The user_attr Database
The user_attr database contains user and role information that supplements the passwd and shadow databases. The user_attr database contains extended user attributes such as authorizations, rights profiles, and assigned
roles. The fields in the user_attr database are separated by colons, as follows:
user:qualifier:res1:res2:attr
|
The following table describes these fields.
|
Field Name
|
Description
|
|
user
|
The name of the user or role as specified in the passwd database.
|
|
qualifier
|
Reserved for future use.
|
|
res1
|
Reserved for future use.
|
|
res2
|
Reserved for future use.
|
|
attr
|
An optional list of semicolon-separated (;) key-value pairs that describes the security attributes to be applied when the user runs commands. The four valid keys are type, auths, profiles, and roles.
-
The type key can be set to normal, if this account is for a normal user, or to role, if this account is for a role.
-
The auths key specifies a comma-separated list of authorization names that are chosen from names that are defined in the auth_attr database. Authorization names can include the asterisk (*) character as a wildcard. For example, solaris.device.* means all of the Solaris device authorizations.
-
The profiles key specifies an ordered, comma-separated list of rights profile names from the prof_attr database. The order of rights profiles works similarly to UNIX search paths. The first rights profile in the list that contains the command
to be executed defines which (if any) attributes are to be applied to the command.
-
The roles key can be assigned to the user through a comma-separated list of role names. Note that roles are defined in the same user_attr database. Roles are indicated by setting the type value to role. Roles cannot be assigned
to other roles.
|
The following example demonstrates how the Operator role is defined in a typical user_attr database and how it is assigned to user johnDoe. Roles and users are differentiated by the type keyword.
% grep operator /etc/user_attr
johnDoe::::type=normal;roles=sysadmin,operator
operator::::profiles=Operator;type=role
|
