oneuser
- manages OpenNebula users
oneuser
command [args] [options]
--group id|name Comma-separated list of Groups for the new User.
The first Group will be the main one.
-r, --read-file Read password from file
--sha1 The password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 The
password will be hashed using the sha1 algorithm
--ssh SSH Auth system
--x509 x509 Auth system for x509 certificates
-k, --key path_to_private_key_pem Path to the Private Key of the User
-c, --cert path_to_user_cert_pem Path to the Certificate of the User
--driver driver Driver to authenticate this user
-a, --append Append new attributes to the current template
--x509_proxy x509 Auth system based on x509 proxy certificates
--proxy path_to_user_proxy_pem Path to the user proxy certificate
--time x Token duration in seconds, defaults to 36000 (10
h). To reset the token set time to 0.To generate
a non-expiring token use -1 (not valid for ssh
and x509 tokens).
--force Force one_auth file rewrite
--stdin_password enable stdin password
-l, --list x,y,z Selects columns to display with list command
-c, --listconf conf Selects a predefined column list
-d, --delay x Sets the delay in seconds for top command
-f, --filter x,y,z Filter data. An array is specified with
column=value pairs.
--operator operator Logical operator used on filters: AND, OR.
Default: AND.
--csv Write table in csv format
--no-pager Disable pagination
-x, --xml Show the resource in xml format
-n, --numeric Do not translate user and group IDs
--describe Describe list columns
--token token_hint The Token to be loaded.
--global Find a global Token.
-v, --verbose Verbose mode
-h, --help Show this message
-V, --version Show version and copyright information
--user name User name used to connect to OpenNebula
--password password Password to authenticate with OpenNebula
--endpoint endpoint URL of OpenNebula xmlrpc frontend
create username [password] Creates a new User Examples: oneuser create my_user my_password oneuser create my_user -r /tmp/mypass oneuser create my_user my_password --group users,102,testers oneuser create my_user --ssh --key /tmp/id_rsa oneuser create my_user --ssh -r /tmp/public_key oneuser create my_user --x509 --cert /tmp/my_cert.pem valid options: group, read_file, sha1, ssh, x509, key, cert, driver
update userid [file] Update the template contents. If a path is not provided the editor will be launched to modify the current content. valid options: append
quota userid [file] Set the quota limits for the user. If a path is not provided the editor will be launched to modify the current quotas.
batchquota range|userid_list [file] Sets the quota limits in batch for various users. If a path is not provided the editor will be launched to create new quotas.
defaultquota [file] Sets the default quota limits for the users. If a path is not provided the editor will be launched to modify the current default quotas.
umask range|userid_list [mask] Changes the umask used to create the default permissions. In a similar way to the Unix umask command, the expected value is a three-digit base-8 number. Each digit is a mask that disables permissions for the owner, group and other, respectively.
If mask is not given, or if it is an empty string, the umask will
be unset
login [username] Alias of token-create. valid options: ssh, x509, x509_proxy, key, cert, proxy, time, force, group, stdin_password
key Shows a public key from a private SSH key. Use it as password for the SSH authentication mechanism. valid options: key
delete range|userid_list Deletes the given User
passwd userid [password] Changes the given User's password valid options: read_file, sha1, ssh, x509, key, cert, driver
chgrp range|userid_list groupid Changes the User's primary group
addgroup range|userid_list groupid Adds the User to a secondary group
delgroup range|userid_list groupid Removes the User from a secondary group
chauth userid [auth] [password] Changes the User's auth driver and its password (optional) Examples: oneuser chauth my_user core oneuser chauth my_user core new_password oneuser chauth my_user core -r /tmp/mypass oneuser chauth my_user --ssh --key /home/oneadmin/.ssh/id_rsa oneuser chauth my_user --ssh -r /tmp/public_key oneuser chauth my_user --x509 --cert /tmp/my_cert.pem valid options: read_file, sha1, ssh, x509, key, cert, driver
list Lists Users in the pool valid options: list, listconf, delay, filter, operator, csv, no_pager, xml, numeric, describe
show [userid] Shows information for the given User valid options: xml
encode username [password] Encodes user and password to use it with ldap
passwdsearch driver password Searches for users with a specific auth driver that has the given string in their password field valid options: csv, xml
token-create [username] Creates the login token for authentication. The token can be used together with any authentication driver. The token will be stored in $HOME/.one/one_auth, and can be used subsequently to authenticate with oned through API, CLI or Sunstone.
If <username> is ommited, it will infer it from the ONE_AUTH file.
Example, request a valid token for a generic driver (e.g. core auth, LDAP...):
oneuser token-create my_user --time 3600
Example, request a group spefici token (new resources will be created in that
group and only resources that belong to that group will be listed):
oneuser token-create my_user --group <id|group>
Example, generate and set a token for SSH based authentication:
oneuser token-create my_user --ssh --key /tmp/id_rsa --time 72000
Example, same using X509 certificates:
oneuser token-create my_user --x509 --cert /tmp/my_cert.pem
--key /tmp/my_key.pk --time 72000
Example, now with a X509 proxy certificate
oneuser token-create my_user --x509_proxy --proxy /tmp/my_cert.pem
--time 72000
valid options: ssh, x509, x509_proxy, key, cert, proxy, time, force, group, stdin_password
token-set [username] Generates a ONE_AUTH file that contains the token.
You must provide one (and only one) of the following options:
--token <token> searches for a token that starts with that string. It must be
unique
--group <id|group> returns the most durable token that provides access to that
specific group.
--global returns the most durable global token (non group specific).
The argument 'username' is optional, if omitted it is inferred from the ONE_AUTH
file.
Example, set a token:
$ oneuser token-set my_user --token 1d47
export ONE_AUTH=/var/lib/one/.one/<file>.token; export ONE_EGID=-1
You can copy & paste the output of the command and will load the proper
environment variables.
valid options: ssh, x509, x509_proxy, key, cert, proxy, time, force, group, stdin_password, token, global
token-delete [username] token Expires a token and removes the associated ONE_AUTH file if present. valid options: ssh, x509, x509_proxy, key, cert, proxy, time, force, group, stdin_password
token-delete-all username Delete all the tokens of a user. This command is intented to be executed by a user that has MANAGE permissions of the target user. valid options: ssh, x509, x509_proxy, key, cert, proxy, time, force, group, stdin_password
file Path to a file
range List of id's in the form 1,8..15
text String
groupid OpenNebula GROUP name or id
userid OpenNebula USER name or id
userid_list Comma-separated list of OpenNebula USER names or ids
password User password
OpenNebula 5.8.5 Copyright 2002-2019, OpenNebula Project, OpenNebula Systems
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0