Overview
The Sun Java System Identity Manager utilizes Resource Adapters to create, modify and delete accounts on systems running the Solaris Operating System. The Identity Manager Resource Adapter needs to be configured with a user that has access to perform user management tasks. The Resource Adapter for the Solaris OS can use the root account, the sudo utility, or a "privileged" user account.
Most customers will not allow Identity Manager to manage users with the root account. The use of the sudo facility requires installation and configuration on the Solaris OS. (sudo is a utility on the Companion CD that is not supported by Sun.) The creation of a "proxy" or "privileged" account is a secure way to grant fine-grained access to specific users. The Solaris OS has a built-in mechanism for delegating privileged commands to individual users or roles.
RBAC and Profiles
The Solaris OS provides Role Based Access Control (RBAC) for the delegation of administrative tasks. RBAC can be used as an alternative to using the root account for user management. RBAC is also a replacement for the sudo utility, which is not supported as a Solaris feature. This paper covers a component of RBAC called profiles. A given profile defines what privileged commands can be executed. A profile can be assigned to users and/or roles.
Profiles in the Solaris OS are enabled by having a user either su into a role or execute privileged commands in a "profile shell."
The Solaris OS provides three different profile shells:
/usr/bin/pfsh
/usr/bin/pfcsh
/usr/bin/pfksh
Click the link for the complete document. http://www.sun.com/bigadmin/features/articles/id_rbac.html
No comments:
Post a Comment