2.4 Installing and Configuring OES as a Subcontainer Administrator

IMPORTANT:The information explained in Section 2.3, NetIQ eDirectory Rights Needed for Installing OES is prerequisite to the information contained in this section.

This section outlines the required eDirectory rights and explains how a subcontainer administrator approaches various installation tasks.

2.4.1 Rights Required for Subcontainer Administrators

For security reasons, you might want to create one or more subcontainer administrators (administrators that are in a container that is subordinate to the container that user Admin is in) with sufficient rights to install additional OES servers, without granting them full rights to the entire tree.

A subcontainer administrator needs the rights listed in Table 2-2 to install an OES server into the tree. These rights are typically granted by placing all administrative users in a Group or Role in eDirectory, and then assigning the rights to the Group or Role. Sample steps for assigning the rights to a single subcontainer administrator are provided as a general guide.

Table 2-2 Subcontainer Administrator Rights Needed to Install

Rights Needed	Sample Steps to Follow
Supervisor right to itself	In iManager, click View Objects > the Browse tab, then browse to and select the subcontainer administrator. Click the administrator object, then select Modify Trustees. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] property, select Supervisor, then click Done > OK.
Supervisor right to the container where the server will be installed	Browse to the container where the subcontainer administrator will install the server. Click the container object and select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] and [Entry rights] properties, select Supervisor, then click Done > OK > OK.
Supervisor right to the W0 object located inside the KAP object in the Security container	Browse to Security > KAP. In KAP, click W0 and select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] and [Entry rights] properties, select Supervisor, then click Done > OK > OK.
Supervisor right to the Security container when installing the NMAS login methods	If the subcontainer administrator will install the NMAS login methods: Browse to and select Security. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] and [Entry rights] properties, select Supervisor, then click Done > OK > OK.
Create right to its own container (context)	Browse to and select the container where you created the subcontainer administrator. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [Entry Rights] property, select Create, then click Done > OK > OK.
Create right to the container where the UNIX Config object is located	Browse to and select the container where the UNIX Config object is located. By default, this is the Organization object. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [Entry Rights] property, select Create, then click Done > OK > OK.
Read right to the Security container object for the eDirectory tree	This is not needed if the Supervisor right was assigned because of NMAS. If the subcontainer administrator won’t install the NMAS login methods, do the following: Browse to and select Security. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] property, select Read, then click Done > OK > OK.
Read right to the NDSPKI:Private Key attribute on the Organizational CA object (located in the Security container)	Browse to Security and select the Organizational CA object. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. Click the Add Property button. Select NDSPKI:Private Key, then click OK. The Read right should be automatically assigned. Click Done > OK > OK.
Read and Write rights to the UNIX Config object	Browse to and select the UNIX Config object. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] property, select Write (Read is already selected), then click Done > OK > OK.
Write right to the [All Attribute Rights] property for the admingroup object	Browse to and select the admingroup object. Select Modify Trustees. Click Add Trustee, browse to and select the subcontainer administrator, then click OK. Click the Assigned Rights link for the administrator object. For the [All Attributes Rights] property, select Write (Compare and Read are already selected), then click Done > OK > OK.

When you install DNS/DHCP into an existing tree with DNS/DHCP, see the following additional guidelines:

For DNS, see eDirectory Permissions in the OES 2015 SP1: DNS/DHCP Services for Linux Administration Guide.
For DHCP, see eDirectory Permissions in the OES 2015 SP1: DNS/DHCP Services for Linux Administration Guide.

2.4.2 Providing Required Rights to the Subcontainer Administrator for Installing and Managing Samba

Prior to installing any new OES Samba server in a tree, ensure that you provide supervisor rights to the subcontainer administrator for the location mentioned in Table 2-3.

Table 2-3 Subcontainer Administrator Rights Needed to Manage Samba

Rights Needed	Sample Steps to Follow
Supervisor rights to the container where the Linux workstation object will be located	In iManager, click View Objects, then browse and select the container where the OES Samba server will be installed. Click Actions > Modify Trustees. On the Modify Trustees page, click Assigned Rights next to the trustee name for which you want to modify rights. Click the desired container admin object to add it to the Selected Objects section. Click OK. Select Property Name rights (All Attribute Rights and Entry Rights) and assign Supervisor rights, then click Done.
Supervisor rights to the container where the Unix config object will be located	On the Novell iManager, click View Objects, then in the Tree, browse and select the container where Unix Config object is located. Select the Unix Config object, then click Actions > Modify trustees. On the Modify Trustees page, click Assigned Rights next to the trustee name for which you want to modify rights. Click the desired container admin object to add it to the Selected Objects section. Click OK. Select Property Name rights (All Attribute Rights and Entry Rights) and assign Supervisor rights, then click Done.
Supervisor rights to the container where the Samba/LDAP base context will be located	On the Novell iManager, click View Objects, then in the Tree, browse and select the container where the Samba/LDAP base context will reside. Select the Current Level tree object, then click Actions > Modify trustees. On the Modify Trustees page, click Assigned Rights next to the trustee name for which you want to modify rights. Click the desired container admin object to add it to the Selected Objects section. Click OK. Select Property Name rights (All Attribute Rights and Entry Rights) and assign Supervisor rights, then click Done.
Supervisor rights to the container where the Samba proxy user will be installed	On the Novell iManager, click View Objects, then in the Tree, browse and select the container where the Samba proxy user context will be installed. Select the Samba proxy object, then click Actions > Modify trustees. On the Modify Trustees page, click Assigned Rights next to the trustee name for which you want to modify rights. Click the desired container admin object to add it to the Selected Objects section. Click OK. Select Property Name rights (All Attribute Rights and Entry Rights) and assign Supervisor rights, then click Done.

2.4.3 Starting a New Installation as a Subcontainer Administrator

You can install a new OES server into an existing tree as a subcontainer administrator if you have the following:

The rights described in Rights Required for Subcontainer Administrators
The rights described in Providing Required Rights to the Subcontainer Administrator for Installing and Managing Samba
(If applicable) The rights described for the server installations in NetIQ eDirectory Rights Needed for Installing OES

When you reach the eDirectory Configuration - Existing Tree page, enter your fully distinguished name (FDN) and password. After verifying your credentials, the installation proceeds normally.

2.4.4 Adding/Configuring OES Services as a Different Administrator

To add or configure OES services on an OES server that another administrator installed, see Adding/Configuring OES Services on a Server That Another Administrator Installed.