Users: console walkthrough¶
The same operations as the step-by-step guide, done in the console.
This console page has a guided tour
Click Start the tour beside the create button for a walkthrough that highlights each field as you go.
List¶
In the IAM perspective, Users lists the accounts in the selected project's domain.
Create¶
Create User opens a guided form.
Identify the person¶
- Username - what they type to sign in. It cannot be changed later.
- Email, First name, Last name.
Setting an email here marks it as verified, because you are asserting it rather than asking them to confirm it. Only enter an address you know is theirs.
Realm appears above the username only when the project has more than one domain.
Put them in their groups¶
Tick every group this person belongs to. This is the step that decides what they can actually do - a user in no groups can sign in and reach nothing.
If the group list is empty, the domain has no groups yet. You can finish here and add them later, or cancel and create the groups first, which is much less work.
Enabled is ticked by default. Clear it to create the account now and let them in later - useful when setting up accounts before a start date.
Decide how they get their first password¶
Set an initial password is off by default, and leaving it off is the better choice: the account is created without one, and no password ever passes through you.
If you do set one, keep the change-on-first-login box ticked
Require the user to change it on first login is what makes the password you chose stop working as soon as they use it.
The password is stored in a Secret in the project, named after the user. It is not shown again on this page, but anyone who can read secrets in the project can read it - which is why a temporary password is much safer than a permanent one.
Submitting creates the Secret first, then the user.
Change¶
The console form creates users; it does not edit them.
Group membership is held on the user, so adding someone to a group is an edit to that user - see Change. The same applies to disabling an account, which is what you want when someone leaves.
Delete¶
Use the kebab menu at the end of the row.
The password Secret is not deleted with the user
If you set an initial password, its Secret stays in the project. Delete it - see Delete.
Prefer disabling an account to deleting it when someone leaves: it stops sign-in immediately while keeping their history intact.
Where the console differs from the CLI¶
| Console | oc |
|
|---|---|---|
| Object name | Sanitised from the username for you | You sanitise it yourself |
| Realm reference | Filled in when there is one domain | You write spec.realmRef.name |
| Groups | Ticked from the existing list | You list them, replacing what was there |
| Password | Generated Secret, temporary by default | You create the Secret and choose temporary |
| Editing | Not offered | Groups, enabled, names |