kyvernon users

`kyvernon users`

User administration

Usage

kyvernon users <COMMAND>

Subcommands: list, get, create, delete, set-password, enable, disable, revoke-sessions, reset-mfa, unlock, service-account, api-tokens, update, password-policy, set-password-policy, oidc, set-oidc, remove-oidc, lockout-policy, set-lockout-policy, groups

`kyvernon users list`

List users

Usage

kyvernon users list

API operation: GET /v1/identity/users

`kyvernon users get`

One user, with the lockout state (locked, lockedUntil)

Usage

kyvernon users get <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: GET /v1/identity/users/{username}

`kyvernon users create`

Create a user (password from KYVERNON_PASSWORD or stdin)

Usage

kyvernon users create [OPTIONS] <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes
`--display-name`	Display name
`--email`	E-mail
`--group`	Group memberships
`--rotation-required`	Require a password change at first login

API operation: POST /v1/identity/users

`kyvernon users delete`

Delete a user

Usage

kyvernon users delete <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: DELETE /v1/identity/users/{username}

`kyvernon users set-password`

Set a user's password (from KYVERNON_PASSWORD or stdin)

Usage

kyvernon users set-password <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: POST /v1/identity/users/{username}/password

`kyvernon users enable`

Enable a user

Usage

kyvernon users enable <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: PUT /v1/identity/users/{username}/enabled

`kyvernon users disable`

Disable a user (sessions are revoked)

Usage

kyvernon users disable <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

`kyvernon users revoke-sessions`

Revoke every session of a user

Usage

kyvernon users revoke-sessions <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: DELETE /v1/identity/users/{username}/sessions

`kyvernon users reset-mfa`

Remove a user's TOTP enrolment

Usage

kyvernon users reset-mfa <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: DELETE /v1/identity/users/{username}/mfa

`kyvernon users unlock`

Lift the lockout of a user after failed logins

Usage

kyvernon users unlock <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: POST /v1/identity/users/{username}/unlock

`kyvernon users service-account`

Mark a user as a service account (no password rotation or MFA), or back

Usage

kyvernon users service-account [OPTIONS] <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes
`--enabled`	`true` or `false` default `true`; values `true`, `false`

API operation: PUT /v1/identity/users/{username}/service-account

`kyvernon users api-tokens`

A user's API tokens

Usage

kyvernon users api-tokens <USERNAME> <COMMAND>

Argument	Description	Required
`<USERNAME>`	Username	yes

API operation: GET /v1/identity/users/{username}/api-tokens

Subcommands: list, create, delete

`kyvernon users api-tokens list`

List tokens

Usage

kyvernon users api-tokens list

`kyvernon users api-tokens create`

Create a token; the secret is printed once

Usage

kyvernon users api-tokens create [OPTIONS] <NAME>

Argument	Description	Required
`<NAME>`	Token name	yes
`--ttl`	Lifetime in seconds, up to the controller maximum (365 days unless configured); default: that maximum. Every token expires

`kyvernon users api-tokens delete`

Delete a token

Usage

kyvernon users api-tokens delete <ID>

Argument	Description	Required
`<ID>`	Token id	yes

`kyvernon users update`

Change display name, e-mail address and local groups of a user

Usage

kyvernon users update [OPTIONS] <USERNAME>

Argument	Description	Required
`<USERNAME>`	Username	yes
`--display-name`	Display name
`--email`	E-mail address
`--group`	Local group (repeat; replaces the set; `--no-groups` empties it)
`--no-groups`	Remove the user from every local group

API operation: PUT /v1/identity/users/{username}

`kyvernon users password-policy`

Show the password policy

Usage

kyvernon users password-policy

API operation: GET /v1/identity/password-policy

`kyvernon users set-password-policy`

Change the password policy (applies to passwords set afterwards)

Usage

kyvernon users set-password-policy [OPTIONS]

Argument	Description	Required
`--min-length`	Shortest password (at least 12)	yes
`--max-length`	Longest password (at most 256)	yes
`--description`	Text for administrators

API operation: PUT /v1/identity/password-policy

`kyvernon users oidc`

Show the OpenID Connect identity provider (the client secret is never shown)

Usage

kyvernon users oidc

API operation: GET /v1/identity/oidc/config

`kyvernon users set-oidc`

Set up the OpenID Connect identity provider; the controller checks that it answers

Usage

kyvernon users set-oidc [OPTIONS]

Argument	Description	Required
`--issuer`	Issuer URL	yes
`--client-id`	Client id registered at the provider	yes
`--client-secret-file`	File with the client secret (`-` for stdin); omitted keeps the stored one
`--redirect-uri`	Redirect URI registered at the provider (`https://<controller>/v1/identity/oidc/callback`)	yes
`--scope`	Scope beyond `openid` (repeat; default profile, email, groups)
`--groups-claim`	Claim of the ID token with the group names default `groups`
`--login-ttl`	How long a started sign-in stays valid, seconds (60 to 3600) default `600`

API operation: PUT /v1/identity/oidc/config

`kyvernon users remove-oidc`

Remove the identity provider; local sign-in stays

Usage

kyvernon users remove-oidc

API operation: DELETE /v1/identity/oidc/config

`kyvernon users lockout-policy`

Show the account lockout policy

Usage

kyvernon users lockout-policy

API operation: GET /v1/identity/lockout-policy

`kyvernon users set-lockout-policy`

Change the account lockout policy

Usage

kyvernon users set-lockout-policy [OPTIONS]

Argument	Description	Required
`--max-failed-attempts`	Failed logins that lock the account (1 to 1000)	yes
`--failed-attempt-interval`	Window in which failed logins count, in seconds	yes
`--auto-unlock-interval`	How long the account stays locked, in seconds	yes
`--description`	Text for administrators

API operation: PUT /v1/identity/lockout-policy

`kyvernon users groups`

Local groups and their members

Usage

kyvernon users groups <COMMAND>

Subcommands: list, get, create, update, delete, add, remove-user, set-members, remove-group

`kyvernon users groups list`

List groups

Usage

kyvernon users groups list [OPTIONS]

Argument	Description	Required
`--search`	Only names containing this text

API operation: GET /v1/identity/groups

`kyvernon users groups get`

One group with its members

Usage

kyvernon users groups get <NAME>

Argument	Description	Required
`<NAME>`	Group name	yes

API operation: GET /v1/identity/groups/{name}

`kyvernon users groups create`

Create a group

Usage

kyvernon users groups create [OPTIONS] <NAME>

Argument	Description	Required
`<NAME>`	Group name	yes
`--description`	Description

API operation: POST /v1/identity/groups

`kyvernon users groups update`

Rename a group or change its description

Usage

kyvernon users groups update [OPTIONS] <NAME>

Argument	Description	Required
`<NAME>`	Group name	yes
`--name`	New name
`--description`	New description

API operation: PUT /v1/identity/groups/{name}

`kyvernon users groups delete`

Delete a group

Usage

kyvernon users groups delete <NAME>

Argument	Description	Required
`<NAME>`	Group name	yes

API operation: DELETE /v1/identity/groups/{name}

`kyvernon users groups add`

Add users and nested groups

Usage

kyvernon users groups add [OPTIONS] <NAME>

Argument	Description	Required
`<NAME>`	Group name	yes
`--user`	User to add (repeat)
`--group`	Group to nest (repeat)

API operation: POST /v1/identity/groups/{name}/members

`kyvernon users groups remove-user`

Remove a user from a group

Usage

kyvernon users groups remove-user <NAME> <USERNAME>

Argument	Description	Required
`<NAME>`	Group name	yes
`<USERNAME>`	Username	yes

API operation: DELETE /v1/identity/groups/{name}/members/users/{username}

`kyvernon users groups set-members`

Replace the members of a group

Usage

kyvernon users groups set-members [OPTIONS] <NAME>

Argument	Description	Required
`<NAME>`	Group name	yes
`--user`	User (repeat)
`--group`	Nested group (repeat)

API operation: PUT /v1/identity/groups/{name}/members

`kyvernon users groups remove-group`

Remove a nested group from a group

Usage

kyvernon users groups remove-group <NAME> <MEMBER>

Argument	Description	Required
`<NAME>`	Group name	yes
`<MEMBER>`	Nested group name	yes

API operation: DELETE /v1/identity/groups/{name}/members/groups/{member}