All commands are available to SEC_ADMINs. Other users can set only certain details for their own user account.

hicli user list

Displays the list of Cryptographic Security Platform Vault users defined in the system.

  • SEC_ADMIN sees all users
  • Others see users in the user groups to which they belong.

hicli user new <username>

Creates a new user account with the <username> username. See below for the supported options.

Option

Value

--email=<email>

The user email

--password=<passwd>

The user password

--full_name=<full_name>

The user password

--authentication=<authentication>

The default authentication method: local or ldap. This option affects only newly-created user accounts. It does not change the authentication method for existing accounts.

--account_state=<active|disabled>

The account state

--roles=<privlist>

A comma-separated list of roles. Allowed roles are: CLOUD_ADMIN, DOMAIN_ADMIN,  SEC_ADMIN

--groups=<grouplist>

A comma-separated list of the groups to which this user should belong. Each group name must be surrounded by double quotes. 

--password_expiration=<date>

The date on which the selected user's password expires. The next time that user logs in, they will be prompted to set a new password.

--account_expiration=<date>

The date on which the user account will be automatically disabled.

The following example selects one of the Cryptographic Security Platform Vault nodes, logs in as secroot, lists the users and groups, and creates two new users.

$ hicli kc select kc-1
$ hicli kc
Current KeyControl: kc-1
$ hicli user login secroot
Password for secroot: ********
$ hicli user list
Username Full Name Privileges
---------------------------------------------------
secroot Security Administrator SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN
$ hicli group list
Group Name Description Members
---------------------------------------------------
Cloud Admin Group Default Group for Administering Cloud VMs secroot
West-Cloud-Group Includes all West Coast Cloud VM Sets secroot
$ hicli user new spate --email=spate@me.com --password=Mypasswd236! \
--roles="SEC_ADMIN, DOMAIN_ADMIN, CLOUD_ADMIN" --full_name="Steve Pate" \
--groups="Cloud Admin Group, SF-Datacenter"
$ hicli user new mrogers --email=martha@me.com --password=Passwd123! \
--roles="CLOUD_ADMIN" --full_name="Martha Rogers" --groups="SF-Datacenter"
$ hicli user list
Username Full Name Privileges
---------------------------------------------------
mrogers Martha Rogers CLOUD_ADMIN
secroot Security Administrator SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN
spate Steve Pate SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN
$ hicli group list
Group Name Description Members
---------------------------------------------------
Cloud Admin Group Default Group for Administering Cloud VMs secroot,spate
West-Cloud-Group Includes all West Coast Cloud VM Sets secroot,spate,mrogers

hicli user detail <username>

Displays the details for the <username> user.

  • SEC_ADMIN can view the details for any user.
  • Others can view details only for their own user account.

hicli user set <username>

Sets information for the <username> user.

  • SEC_ADMIN can set all information for all accounts.
  • Other users can only set the email address, full name, and password for their own account.

For example, consider the following user:

$ hicli user detail fred
Login name | fred
Status | Active
Full name | Fred Flintstone
Email | fred@me.com
Last login | 2018-04-13 10:21:03 PDT
Password Expiration | Never
Account Expiration | 06/09/2020
Failed logins | 0
Privileges | CLOUD_ADMIN
Groups | Cloud Admin Group

The following call adds Security Admin privileges and changes the email:

$ hicli user set fred --roles=SEC_ADMIN,CLOUD_ADMIN --email=fred@hytrust.com
$ hicli user detail spate
Login name | fred
Status | Active
Full name | Fred Flintstone
Email | fred@hytrust.com
Last login | 2018-04-13 10:21:03 PDT
Password Expiration | Never
Account Expiration | 06/09/2020
Failed logins | 0
Privileges | SEC_ADMIN,CLOUD_ADMIN
Groups | Cloud Admin Group

hicli user rm <username>

Removes the <username> user.

Only Security Administrators can remove users.

The example below displays the current list of users and removes the user spate. 

$ hicli user list
Username Full Name Privileges
---------------------------------------------------
secroot Security Administrator SEC_ADMIN
spate Steve Pate CLOUD_ADMIN
$ hicli user rm spate
$ hicli user list
Username Full Name Privileges
---------------------------------------------------
secroot Security Administrator SEC_ADMIN

All objects (Cloud VM Sets and VMs) are owned by administrative groups and not by the users themselves. So, if you remove a user, the object stays intact.

hicli user defaults

Set the default parameters for Cryptographic Security Platform Vault user accounts. You can specify:

Option

Value

authentication

The default authentication method: local or ldap. This option affects only newly-created user accounts. It does not change the authentication method for existing accounts.

password_expiry

The number of days before the user's password expires. This option affects only newly-created accounts. It does not change the password expiration date for existing accounts.

max_failed_logins

The number of failed login attempts that can be made before Cryptographic Security Platform Vault disables the user account. This setting affects all user accounts, including existing accounts.

min_passwd_length

The minimum number of characters required in a Cryptographic Security Platform Vault account password. This setting affects all user accounts, including existing accounts.

The following command line example sets the default authentication to local, the password expiration to 60 days after the account is created or the password is changed, the maximum failed login attempts to 4, and the minimum password length to 12 characters.

$ hicli user defaults --authentication=local --password_expiry=60 --max_failed_logins=4 --min_passwd_length=12