Creating computer-level role assignments in classic zones

Classic zones support computer-level role assignments. If you want to configure computer‑level role assignments, keep the following in mind:

  • The classic zone that the computer is a member of must have authorization enabled before you can create role definitions and role assignments.
  • The role assignment is only valid on the computer where you have made the assignment.
  • The role definition you use must be defined in the classic zone that the computer is a member of.

A computer-level role assignment in a classic zone is similar to computer-level overrides in hierarchical zones, except that you cannot save user or group profile information for individual computers. User and group information is stored in the classic zone. To enable computer-specific role assignments in classic zones, you must use a specialized zone type, the classic-computer zone type.

To create a computer-level role assignment in a classic zone:

  1. Precreate the computer in a classic4 zone, if it doesn’t already exist.
  2. Create a zone that uses the specialized zone type of classic-computer.
  3. Select the classic-computer zone within the classic zone.
  4. Create the role assignment.

The following code snippet illustrates the commands to execute in ADEdit to make computer-specific role assignments in classic zones:

package require ade_lib
select_zone cn=cls,cn=zones,dc=ajuba,dc=net
get_zone_field type
precreate_computer rhelqa$
   {comp5$} {rhelqa$}
create_zone classic-computer,cn=zones,dc=ajuba,dc=net
set_role_assignment_field role role1/cls

You can then get the classic-computer zones by running the get_child_zones command when the classic zone is selected. For example:

select_zone cn=cls,cn=zones,dc=ajuba,dc=net