The following example selects one of the Cryptographic Security Platform Vault nodes, logs in as secroot, lists the users and groups, and then creates two new users, one called spate with the same privileges as secroot and one called mrogers with just the CLOUD_ADMIN user role in the West-Cloud-Group Cloud Admin Group.
$ hicli kc select kc-1$ hicli kcCurrent KeyControl: kc-1$ hicli user login secrootPassword for secroot: ********$ hicli user listUsername Full Name Privileges---------------------------------------------------secroot Security Administrator SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN$ hicli group listGroup Name Description Members---------------------------------------------------Cloud Admin Group Default Group for Administering Cloud VMs secrootWest-Cloud-Group Includes all West Coast Cloud VM Sets secroot$ hicli user new spate --email=spate@me.com --password=Mypasswd236! \ --roles="SEC_ADMIN, DOMAIN_ADMIN, CLOUD_ADMIN" --full_name="Steve Pate" \ --groups="Cloud Admin Group, SF-Datacenter"$ hicli user new mrogers --email=martha@me.com --password=Passwd123! \ --roles="CLOUD_ADMIN" --full_name="Martha Rogers" --groups="SF-Datacenter"$ hicli user listUsername Full Name Privileges---------------------------------------------------mrogers Martha Rogers CLOUD_ADMINsecroot Security Administrator SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMINspate Steve Pate SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN$ hicli group listGroup Name Description Members---------------------------------------------------Cloud Admin Group Default Group for Administering Cloud VMs secroot,spateWest-Cloud-Group Includes all West Coast Cloud VM Sets secroot,spate,mrogersIf there is more than one Cryptographic Security Platform Vault node in the cluster, you can select any node. As soon as changes are made on one node, they are automatically reflected on all other nodes. In the example here, we have selected kc-1.
Since we are creating a new user, we must first log on as a Security Administrator. In the example above, we were prompted for the password. Alternatively, you can specify the password on the command line using --password=. Login sessions are valid for one hour past the last command typed. We recommend that sets of commands be preceded by a login call and followed by a logout call.
In order to check the progress of your API calls, log on to the web GUI and view the results.
As example of modifying a user example, consider the following user:
$ hicli user detail fredLogin name | fredStatus | ActiveFull name | Fred FlintstoneEmail | fred@me.comLast login | 2018-04-13 10:21:03 PDTPassword Expiration | NeverAccount Expiration | 06/09/2020Failed logins | 0Privileges | CLOUD_ADMINGroups | Cloud Admin GroupThe following call adds Security Admin privileges and changes the email:
$ hicli user set fred --roles=SEC_ADMIN,CLOUD_ADMIN --email=fred@hytrust.com$ hicli user detail spateLogin name | fredStatus | ActiveFull name | Fred FlintstoneEmail | fred@hytrust.comLast login | 2018-04-13 10:21:03 PDTPassword Expiration | NeverAccount Expiration | 06/09/2020Failed logins | 0Privileges | SEC_ADMIN,CLOUD_ADMINGroups | Cloud Admin Group