Manage Group Memberships

Overview

At checkout the broker adds the requesting user to a FreeIPA group; at checkin it removes them. A single PowerShell script handles both — the Action (Checkout/Checkin) is passed as a profile attribute. The script connects to FreeIPA, verifies the user and group exist, then adds or removes membership.

Before You Begin

The Access Broker is deployed and connected
PowerShell 5.1+ (Windows or Core) on the broker host
The Manage-FreeIPA module available in $env:PSModulePath
A FreeIPA admin account that can modify group membership

Parameters

Name	Source	Notes
`Server`	Resource config	FreeIPA hostname or IP
`Username`, `Password`	Resource config / vault	FreeIPA admin credentials
`User`	Profile (dynamic)	User to add/remove
`Group`	Profile (dynamic)	Target group
`Action`	Profile (dynamic)	`Checkout` or `Checkin`

Script

Full script: FreeIPA/manage-groups.ps1

FreeIPA/manage-groups.ps1

# single script branches on $Action
if ($Action -eq "Checkout") {
    Add-FreeIPAGroupMember    -Group $Group -User $User
} elseif ($Action -eq "Checkin") {
    Remove-FreeIPAGroupMember -Group $Group -User $User
}

Exit codes: 0 success · 2 user not found / login failed · 3 group not found · 4 add/remove failed.

Configure in Britive

Create the permission

Resource Manager → Resource Type Permissions → New Permission. Language = PowerShell. Paste the script into both Checkout and Checkin — it branches on Action. Declare Server, Username, Password, Group, Action; User is system-defined.

Create a profile and policy

Create a profile (e.g. 4h), set Group, add the permission, and add a policy assigning members by tag.

Verify

# on the FreeIPA server, during checkout
ipa group-show <group>          # the user is listed as a member
# after checkin — the user is removed

Troubleshoot

Symptom	Cause	Fix
Exit code `2`	Wrong admin credentials or user missing	Verify `Username`/`Password` and that `User` exists in FreeIPA
Exit code `3`	Group missing	Confirm the `Group` name/value
Module not found	Manage-FreeIPA not installed	Install it into `$env:PSModulePath` on the broker host

Next Steps

Last updated on July 3, 2026

Getting Started