Univention Corporate Server - Delegative administration documentation

Contents

• 1. Introduction
  • 1.1. Feedback
  • 1.2. Technical requirements
  • 1.3. Limits and known issues
  • 1.4. Features
  • 1.5. Roles for delegative administration
• 2. Concepts
  • 2.1. Basic idea
  • 2.2. Roles and context
  • 2.3. Definition of roles
  • 2.4. Examples for role definitions
  • 2.5. Evaluation of permissions
• 3. Set up a test environment
  • 3.1. Preparation
  • 3.2. Activate delegative administration
    • 3.2.1. UMC
    • 3.2.2. UDM HTTP REST API
  • 3.3. Test delegative administration
  • 3.4. Preparation for testing the default role for OUs
  • 3.5. Deactivate delegative administration
• 4. Configuration options
  • 4.1. Default roles
  • 4.2. Custom roles
  • 4.3. Options
• 5. Object dependencies
  • 5.1. Object reference map
  • 5.2. Permission requirements by operation type
  • 5.3. Examples: Current UDM roles and their dependencies
    • 5.3.1. Domain Administrator role
    • 5.3.2. Organizational Unit Admin role
    • 5.3.3. Helpdesk Operator role
    • 5.3.4. Linux OU Client Manager role
    • 5.3.5. Self-Service Profile role
• 6. Troubleshooting
• 7. Federated authentication for administrators
  • 7.1. Concepts
    • 7.1.1. Basic idea
    • 7.1.2. Data protection
    • 7.1.3. Understanding Keycloak mappers
    • 7.1.4. Technical prerequisites
    • 7.1.5. Before you begin
  • 7.2. Configure Nubus for UCS
    • 7.2.1. UMC permissions for federated accounts
    • 7.2.2. Enable federated account support in LDAP
    • 7.2.3. Keycloak and single sign-on in the Management UI
  • 7.3. Establish trust between Nubus and the upstream IdP
    • 7.3.1. Upstream IdP configuration
    • 7.3.2. Nubus Keycloak identity provider configuration
  • 7.4. Configure the UMC OIDC client
  • 7.5. Configure role assignment strategies
    • 7.5.1. Direct role attribute approach
      • 7.5.1.1. Upstream IdP
      • 7.5.1.2. Nubus IdP
      • 7.5.1.3. UMC OIDC clients
      • 7.5.1.4. Authentication flow for direct roles
    • 7.5.2. Group-based role assignment approach
      • 7.5.2.1. Example structure
      • 7.5.2.2. Upstream IdP configuration
      • 7.5.2.3. Nubus IdP configuration
      • 7.5.2.4. Providing guardian roles to UMC
      • 7.5.2.5. Sign-in flow for group-based roles
      • 7.5.2.6. Automating the configuration
  • 7.6. Verify the configuration of federated authentication
    • 7.6.1. Test the sign-in
    • 7.6.2. Logging
  • 7.7. Manage administrators for federated authentication
    • 7.7.1. Add a new administrator
    • 7.7.2. Update administrative roles
    • 7.7.3. Prepare emergency access
  • 7.8. Troubleshooting federated authentication
    • 7.8.1. Sign-in fails
    • 7.8.2. No management modules are visible after sign-in
    • 7.8.3. Authorization doesn’t work
• 8. Bibliography