How to make a Junior Admin?

[Xenomorph]

We want a user account that is able to do some admin-things, but NOT be a full Administrator.

We want them to be able to create accounts for new users. We don't want them to have the ability to destroy the rest of the system on accident or if they get angry.

Create accounts, disable accounts, edit accounts, lock accounts. Able to modify all non-admin accounts.

When creating a user, I only see how to make them an Admin, or non admin. No in-between.

Any suggestions?

[bdial]

if you have network edition you can make domain administrators. i think they only have power within the domain you assign them to.

[Xenomorph]

Originally Posted by bdial

if you have network edition you can make domain administrators. i think they only have power within the domain you assign them to.

So I guess this is something that the Zimbra people are in no hurry to address in the free version?

[bdial]

something has to pay for development of the free version

[Klug]

You should check 6.0 features...

[Xenomorph]

Originally Posted by Klug

You should check 6.0 features...

Is that Bug 11515 – role based delegate administration
and Bug 18277 – server side infrastructure for role based delegated administration ?

[Xenomorph]

I just upgraded our 5.0.18 install to 6.0 RC1, and honestly I didn't see anything new for Administrators other than being called "Global Administrator" instead of just "Administrator".

What should I be looking for? Does something need to be enabled?

[bdial]

this post might be helpful

View e-mail action on zimbraAdmin

[Xenomorph]

Originally Posted by bdial

this post might be helpful

View e-mail action on zimbraAdmin

So again, the GUI/interface to assign rights is for the paid version, correct?

The commands don't seem to work for me.

Typing "zmprov rvr account user@domain.com adminLoginAs"

gives output like:
"usage: revokeRight(rvr) {target-type} [{target-id|target-name}] {grantee-type} {grantee-id|grantee-name} {[-]right}
zmprov [args] [cmd] [cmd-args ...]"

And lists a bunch of other stuff. I can only assume the command is failing because of something being typed wrong.

Is there a guide for commands?

I just want an "Admin" that can't change system settings or alter other Admin accounts. They should only be able to add users to the system.

[bdial]

Originally Posted by Xenomorph

So again, the GUI/interface to assign rights is for the paid version, correct?

it would appear so. i only have a 6.0rc1 foss install and i don't see the options in the gui. i don't have a NE 6.0 beta to see if they're in there.

The commands don't seem to work for me.

Typing "zmprov rvr account user@domain.com adminLoginAs"

gives output like:
"usage: revokeRight(rvr) {target-type} [{target-id|target-name}] {grantee-type} {grantee-id|grantee-name} {[-]right}
zmprov [args] [cmd] [cmd-args ...]"

And lists a bunch of other stuff. I can only assume the command is failing because of something being typed wrong.

Is there a guide for commands?

Theres a bit if you run zmprov help right

  revokeRight(rvr) {target-type} [{target-id|target-name}] {grantee-type} {grantee-id|grantee-name} {[-]right}


    target-type = account, calresource, cos, dl, domain, server, xmppcomponent, zimlet, config, global
        {target-id|target-name} is required if target-type is: account calresource cos dl domain server xmppcomponent zimlet ,
        otherwise {target-id|target-name} should not be specified

    grantee-type = usr, grp, dom

    right: (if right is prefixed with a '-', it means negative right, i.e., specifically deny)

theres a grantright as well, which is wierd because i would think using grantright with the - options on teh attribute would be the same as revokeright. i've never explored this feature yet though

I just want an "Admin" that can't change system settings or alter other Admin accounts. They should only be able to add users to the system.

and it looks like you'll be able to but rememer you're using beta software and a bit of patience and elbow grease is required as the documentation may not come for a while.