Q&A: Is there more flexibility for delegation of user rights management

[DirkS]

Question

Is there more flexibility for delegation of user rights management?
Helpdesk admins should be able to do that or that without becoming complete Domain Admin.

Answer

In the current versions of UCS only ship with LDAP-ACLs for a basic Active Directory style role model, but as requests for more flexibility often reach us, it is planned to offer additional roles to support more granular delegation of users rights management to give more flexibility for Administrators right out of the box. Currently this needs to be done by extending ACLs in OpenLDAP, which are quite complex and require a certain level of experience and thorough testing to avoid performance regressions.

Until this is done, perhaps this helps you:

Only domain admins can reset user passwords

Problem: Per default only members of “Domain Admins” have the right to change user passwords Often there is the need of a delegated helpdesk (or servicedesk) user group which only can reset user passwords - without all domain admin rights. Solution: Install univention-admingrp-user-passwordreset The idea behind this extension is a new group called “User Password Admins”. It will be created automatically. Members of this group will only see the users module in UMC and they will be able to c…

Delegating right to join Windows clients in Samba 4 domains

This article describes how to delegate the administrative task of joining Windows clients into an Samba 4 / Active Directory domain. For example a user “domjoin” in the top OU “Users” who is only member of the “Domain User” group in UCS LDAP can be created beforehand for this. The Active Directory access control model allows delegation of specific administrative tasks affecting a defined scope of the content of the Active Directory to selected users or groups. The following steps can be used t…