How to transfer group management?

[dvv]

Hi!

Is the following behaviour intended:

kanidm group create g1 -D idm_admin # Successfully created group 'g1'
kanidm group set-entry-manager g1 u1 -D idm_admin # HTTP Error: 403 Forbidden AccessDenied

?
If yes, how do I delegate existing group management to another account (person only allowed?)?

TIA

[Firstyear]

It's a bit counter-intuitive, but the ability to change entry-managed-by is a very high level of privilege. To prevent abuse of this from the idm_admin silo to the admin silo, it's in the "admin" side of the server. I think I may need a cleanup of this in some way. ...

You should be able to use "admin" for now to change entry-managed-by post setup.

Please raise an issue not a discussion for improvements to the admin/idm_admin permission silo features.

[dvv]

I exampled with idm_admin because I can not login as a vanilla user in CLI. But I consider management delegation as a routine procedure -- a trivial example is "an operator XXX goes to vacation and delegates its duties to an operator YYY".

OFF: I could not find the link to discord so that not to bloat the discussions/issues -- couldn't you point me directly?

[yaleman]

We don't use Discord, there's a Gitter channel.

[yaleman]

You can log into the CLI on a local machine using a hardware token.