documentation/docs/admin-guide/configuration/access/system_access.md

Regular and Administrative User Access

Regular Access

Access for ActiveDirectory (AD) user accounts or groups:

aaa::users:
  - 'muster_h'
  - '%unx-project_group'

Groups are allowed with the % prefix in front of the group name.

To limit a login to the physical desktop/console only you can add an full access.conf line with a LOCAL restriction like this:

aaa::users:
  - '+:muster_h:LOCAL'

Note that administrative users (see below) always have normal access without being explicitly listed in aaa::users.

Allow Access for External, Global, Experiment or Service Accounts

• aaa::allow_external_accounts: true allows for external accounts
• aaa::allow_global_accounts: true allows for global accounts
• aaa::allow_experiment_accounts: true allows for experiment accounts
• aaa::allow_service_accounts: true allow logins of service accounts

Note that individual users of these groups additionally need to be added to one of aaa::users or aaa::admins to actually get access to a system.

Use Special User List

If you need to use a different user list on a special system that differs from the user list that is defined toplevel this can be done like this:

# Disable login on this machine except for specified users
aaa::userlist_name: custom
aaa::userlist::custom:
    - muster_h

With this not the users from aaa::users but aaa::userlist:custom is used to set the systems user list. custom can be any arbitrary name.

Administrative (root/sudo) Access

To give root access for AD user accounts or groups via sudo.

aaa::admins:
  - 'muster_h'
  - '%unx-project_admins'

Administrative Rights on Desktop (polkit/group wheel)

To give users administrative rights on the desktop to e.g. install software using the Software tool, list them in Hiera in desktop::priv_users:

desktop::priv_users:
  - 'doe_j'
  - '%unx-project_group'

This is implemented by adding the user/group to the wheel group and having polkit policies allowing certain actions.

Note that all users of aaa::admins are added automatically to the group wheel.