# Regular and Administrative User Access


## Regular Access
Access for ActiveDirectory (AD) user accounts or groups:
```
aaa::users:
  - 'muster_h'
  - '%unx-project_group'
```
Groups are allowed with the `%` prefix in front of the group name.

To limit a login to the physical desktop/console only you can add an full [access.conf](https://man7.org/linux/man-pages/man5/access.conf.5.html) line with a `LOCAL` restriction like this:
```
aaa::users:
  - '+:muster_h:LOCAL'
```

Note that administrative users (see below) always have normal access without being explicitly listed in `aaa::users`.

## Allow Access for External, Global, Experiment or Service Accounts
- `aaa::allow_external_accounts: true` allows for external accounts
- `aaa::allow_global_accounts: true` allows for global accounts
- `aaa::allow_experiment_accounts: true` allows for [experiment accounts](eaccounts)
- `aaa::allow_service_accounts: true` allow logins of service accounts

Note that individual users of these groups additionally need to be added to one of `aaa::users` or `aaa::admins` to actually get access to a system.

## Use Special User List

If you need to use a different user list on a special system that differs from the user list that is defined toplevel this can be done like this:

```yaml
# Disable login on this machine except for specified users
aaa::userlist_name: custom
aaa::userlist::custom:
    - muster_h
```

With this not the users from `aaa::users` but `aaa::userlist:custom` is used to set the systems user list. `custom` can be any arbitrary name.

## Administrative (root/sudo) Access
To give root access for AD user accounts or groups via sudo.
```
aaa::admins:
  - 'muster_h'
  - '%unx-project_admins'
```

## Administrative Rights on Desktop (polkit/group `wheel`)

To give users administrative rights on the desktop to e.g. install software using the `Software` tool, list them in Hiera in `desktop::priv_users`:
```
desktop::priv_users:
  - 'doe_j'
  - '%unx-project_group'
```

This is implemented by adding the user/group to the `wheel` group and having [`polkit`](https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) policies allowing certain actions.

Note that all users of `aaa::admins` are added automatically to the group `wheel`.