In this video, I'll discuss and demonstrate user creation in different authorization groups
on Oracle Private Cloud Appliance.
I'll begin this demonstration by using the Service Command-Line-Interface but I'll also
use the Service Web interface later in this video.
To access the Service CLI you establish an SSH connection to TCP port 30006 on one of
the management nodes in your appliance.
This is the syntax of the command you need to run, ssh admin@management_node -p 30006.
Since I'm already logged on to a management node, I'll run this command, and specify localhost
and provide the admin user password and now I'm connected.
The Service CLI prompt, PCA-ADMIN, is displayed.
First I'll list the available authorization groups by running the command list AuthorizationGroup.
The output shows there are 6 of these groups.
I'll describe each of these authorization groups beginning with the SuperAdminGroup.
Administrators with the SuperAdmin role have unrestricted access to the Service Enclave.
They are authorized to perform all available operations, including the setup of other administrator
accounts and management of authorization groups.
The Admin role grants permission to list, create, modify and delete practically all
supported object types.
Permissions excluded from this role are: administrator account and authorization group management,
and disaster recovery operations.
Administrators with a Monitor role are authorized to execute read-only commands.
For example, using the get API calls, they can list and filter for objects of a certain
type.
The DrAdmin role grants the same permissions as the Admin role, with the addition of all
operations related to disaster recovery.
The Day0Config role only provides specific access to operations related to the initial
setup of the appliance – a process also referred to as the "day zero configuration".
And finally, the Internal role is reserved for internal system use only.
Let's list the current users on the system by running the command list user.
The output shows there are 3 current users.
We can use the show user command and provide the name=user argument to see which authorization
group each user belongs to.
The admin user belongs to the SuperAdminGroup.
The grafana_admin user belongs to the MonitorGroup.
And the pca_admin user belongs to the AdminGroup.
I will now add a new user using the createUserInGroup command.
This command requires a name= argument, a password= argument, a confirmPassword= argument
and an authGroup= argument.
The authGroup= argument requires the id of the Authorization Group so I'll run the list
AuthorizationGroup again to view the ids.
Now I can use the createUserInGroup command to add a new user named demo and provide and
confirm a password, and I'll provide the id of the DrAdminGroup to add the new user to
this group.
The command was a success.
Now if I run the list user command, we see the new demo user.
And I'll run the show user name=demo command and confirm that the authorization group is
DRAdmin for the user.
To add an existing user to an authorization group, use the add User command.
This command requires an id= argument for the user, the phrase "to AuthorizationGroup",
and an id= argument for the authorization group.
I'll run the add user command and provide the id of the demo user, then the phrase "to
AuthorizationGroup", and provide the id of the SuperAdmin group.
The command was a success.
Now if I run the show user name=demo command, we see that the demo user now belongs to 2
authorization groups.
To remove an authorization group from a user, use the remove User command.
This command requires a name= argument for the user, the phrase "from AuthorizationGroup",
and an id= argument for the authorization group.
I'll first run this command incorrectly by providing the id for the user and we see that
the command fails.
You need to provide the user name, not the id, so I'll run this command again and it
is a success.
I'll now run the show user name=demo command and we see that the second authorization group
has been removed.
I'll now demonstrate the authorization group functions that can be performed from the Service
Web interface.
I've logged on to the Service Web interface as the admin user.
From the Dashboard, click the Users button.
To add a user to an authorization group, click the Create User button.
I'll add a user named test.
Click the drop-down menu to select an authorization group.
From the Service Web interface, the only options are Admin, Monitor, and SuperAdmin.
You must use the Service Command-Line-Interface to select the DrAdmin, or Day0Config, or Internal
authorization groups.
Provide a password and confirm the password.
Click the Create User button and the new user shows up in the list.
For existing users, I'll click the actions button.
The only options available are view details, copy the ID, change the password, or delete
the user.
You must use the Service Command-Line-Interface to add or remove an authorization group for
an existing user.
This concludes this demonstration.
Thank you for watching.
Please check our additional information on Oracle Private Cloud Appliance in the Oracle
Private Cloud Appliance Documentation or in the Oracle Private Cloud Appliance Learning
Library.