class="language-bash">kanidm login -D admin
|
|
kanidm service-account credential generate -D admin idm_admin
|
|
# Success: wJX...
|
|
</code></pre>
|
|
<p>These accounts will be used through the remainder of this document for managing the server.</p>
|
|
<h2 id="viewing-default-groups"><a class="header" href="#viewing-default-groups">Viewing Default Groups</a></h2>
|
|
<p>You should take some time to inspect the default groups which are related to default permissions.
|
|
These can be viewed with:</p>
|
|
<pre><code class="language-bash">kanidm group list
|
|
kanidm group get <name>
|
|
</code></pre>
|
|
<h2 id="creating-person-accounts"><a class="header" href="#creating-person-accounts">Creating Person Accounts</a></h2>
|
|
<p>By default <code>idm_admin</code> has the privileges to create new persons in the system.</p>
|
|
<pre><code class="language-bash">kanidm login --name idm_admin
|
|
kanidm person create demo_user "Demonstration User" --name idm_admin
|
|
kanidm person get demo_user --name idm_admin
|
|
|
|
kanidm group create demo_group --name idm_admin
|
|
kanidm group add-members demo_group demo_user --name idm_admin
|
|
kanidm group list-members demo_group --name idm_admin
|
|
</code></pre>
|
|
<p>You can also use anonymous to view accounts and groups - note that you won't see certain fields due
|
|
to the limits of the access control anonymous access profile.</p>
|
|
<pre><code class="language-bash">kanidm login --name anonymous
|
|
kanidm person get demo_user --name anonymous
|
|
</code></pre>
|
|
<p>Kanidm allows person accounts to include human related attributes, such as their legal name and
|
|
email address.</p>
|
|
<p>Initially, a person does not have these attributes. If desired, a person may be modified to have
|
|
these attributes.</p>
|
|
<pre><code class="language-bash"># Note, both the --legalname and --mail flags may be omitted
|
|
kanidm person update demo_user --legalname "initial name" --mail "initial@email.address"
|
|
</code></pre>
|
|
<!-- deno-fmt-ignore-start -->
|
|
<p>{{#template templates/kani-warning.md
|
|
imagepath=images
|
|
title=Warning!
|
|
text=Persons may change their own displayname, name, and legal name at any time. You MUST NOT use these values as primary keys in external systems. You MUST use the <code>uuid</code> attribute present on all entries as an external primary key.
|
|
}}</p>
|
|
<!-- deno-fmt-ignore-end -->
|
|
<h2 id="creating-service-accounts"><a class="header" href="#creating-service-accounts">Creating Service Accounts</a></h2>
|
|
<p>The <code>admin</code> service account can be used to create service accounts.</p>
|
|
<pre><code class="language-bash">kanidm service-account create demo_service "Demonstration Service" --name admin
|
|
kanidm service-account get demo_service --name admin
|
|
</code></pre>
|
|
<h2 id="using-api-tokens-with-service-accounts"><a class="header" href="#using-api-tokens-with-service-accounts">Using API Tokens with Service Accounts</a></h2>
|
|
<p>Service accounts can have api tokens generated and associated with them. These tokens can be used
|
|
for identification of the service account, and for granting extended access rights where the service
|
|
account may previously have not had the access. Additionally service accounts can have expiry times
|
|
and other auditing information attached.</p>
|
|
<p>To show api tokens for a service account:</p>
|
|
<pre><code class="language-bash">kanidm service-account api-token status --name admin ACCOUNT_ID
|
|
kanidm service-account api-token status --name admin demo_service
|
|
</code></pre>
|
|
<p>By default api tokens are issued to be "read only", so they are unable to make changes on behalf of
|
|
the service account they represent. To generate a new read only api token:</p>
|
|
<pre><code class="language-bash">kanidm service-account api-token generate --name admin ACCOUNT_ID LABEL [EXPIRY]
|
|
kanidm service-account api-token generate --name admin demo_service "Test Token"
|
|
kanidm service-account api-token generate --name admin demo_service "Test Token" 2020-09-25T11:22:02+10:00
|
|
</code></pre>
|
|
<p>If you wish to issue a token that is able to make changes on behalf of the service account, you must
|
|
add the "--rw" flag during the generate command. It is recommended you only add --rw when the
|
|
api-token is performing writes to Kanidm.</p>
|
|
<pre><code class="language-bash">kanidm service-account api-token generate --name admin ACCOUNT_ID LABEL [EXPIRY] --rw
|
|
kanidm service-account api-token generate --name admin demo_service "Test Token" --rw
|
|
kanidm service-account api-token generate --name admin demo_service "Test Token" 2020-09-25T11:22:02+10:00 --rw
|
|
</code></pre>
|
|
<p>To destroy (revoke) an api token you will need it's token id. This can be shown with the "status"
|
|
command.</p>
|
|
<pre><code class="language-bash">kanidm service-account api-token destroy --name admin ACCOUNT_ID TOKEN_ID
|
|
kanidm service-account api-token destroy --name admin demo_service 4de2a4e9-e06a-4c5e-8a1b-33f4e7dd5dc7
|
|
</code></pre>
|
|
<p>Api tokens can also be used to gain extended search permissions with LDAP. To do this you can bind
|
|
with a dn of <code>dn=token</code> and provide the api token in the password.</p>
|
|
<pre><code class="language-bash">ldapwhoami -H ldaps://URL -x -D "dn=token" -w "TOKEN"
|
|
ldapwhoami -H ldaps://idm.example.com -x -D "dn=token" -w "..."
|
|
# u: demo_service@idm.example.com
|
|
</code></pre>
|
|
<h2 id="resetting-service-account-credentials-deprecated"><a class="header" href="#resetting-service-account-credentials-deprecated">Resetting Service Account Credentials (Deprecated)</a></h2>
|
|
<!-- deno-fmt-ignore-start -->
|
|
<p>{{#template templates/kani-warning.md
|
|
imagepath=images
|
|
text=Api Tokens are a better method to manage credentials for service accounts, and passwords may be removed in the future!
|
|
}}</p>
|
|
<!-- deno-fmt-ignore-end -->
|
|
<p>Service accounts can not have their credentials interactively updated in the same manner as persons.
|
|
Service accounts may only have server side generated high entropy passwords.</p>
|
|
<p>To re-generate this password to an account</p>
|
|
<pre><code class="language-bash">kanidm service-account credential generate demo_service --name admin
|
|
</code></pre>
|
|
<h2 id="nested-groups"><a class="header" href="#nested-groups">Nested Groups</a></h2>
|
|
<p>Kanidm supports groups being members of groups, allowing nested groups. These nesting relationships
|
|
are shown through the "memberof" attribute on groups and accounts.</p>
|
|
<p>Kanidm makes all group membership determinations by inspecting an entry's "memberof" attribute.</p>
|
|
<p>An example can be easily shown with:</p>
|
|
<pre><code class="language-bash">kanidm group create group_1 --name idm_admin
|
|
kanidm group create group_2 --name idm_admin
|
|
kanidm person create nest_example "Nesting Account Example" --name idm_admin
|
|
kanidm group add-members group_1 group_2 --name idm_admin
|
|
kanidm group add-members group_2 nest_example --name idm_admin
|
|
kanidm person get nest_example --name anonymous
|
|
</code></pre>
|
|
<h2 id="account-validity"><a class="header" href="#account-validity">Account Validity</a></h2>
|
|
<p>Kanidm supports accounts that are only able to authenticate between a pair of dates and times; the
|
|
"valid from" and "expires" timestamps define these points in time.</p>
|
|
<p>This can be displayed with:</p>
|
|
<pre><code class="language-bash">kanidm person validity show demo_user --name idm_admin
|
|
valid after: 2020-09-25T21:22:04+10:00
|
|
expire: 2020-09-25T01:22:04+10:00
|
|
</code></pre>
|
|
<p>These datetimes are stored in the server as UTC, but presented according to your local system time
|
|
to aid correct understanding of when the events will occur.</p>
|
|
<p>To set the values, an account with account management permission is required (for example,
|
|
idm_admin).</p>
|
|
<p>You may set these time and date values in any timezone you wish (such as your local timezone), and
|
|
the server will transform these to UTC. These time values are in iso8601 format, and you should
|
|
specify this as:</p>
|
|
<pre><code class="language-shell">YYYY-MM-DDThh:mm:ssZ+-hh:mm
|
|
Year-Month-Day T hour:minutes:seconds Z +- timezone offset
|
|
</code></pre>
|
|
<p>Set the earliest time the account can start authenticating:</p>
|
|
<pre><code class="language-bash">kanidm person validity begin_from demo_user '2020-09-25T11:22:04+00:00' --name idm_admin
|
|
</code></pre>
|
|
<p>Set the expiry or end date of the account:</p>
|
|
<pre><code class="language-bash">kanidm person validity expire_at demo_user '2020-09-25T11:22:04+00:00' --name idm_admin
|
|
</code></pre>
|
|
<p>To unset or remove these values the following can be used, where <code>any|clear</code> means you may use
|
|
either <code>any</code> or <code>clear</code>.</p>
|
|
<pre><code class="language-bash">kanidm person validity begin_from demo_user any|clear --name idm_admin
|
|
kanidm person validity expire_at demo_user never|clear --name idm_admin
|
|
</code></pre>
|
|
<p>To "lock" an account, you can set the expire_at value to the past, or unix epoch. Even in the
|
|
situation where the "valid from" is <em>after</em> the expire_at, the expire_at will be respected.</p>
|
|
<pre><code class="language-bash">kanidm person validity expire_at demo_user 1970-01-01T00:00:00+00:00 --name idm_admin
|
|
</code></pre>
|
|
<p>These validity settings impact all authentication functions of the account (kanidm, ldap, radius).</p>
|
|
<h3 id="allowing-people-accounts-to-change-their-mail-attribute"><a class="header" href="#allowing-people-accounts-to-change-their-mail-attribute">Allowing people accounts to change their mail attribute</a></h3>
|
|
<p>By default, Kanidm allows an account to change some attributes, but not their mail address.</p>
|
|
<p>Adding the user to the <code>idm_people_self_write_mail</code> group, as shown below, allows the user to edit
|
|
their own mail.</p>
|
|
<pre><code class="language-bash">kanidm group add-members idm_people_self_write_mail_priv demo_user --name idm_admin
|
|
</code></pre>
|
|
<h2 id="why-cant-i-change-admin-with-idm_admin"><a class="header" href="#why-cant-i-change-admin-with-idm_admin">Why Can't I Change admin With idm_admin?</a></h2>
|
|
<p>As a security mechanism there is a distinction between "accounts" and "high permission accounts".
|
|
This is to help prevent elevation attacks, where say a member of a service desk could attempt to
|
|
reset the password of idm_admin or admin, or even a member of HR or System Admin teams to move
|
|
laterally.</p>
|
|
<p>Generally, membership of a "privilege" group that ships with Kanidm, such as:</p>
|
|
<ul>
|
|
<li>idm_account_manage_priv</li>
|
|
<li>idm_people_read_priv</li>
|
|
<li>idm_schema_manage_priv</li>
|
|
<li>many more ...</li>
|
|
</ul>
|
|
<p>...indirectly grants you membership to "idm_high_privilege". If you are a member of this group,
|
|
the standard "account" and "people" rights groups are NOT able to alter, read or manage these
|
|
accounts. To manage these accounts higher rights are required, such as those held by the admin
|
|
account are required.</p>
|
|
<p>Further, groups that are considered "idm_high_privilege" can NOT be managed by the standard
|
|
"idm_group_manage_priv" group.</p>
|
|
<p>Management of high privilege accounts and groups is granted through the the "hp" variants of all
|
|
privileges. A non-conclusive list:</p>
|
|
<ul>
|
|
<li>idm_hp_account_read_priv</li>
|
|
<li>idm_hp_account_manage_priv</li>
|
|
<li>idm_hp_account_write_priv</li>
|
|
<li>idm_hp_group_manage_priv</li>
|
|
<li>idm_hp_group_write_priv</li>
|
|
</ul>
|
|
<p>Membership of any of these groups should be considered to be equivalent to system administration
|
|
rights in the directory, and by extension, over all network resources that trust Kanidm.</p>
|
|
<p>All groups that are flagged as "idm_high_privilege" should be audited and monitored to ensure that
|
|
they are not altered.</p>
|
|
|
|
</main>
|
|
|
|
<nav class="nav-wrapper" aria-label="Page navigation">
|
|
<!-- Mobile navigation buttons -->
|
|
<a rel="prev" href="administrivia.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
|
|
<i class="fa fa-angle-left"></i>
|
|
</a>
|
|
|
|
<a rel="next" href="authentication.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
|
|
<i class="fa fa-angle-right"></i>
|
|
</a>
|
|
|
|
<div style="clear: both"></div>
|
|
</nav>
|
|
</div>
|
|
</div>
|
|
|
|
<nav class="nav-wide-wrapper" aria-label="Page navigation">
|
|
<a rel="prev" href="administrivia.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
|
|
<i class="fa fa-angle-left"></i>
|
|
</a>
|
|
|
|
<a rel="next" href="authentication.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
|
|
<i class="fa fa-angle-right"></i>
|
|
</a>
|
|
</nav>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<script>
|
|
window.playground_copyable = true;
|
|
</script>
|
|
|
|
|
|
<script src="elasticlunr.min.js"></script>
|
|
<script src="mark.min.js"></script>
|
|
<script src="searcher.js"></script>
|
|
|
|
<script src="clipboard.min.js"></script>
|
|
<script src="highlight.js"></script>
|
|
<script src="book.js"></script>
|
|
|
|
<!-- Custom JS scripts -->
|
|
|
|
|
|
</div>
|
|
</body>
|
|
</html>
|