openSUSE admin

Easy to do :) what's the group name for users who on board and create new users? I'll grant it so that members of the "user create/onboard" group can modify the vpn group.

Hmm, which of the groups I am in allowed me to create the person? :-)

I'll make a user-onboarding group then too 🤣

I think you're part of idm_admins which gives you a lot of power to create accounts, but it's not a group I think we want everyone in.

Ah, sure, that makes sense.
But maybe make it something more generic, like "user-management" or similar? It might be good to have the same group be allowed to create and edit other groups and users.

Yep, that was the plan :)

Done. Users who need to onboard new accounts should be added as members of "user-management". user-management has the ability to create and modify people, create and modify groups, and to extend and assign unix/posix attributes. Additionally, user-management is now listed as the "owner" of the vpn group, and can add members to that group as required.

"user-management" can be extended by members of kanidm-admins, which today us yourself and myself.

Hopefully that solves the problems :)

PS: the vpn group is still controlled by freeipa - currently, to add members to the vpn group you need to do it on freeipa until we disable the freeipa sync. This is because the way Kanidm sync works is that we consider all the groups and users fed to us by freeipa as being owned by that provider, so until that authority is released kanidm can't alter that group.

Of course, no problem at all :)

You should be able to do that yourself with "kanidm group set-entry-manager ". So in this case I did "kanidm group set-entry-manager vpn user-management". That way you can delegate that user-management is the owner and has access to modify the vpn group.

Even better! :-)