In Red Hat Satellite 6, a user is a unique individual who can access and use the system. Every user has a profile, which contains information such as their name, email address, and password. The locations, organizations, and roles that are assigned to a Satellite user determine which objects they can view or manipulate within Satellite Server.

To create a user, navigate to Administer → Users. Click Create User. A page loads with the User, Preferences, Locations, Organizations, Roles, and SSH Keys tabs.

Figure 11.1: User creation options

In the User tab, specify the username, password, password verification, and Authorized by selection. The Authorized by field points to the service that provides user storage and authentication, such as an external LDAP server that is integrated. If you choose INTERNAL in the Authorized by field, then the user record is created in Satellite's internal database, which also requires entering a password. All other fields are optional for the user creation and can be updated later.

The selected values in the Locations and Organizations tabs limit the scope of which Satellite objects the user can access. Set the Default on login field to the most commonly used location and organization for that user. That default context is set each time that the user logs in. The user can switch to any other assigned location or organization after they log in.

Roles determine the Satellite resources that a user can access and manage within Satellite. A user can be assigned multiple roles, as specified in the Roles tab in the user's profile. The special Administrator role grants a user full access and permissions to Satellite Server.

SSH public keys can be assigned to a user on the SSH Keys tab. These keys can be deployed on systems that the user provisioned, so that the user can log in without a password. Click Submit after all the tabs are completed and reviewed.

Administrators can edit or delete users by using the Administer → Users page. To edit a user, click the hyperlink in the Username field to access the user's profile. To delete a user account, click Delete in the Actions column.

Individual Satellite users are assigned roles that grant privileges to Satellite resources. As a Satellite administrator, you can create Satellite user groups to manage collections of Satellite users.

Manage user groups on the Administer → User Groups page. Click Create User Group. Provide a unique name, and then select users to be members of the group. User groups can also contain other user groups.

Administrators can edit or delete existing user groups on the Administer → User Groups page. To edit a user group, click the hyperlink in the Name field to access the user group's profile. To delete a user group, click Delete in the Actions column.

Red Hat Satellite uses Role Based Access Control (RBAC), to control which Satellite resources users can access, and which actions they can perform on those resources. Satellite is configured with predefined roles for standard Satellite tasks. Predefined roles are used for configuration management integration, and external tools can also use them. These predefined roles are locked to prevent changes.

Satellite administrators can create roles manually or by cloning and customizing any existing role, including predefined roles. You can assign a role to a user group to manage several user privileges without manually configuring each user. You can manage the roles that are assigned to a user group on the Administer → User Groups page. Click the user group to manage, and click the Roles tab.

To create a role, navigate to Administer → Roles and click Create Role. Enter a unique name, and then click Submit to create the role without filters. You must create the role before you can manage its filters.

An alternative way to create a role is to clone an existing one. Navigate to Administer → Roles and select Clone from the Actions list on the existing role's row. Enter a unique name, and then click Submit. The new role initially has the same filters as the original role.

Role filters grant permissions to Satellite resources. To manage role filters, click the role name on the Administer → Roles page, and then click the Filters tab. Existing filters for cloned roles appear as a list, and are sorted by resource type.

Existing role filters can be deleted or edited from the menu in the Actions column. Click New Filter to create a filter for the selected role. Grant access to a resource type by selecting it from the Resource Type menu. A list of available permissions is displayed for that resource. Each resource type has a list of valid user permissions for that type. Typically, permissions are available for viewing, creating, editing, and deleting.

By default, role filters apply to all resources of the selected type. Clearing the Unlimited? checkbox can provide more granular control. Clicking the Search field generates a menu of field names and operators to use to select resources. The syntax of this search expression is as follows:

field_name operator value

This expression limits the resources that this filter matches for this role.