The following example selects one of the Cryptographic Security Platform Vault nodes, logs in as secroot, lists the users and groups, and then creates two new users, one called spate with the same privileges as secroot and one called mrogers with just the CLOUD_ADMIN user role in the West-Cloud-Group Cloud Admin Group.
$ hicli kc select kc-1
$ hicli kc
Current KeyControl: kc-1
$ hicli user login secroot
Password for secroot: ********
$ hicli user list
Username Full Name Privileges
---------------------------------------------------
secroot Security Administrator SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN
$ hicli group list
Group Name Description Members
---------------------------------------------------
Cloud Admin Group Default Group for Administering Cloud VMs secroot
West-Cloud-Group Includes all West Coast Cloud VM Sets secroot
$ hicli user new spate --email=spate@me.com --password=Mypasswd236! \
--roles="SEC_ADMIN, DOMAIN_ADMIN, CLOUD_ADMIN" --full_name="Steve Pate" \
--groups="Cloud Admin Group, SF-Datacenter"
$ hicli user new mrogers --email=martha@me.com --password=Passwd123! \
--roles="CLOUD_ADMIN" --full_name="Martha Rogers" --groups="SF-Datacenter"
$ hicli user list
Username Full Name Privileges
---------------------------------------------------
mrogers Martha Rogers CLOUD_ADMIN
secroot Security Administrator SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN
spate Steve Pate SEC_ADMIN,DOMAIN_ADMIN,CLOUD_ADMIN
$ hicli group list
Group Name Description Members
---------------------------------------------------
Cloud Admin Group Default Group for Administering Cloud VMs secroot,spate
West-Cloud-Group Includes all West Coast Cloud VM Sets secroot,spate,mrogersIf there is more than one Cryptographic Security Platform Vault node in the cluster, you can select any node. As soon as changes are made on one node, they are automatically reflected on all other nodes. In the example here, we have selected kc-1.
Since we are creating a new user, we must first log on as a Security Administrator. In the example above, we were prompted for the password. Alternatively, you can specify the password on the command line using --password=. Login sessions are valid for one hour past the last command typed. We recommend that sets of commands be preceded by a login call and followed by a logout call.
In order to check the progress of your API calls, log on to the webGUI and view the results.
Modifying a User Example
As an example, consider the following user:
$ hicli user detail fred Login name | fred Status | Active Full name | Fred Flintstone Email | fred@me.com Last login | 2018-04-13 10:21:03 PDT Password Expiration | Never Account Expiration | 06/09/2020 Failed logins | 0 Privileges | CLOUD_ADMIN Groups | Cloud Admin Group
The following call adds Security Admin privileges and changes the email:
$ hicli user set fred --roles=SEC_ADMIN,CLOUD_ADMIN --email=fred@hytrust.com $ hicli user detail spate Login name | fred Status | Active Full name | Fred Flintstone Email | fred@hytrust.com Last login | 2018-04-13 10:21:03 PDT Password Expiration | Never Account Expiration | 06/09/2020 Failed logins | 0 Privileges | SEC_ADMIN,CLOUD_ADMIN Groups | Cloud Admin Group