Please keep freeipa-users@ in CC:

On to, 01 joulu 2016, Denis Müller wrote:
Sorry, but i still do not understand how can i apply a single HAC-Rule
to a single user. Editing a HBAC-Rule, there is no option to select an
As I said, there wouldn't any. The concept is that you need to have a
real LDAP object to include into the HBAC or SUDO rule and that object
must be a POSIX user or group.

We cannot map AD user to POSIX user this way yet, only to POSIX groups,
so in the HBAC rule you need to use POSIX group to add instead of AD
user (or IPA user).

[root@ipa01<mailto:root@ipa01> ~]# ipa group-show ad_users_external
 Gruppenname: ad_users_external
 Beschreibung: AD users external map
 Mitglied der Gruppen: ad_users
 Indirect Member of HBAC rule: ssh_rule
 External member:<>,<>

[root@ipa01<mailto:root@ipa01> ~]# ipa hbacrule-add-user
Regelname: ssh_rule
[Mitglied Benutzer]:<>
[Mitglied Gruppe]: ad_users_external
 Regelname: ssh_rule
 Aktiviert: TRUE
 Benutzergruppen: ad_users, ad_users_external
 Dienste: sshd
 Failed users/groups:
   Mitglied Benutzer:<>: no such entry
   Mitglied Gruppe:

Am Donnerstag, den 01.12.2016, 16:12 +0200 schrieb Alexander Bokovoy:

On to, 01 joulu 2016, Denis Müller wrote:

Hello Alexander,

thank you for reply. As i understand, working with ad users/groups works this 

ad_users => ad_users_external_group => ipa_users_group

So i can manage ipa_users_group to provide Sudo Rules etc.

But how can i provide rules to a single user? What would be the best way?

The same way -- by specifying user as part of the external group.

Check out this email, this topic is raised regularly:

/ Alexander Bokovoy

Manage your subscription for the Freeipa-users mailing list:
Go to for more info on the project

Reply via email to