Roles and organizations with the PAM issuer

On Red Hat Enterprise Linux, the built-in PAM issuer maps Linux groups inside the flightctl-pam-issuer container to Red Hat Edge Manager roles and organizations without requiring Red Hat Ansible Automation Platform or an external OpenID Connect provider.

When you use the PAM issuer, Red Hat Edge Manager organizations exist in the product. However, membership and permissions come from group names in the PAM issuer container, not from Red Hat Ansible Automation Platform organizations or OAuth role assignments.

If you connect the PAM issuer to the host’s SSSD daemon, groups resolved from LDAP, FreeIPA, or Active Directory must use the same naming patterns. For SSSD configuration, see Authenticating with SSSD and the PAM issuer in the Additional resources section.

How group names map to access
Copy link

The PAM issuer reads POSIX groups for each authenticated user and translates them as follows:

  • Organization membership: group name org-<ORGANIZATION_NAME> assigns the user to organization <ORGANIZATION_NAME>.
  • Global role: group name <ROLE_NAME> (for example, flightctl-admin) grants that role across all organizations the user belongs to.
  • Organization-scoped role: group name <ORGANIZATION_NAME>.<ROLE_NAME> (for example, engineering.flightctl-operator) grants <ROLE_NAME> only within <ORGANIZATION_NAME>.
Note

Group names follow the literal patterns above. For example, use org-operations and operations.flightctl-org-admin, not combined names such as flightctl-org-admin_Default.

A user can belong to multiple organizations by being a member of multiple org-* groups.

Supported roles
Copy link

The following external role names are recognized when they appear as global groups or as the role segment in an organization-scoped group name:

Table 1. Supported Red Hat Edge Manager roles
Role name Access in Red Hat Edge Manager

flightctl-admin

Full administrative access. Must be assigned as a global group (flightctl-admin); cannot be organization-scoped.

flightctl-org-admin

Full access to all resources within an organization. Can be global or organization-scoped.

flightctl-operator

Create, read, update, and delete devices, fleets, resource syncs, and repositories; manage image builds and exports (including cancel and logs); create and manage ImagePromotion resources. Cannot create, update, patch, or delete Catalog or CatalogItem resources directly.

flightctl-viewer

Read-only access; can view image build and export logs but cannot download exports.

flightctl-installer

Get and approve enrollment requests and manage certificate signing requests; view image builds and exports; download image exports.
Important

Role groups are not created automatically in the PAM issuer container. Create each group with groupadd before you assign users.

Organization assignment
Copy link

Create an organization group and add users to it:

sudo podman exec -i flightctl-pam-issuer groupadd org-engineering
sudo podman exec -i flightctl-pam-issuer groupadd org-operations
sudo podman exec -i flightctl-pam-issuer usermod -aG org-engineering alice
sudo podman exec -i flightctl-pam-issuer usermod -aG org-operations bob

In this example, alice belongs to the engineering organization and bob belongs to the operations organization.

Global role assignment
Copy link

Create a global role group and add the user:

sudo podman exec -i flightctl-pam-issuer groupadd flightctl-admin
sudo podman exec -i flightctl-pam-issuer usermod -aG flightctl-admin alice

In this example, alice is the PAM issuer username added to the flightctl-admin group. Global roles apply across every organization the user belongs to.

Organization-scoped role assignment
Copy link

Create a group named <ORGANIZATION>.<ROLE> and add the user:

sudo podman exec -i flightctl-pam-issuer groupadd engineering.flightctl-operator
sudo podman exec -i flightctl-pam-issuer groupadd operations.flightctl-org-admin
sudo podman exec -i flightctl-pam-issuer usermod -aG engineering.flightctl-operator alice
sudo podman exec -i flightctl-pam-issuer usermod -aG operations.flightctl-org-admin bob

In this example, alice is an operator in engineering and bob is an organization administrator in operations.

Example: multiple users, organizations, and roles
Copy link

The following example creates organizations, roles, and three users with different access levels:

# Organization groups
sudo podman exec -i flightctl-pam-issuer groupadd org-engineering
sudo podman exec -i flightctl-pam-issuer groupadd org-operations

# Global and organization-scoped role groups
sudo podman exec -i flightctl-pam-issuer groupadd flightctl-admin
sudo podman exec -i flightctl-pam-issuer groupadd flightctl-viewer
sudo podman exec -i flightctl-pam-issuer groupadd engineering.flightctl-operator
sudo podman exec -i flightctl-pam-issuer groupadd operations.flightctl-org-admin

# Global administrator
sudo podman exec flightctl-pam-issuer useradd -m admin
sudo podman exec -i flightctl-pam-issuer sh -c 'echo "admin:<PASSWORD>" | chpasswd'
sudo podman exec -i flightctl-pam-issuer usermod -aG flightctl-admin admin

# Engineering operator
sudo podman exec flightctl-pam-issuer useradd -m alice
sudo podman exec -i flightctl-pam-issuer sh -c 'echo "alice:<PASSWORD>" | chpasswd'
sudo podman exec -i flightctl-pam-issuer usermod -aG org-engineering,engineering.flightctl-operator alice

# Operations organization administrator
sudo podman exec flightctl-pam-issuer useradd -m bob
sudo podman exec -i flightctl-pam-issuer sh -c 'echo "bob:<PASSWORD>" | chpasswd'
sudo podman exec -i flightctl-pam-issuer usermod -aG org-operations,operations.flightctl-org-admin bob

Replace <PASSWORD> with a strong password for each account. For production environments, prefer password hashes instead of plain text in shell history. See Configure authentication credentials in the Additional resources section for hash-based user creation.

Verify group membership
Copy link

To confirm which groups (and therefore roles and organizations) a user has:

sudo podman exec flightctl-pam-issuer groups alice

Example output:

alice : alice org-engineering engineering.flightctl-operator

This shows that alice belongs to the engineering organization and holds the flightctl-operator role within that organization.