selecting/limiting admin(s) within a declared super_realm

[foot3print]

Setup

Privacyidea 2.18
Ubuntu 16 xenial
mysql
apache2

• LDAP backend
• ALL TOKENS NO PIN (used userstore instead)

What I did

I tried creating policy for admins using the following parameters:

• scope: admin
• admin-realm: superuser (provided in pi.cfg)
• action: all (boxes all checked!)
• user-realm: domain-ldap
• user-resolver: ldap-backend
• admin: admin, mullgerb, pwblute (test accounts existing in ldap)

What I expect

I expected that the admin policy be created and be valid for the indicated users in "admin:"

Outcome

The policy is created BUT! afterwards upon logging in again with one the the ADMIN-USERS (admin, mullgerb, pwblute), I could not do anything except for viewing all tokens of users.

NOTE: I left a window-tab with the admin still logged in (added through first initialitaion using pi-manage) and tried to disable the created admin-policy and a red bubble threw an ERROR with:
"Admin actions are defined, but the action policydelete is not allowed!"

Conclusion/Question

• Is this suppose to happen??
• How would I add the role "admin" to my existing users(ldap)??
  If I create the admin-policy the initial admin (configured at start with pi-manage admin add admin admin@localhost) loose all the functions of a superuser admin. :-(

Regards,

[cornelinux]

The mailing list would be a great place to ask this question.
Please read this:
http://privacyidea.readthedocs.io/en/latest/policies/admin.html
This should cover your question. This should explain, how users from LDAP can get the admin role.

If you do not understand this, then obviously we have to improve this part of the documentation. Please tell, at which part we need to add some more details, so that we can improve this. Thanks a lot!

[foot3print]

@cornelinux

Thank for the immediate response! I was just about to comment additional infos on this, when I saw you reply. I had to test again.

This helped me understanding the connection between the declaration of a realm as SUPER_REALM - http://privacyidea.readthedocs.io/en/latest/faq/admins.html . Maybe include this as reference?

I was able to see the admin functions for my admin users but I still have one problem! :-( So, here is what I did;
NOTE: I only have one realm "myrealm" (with LDAP Resolver) aside from the default superuser when installing the server.
1- SUPER_REALM = ['superuser', 'myrealm'] in pi.cfg
2- I have a WebUI policy which has the parameter login_mode = privacyIDEA so that all logins via web will be authenticated against the privacyidea server.
3- I am able to login successfully against the server (user,pw + token) with my test admin account(s)!

BUT here is the problem. All of my users in LDAP became admins. :-( Is this possible with just one realm?

Update:

• We can limit as what @cornelinux said in the docs under admin policy scope:admin with the parameter Admin: 'youradmin'

The only drawback for me with this Setup is that my policy webui tokenwizard = true does not prompt when a user has NO TOKEN because I have a authentication policy which does passthru = userstore which is triggered when the user is added in the parameter user = 'user1', 'user2', 'user3'. I use this so I can impose the users to first mail me or the admin for an activation (for them to be allowed to use 2FA). If I just use the default SUPER_REALM = 'superuser' then I will have only the default 'admin' created from the pi-manage.

If ever there are ideas or better implementation/solution to my setup please do post a comment. Thanks a lot!

[cornelinux]

If you want LDAP users to be admin, you need to create a realm and declare this to be an admin realm.
E.g. if you have a realm "myrealm", with all your users, you should configure a second realm "it-department". At this point, both might be normal users.

Now got to pi.cfg and configure

 SUPERUSER_REALM = ["it-department"]

Users logging in as user@it-department will have the role admin.

Honestly, if you need any more help to setup your rather enterprizy environment, drop me a note!

[foot3print]

@cornelinux

thanks for your response! Ill try to figure this one out. Maybe Im missing some parameters in the policies i have.