documentation/admin-guide/configuration/access/system_access.md

Regular and Administrative User Access

Regular Access

Access for ActiveDirectory (AD) user accounts or groups:

aaa::users:
  - 'muster_h'
  - '%unx-project_group'

Groups are allowed with the % prefix in front of the group name.

To limit a login to the physical desktop/console only you can add a :LOCAL suffix like this:

aaa::users:
  - 'muster_h:LOCAL'

Note that administrative users (see below) always have normal access without being explicitely listed in aaa::users.

Allow Access for External, Global, Experiment or Service Accounts

• aaa::allow_external_accounts: true allows for external accounts
• aaa::allow_global_accounts: true allows for global accounts
• aaa::allow_experiment_accounts: true allows for experiment accounts
• aaa::allow_service_accounts: true allow logins of service accounts

Note that individual users of these groups additionally need to be added to one of aaa::users or aaa::admins to actually get access to a system.

Administrative (root/sudo) Access

To give root access for AD user accounts or groups via sudo.

aaa::admins:
  - 'muster_h'
  - '%unx-project_admins'

Administrative Rights on Desktop (polkit/group wheel)

To give users administrative rights on the desktop to e.g. install software using the Software tool, list them in Hiera in desktop::priv_users:

desktop::priv_users:
  - 'doe_j'
  - '%unx-project_group'

This is implemented by adding the user/group to the wheel group and having polkit policies allowing certain actions.

Note that all users of aaa::admins are added automatically to the group wheel.