X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/5ee93e408c0e547dfb03b2f3d039a7715126395b..9d01823b167d1a9715fff727155529402e3b053d:/doc/admin/user-management-cli.html.textile.liquid
diff --git a/doc/admin/user-management-cli.html.textile.liquid b/doc/admin/user-management-cli.html.textile.liquid
index 33969ea8f8..949ce6a552 100644
--- a/doc/admin/user-management-cli.html.textile.liquid
+++ b/doc/admin/user-management-cli.html.textile.liquid
@@ -16,40 +16,118 @@ ARVADOS_API_HOST={{ site.arvados_api_host }}
ARVADOS_API_TOKEN=1234567890qwertyuiopasdfghjklzxcvbnm1234567890zzzz
-In these examples, @x1u39-tpzed-3kz0nwtjehhl0u4@ is the sample user account. Replace with the uuid of the user you wish to manipulate.
+In these examples, @zzzzz-tpzed-3kz0nwtjehhl0u4@ is the sample user account. Replace with the uuid of the user you wish to manipulate.
-See "user management":{{site.baseurl}}/admin/activation.html for an overview of how to use these commands.
+See "user management":{{site.baseurl}}/admin/user-management.html for an overview of how to use these commands.
h3. Setup a user
This creates a default git repository and VM login. Enables user to self-activate using Workbench.
+
+$ arv user setup --uuid zzzzz-tpzed-3kz0nwtjehhl0u4
+
+$ arv user unsetup --uuid zzzzz-tpzed-3kz0nwtjehhl0u4
+
+$ arv user update --uuid "zzzzz-tpzed-3kz0nwtjehhl0u4" --user '{"is_active":true}'
+
+$ arv api_client_authorization create --api-client-authorization '{"owner_uuid": "zzzzz-tpzed-fr97h9t4m5jffxs"}'
+{
+ "href":"/api_client_authorizations/zzzzz-gj3su-yyyyyyyyyyyyyyy",
+ "kind":"arvados#apiClientAuthorization",
+ "etag":"9yk144t0v6cvyp0342exoh2vq",
+ "uuid":"zzzzz-gj3su-yyyyyyyyyyyyyyy",
+ "owner_uuid":"zzzzz-tpzed-fr97h9t4m5jffxs",
+ "created_at":"2020-03-12T20:36:12.517375422Z",
+ "modified_by_client_uuid":null,
+ "modified_by_user_uuid":null,
+ "modified_at":null,
+ "user_id":3,
+ "api_client_id":7,
+ "api_token":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+ "created_by_ip_address":null,
+ "default_owner_uuid":null,
+ "expires_at":null,
+ "last_used_at":null,
+ "last_used_by_ip_address":null,
+ "scopes":["all"]
+}
+
-arv user setup --uuid x1u39-tpzed-3kz0nwtjehhl0u4 +ARVADOS_API_TOKEN=v2/zzzzz-gj3su-yyyyyyyyyyyyyyy/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-h3. Deactivate user +h3(#delete-token). Delete a single token + +As a user or admin, if you need to revoke a specific, known token, for example a token that may have been leaked to an unauthorized party, you can delete it at the command line. + +First, determine the token UUID. If it is a "v2" format token (starts with "v2/") then the token UUID is middle section between the two slashes. For example:
-arv user unsetup --uuid x1u39-tpzed-3kz0nwtjehhl0u4 +v2/zzzzz-gj3su-yyyyyyyyyyyyyyy/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-When deactivating a user, you may also want to "reassign ownership of their data":{{site.baseurl}}/admin/reassign-ownership.html . +the UUID is "zzzzz-gj3su-yyyyyyyyyyyyyyy" and you can skip to the next step. -h3. Directly activate user +If you have a "bare" token (only the secret part) then, as an admin, you need to query the token to get the uuid:
-arv user update --uuid "x1u39-tpzed-3kz0nwtjehhl0u4" --user '{"is_active":true}' +$ ARVADOS_API_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx arv --format=uuid api_client_authorization current +zzzzz-gj3su-yyyyyyyyyyyyyyy-Note this bypasses user agreements checks, and does not set up the user with a default git repository or VM login. +Now you can delete the token: +
+$ ARVADOS_API_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx arv api_client_authorization delete --uuid zzzzz-gj3su-yyyyyyyyyyyyyyy ++ +h3(#delete-all-tokens). Delete all tokens belonging to a user + +First, "obtain a valid token for the user.":#create-token + +Then, use that token to get all the user's tokens, and delete each one: + +
+$ ARVADOS_API_TOKEN=xxxxtoken-belonging-to-user-whose-tokens-will-be-deletedxxxxxxxx ; \ +for uuid in $(arv --format=uuid api_client_authorization list) ; do \ +arv api_client_authorization delete --uuid $uuid ; \ +done +-h2. Permissions +h2. Adding Permissions -h3. VM login +h3(#vm-login). VM login -Give @$user_uuid@ permission to log in to @$vm_uuid@ as @$target_username@ +Give @$user_uuid@ permission to log in to @$vm_uuid@ as @$target_username@ and make sure that @$target_username@ is a member of the @docker@ group
user_uuid=xxxxxxxchangeme @@ -62,7 +140,7 @@ read -rd $'\000' newlink <