Red Hat Satellite 6 Administration

Instructions

The Operations organization wants to delegate user administration to specific Satellite users without permitting other Satellite Administrator privileges. A designated Satellite user can create users and view existing users, but is not permitted to delete users, within the Operations organization.

Create an ops-user-admin role. Create a user-admin user with redhat as the password in the Operations organization. Then, assign the ops-user-admins role. Use the user-admin user to test creating an example intern034 user with default permissions. Verify that the user-admin user cannot delete users.

1. Log in to the Satellite Server web UI, https://satellite.lab.example.com, as the admin user with redhat as the password.

2. In the upper-left corner of the web page, set the organization to Operations. Set the location to Any Location.

3. Create the ops-user-admin role by cloning the System admin role, and then by editing the cloned role.

   1. Click Administer → Roles. Only the first 20 predefined roles are displayed. The roles with a lock icon cannot be changed, and must be cloned to create a role with similar privileges.

   2. In the list of roles, locate the predefined System admin role that manages users, roles, organizations, locations, and other resources. In the System admin row, click the down-arrow icon to the right of the Filters button, and then select Clone from the list.

   3. In the Create Role page, enter ops-user-admin in the Name field. In the selection tool, click the Operations organization to move it to the Selected items list. Leave the other fields unchanged, and then click Submit.

4. Restrict the ops-user-admin role to create and edit but not delete users.

   1. In the Roles table, locate the ops-user-admin role and click Filters. The role resource page is displayed.

   2. Keep the Filter, Location, Role, (Miscellaneous), Organization, and User resources. Remove the other resources from the role's filter table. For each resource, select Delete from the Edit list in the Actions column, and then click Confirm.

   3. Modify the Location resource by clicking Edit on the resource row. Keep the assign_locations and view_locations permissions in the Selected items list. Remove the other permissions by clicking each permission to move it to the All items list. Click Submit.

   4. Modify the Role resource by clicking Edit on the resource row. Keep the view_roles permissions in the Selected items list. Remove the other permissions by clicking each permission to move it to the All items list. Click Submit.

   5. Modify the Organization resource by clicking Edit on the resource row. Keep the assign_organizations and view_organizations permissions in the Selected items list. Remove the other permissions by clicking each permission to move it to the All items list. Click Submit.

   6. Modify the User resource by clicking Edit on the resource row. Keep the create_users, edit_users, and view_users permissions in the Selected items list. Remove the other permissions by clicking each permission to move it to the All items list. Click Submit.

5. Create a user-admin user with redhat as the password. Restrict the account to access only the Operations organization. Assign the ops-user-admin role to the user-admin user.

   1. Click Administer → Users, and then click Create User. On the User tab, enter the information for the following fields. Leave the other fields unchanged.

      Field	Value
      Username	user-admin
      Email Address	root@satellite.lab.example.com
      Authorized by	INTERNAL
      Password	redhat
      Verify	redhat

   2. Click the Organizations tab. Edit the organizations so that the Operations organization is in the Selected items list, and all other organizations are in the All items list. Select Operations in the Default on login list.

   3. Click the Locations tab. Click Boston to move it to the Selected items list. Select Boston in the Default on login field. Click Submit.

   4. Click the Roles tab. Click ops-user-admin to move it to the Selected items list. Click Submit.

6. Log in as the user-admin user and test the ops-user-admin role by creating the intern034 user.

   1. In the Satellite web UI, log out of the admin user. Log in as the user-admin user with redhat as the password.

      A "Permission denied" screen is displayed, because the user-admin user does not have permission for the default Hosts → All Hosts page. Only the Monitor, Configure, and Administer menus are available to this user.

   2. In the upper-left corner of the web page, set the organization to Operations. Set the location to Boston.

   3. Click Administer → Users. Only the user-admin user appears in the list, because this user can view only the users in the Operations organization.

   4. Click Create User. On the User tab, enter the information for the following fields. Leave the other fields unchanged.

      Field	Value
      Username	intern034
      Email Address	root@satellite.lab.example.com
      Authorized by	INTERNAL
      Password	temp123
      Verify	temp123

   5. Click the Roles tab. Click Remote Execution User to move it to the Selected items list. Click Submit.

7. Test the intern034 user.

   1. In the Satellite web UI, log out of the user-admin user. Log in as the intern034 user with temp123 as the password.

   2. The intern034 user has access to a limited menu. The menu includes only the Monitor, Content, Hosts, Infrastructure, and Administer tabs.

   3. Log out of the intern034 account.