Managing Administrators

An administrator generally has broader rights and permissions than most users. You can create a number of administrators, with different access controls and resource limits.

To Create a New Administrator

Import the administrator data using import-ldif.
For this example, the administrator being added has uid=Admin.Lab.
- Alternatively, you can use an existing user.
(Optional) Create a group of administrators with cn=Administrators.
Since the group of administrators should have only a few users, you can create a static group. For more information, see Defining Static Groups.
```
dn: cn=Administrators,ou=People,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
member: uid=Admin.Lab,ou=People,dc=example,dc=com
cn: Administrator
```

Set the privileges of the administrator by using the ldapmodify command.

For example, the following command would give the administrator the rights to perform backup and restore on the back end.

ldapmodify -h localhost -p 1389 -w password -D cn=directory\ manager
dn: uid=Admin.Lab,ou=People,dc=example,dc=com
changetype: modify
add: ds-privilege-name
ds-privilege-name: backend-backup
ds-privilege-name: backend-restore

Set resource limits, if required.
The procedure is similar to setting the resource limits for a root user. See Setting Root User Resource Limits.

To Create an Administrator with Root User Privileges

You can assign root user privileges to an administration or user.

Create an administrator, or use an existing user.
See To Create a New Administrator.

Modify the privileges using the ldapmodify command.

For example, the command below changes the privileges for the administrator named Admin.Lab to have the same default privileges as a root user.

ldapmodify -h localhost -p 1389 -w password -D cn=directory\ manager
dn: uid=Admin.Lab,cn=Administrators,ou=People,dc=example,dc=com
changetype: modify
add: ds-privilege-name
ds-privilege-name: bypass-acl
ds-privilege-name: modify-acl
ds-privilege-name: config-read
ds-privilege-name: config-write
ds-privilege-name: ldif-import
ds-privilege-name: ldif-export
ds-privilege-name: backend-backup
ds-privilege-name: backend-restore
ds-privilege-name: server-shutdown
ds-privilege-name: server-restart
ds-privilege-name: disconnect-client
ds-privilege-name: cancel-request
ds-privilege-name: password-reset
ds-privilege-name: update-schema
ds-privilege-name: privilege-change
ds-privilege-name: unindexed-search

Note - The privileges on the access controls bypass-acl and modify-acl should only be assigned to a restricted number of people. Assigning the rights to bypass or modify access controls to inexperienced users can be risky.

Exit Print View
Sun OpenDS Standard Edition 2.2 Administration Guide