☰

Managing Users

Cloudify provides a user management mechanism, so you can define different users with different permissions, and upon login perform authentication and authorization to control the users’ access to resources.

The users can be either defined and managed in Cloudify itself, or you can configure your Manager to integrate with an LDAP-based user-management system. You must select one of these options, as you cannot do both, and you must configure your manager accordingly upon installation or immediately afterwards, when no actions were performed on it yet.
User management can be performed using the CLI or the Cloudify Management Console.

User Management Credentials

You must have Cloudify Manager administrator permissions to perform user-management related actions.

Managing users in Cloudify Manager

If you choose not to integrate with an external user-management system, you can manage your Cloudify users on the manager itself, either by the CLI commands or the User Management widget in the Cloudify Management Console. You can create users, add them to user-groups, assign them with tenants under specific roles, deactivate and delete them.

Managing users by Integrating with an LDAP System

To integrate the Cloudify Management Console with an LDAP user repository, please follow these directions

Adding Users Manually

If you choose not to integrate Cloudify Manager with LDAP systems, you must add each user individually and set a password for them. You can also create user-groups and add users to them. The users and user groups can be assigned to one or more tenants.

For more information, see the users and user-groups commands in the CLI documentation.

You can add and remove users and user groups to/from a specific tenant. To run these user-related tenant-specific commands, use cfy tenant. For more information, see the tenants command in the CLI documentation.

How to assign a role to user

When a user is added to a tenant, a Role must be assigned to it by passing a valid value in the -r/--role option.

User Account Lock

Cloudify lets admins enforce an account lock after a user fails for a specified number of login attempts. After an account is locked the user must wait the specified time period before another login attempt, or the admin can unlock the user account.

You can configure the account lock in the Cloudify Manager either:

User Lock Settings

In either the config.yaml file or the REST service configuration, set these account lock settings:

Unlocking a user

Cloudify admins can unlock a user account with the command: cfy users unlock <username>