Hello
Welcome to this video about managing internal domain users and groups with command line
for Oracle Linux Virtualization Manager.
In this video we will describe the use of a command line tool to manage local users
and groups for the Oracle Linux Virtualization Manager system.
We will describe the need to use a command line tool to add users and groups to the system
before importing them and managing them through the Administration Portal.
Using the tool, we will show how to add and remove internal domain users and groups to
the system.
We will see how to set user related account settings and user passwords.
Then we will see how to query user and group information from the command line.
Before local users can use their login credentials to access the Administration and VM Portal
sites, new users and groups are added to the system using the ovirt-aaa-jdbc-tool command
utility.
This utility is used to manage user and group accounts on the internal domain, which is
also called the local domain.
As mentioned already, the command line tool is used to add and remove users and groups,
reset users passwords and change default account settings.
To run the command line tool, root level privileges are required.
Permission settings and functional roles carried out by the user can be assigned through the
Administration Portal after the new user or group is created and imported into the system.
Users must be created through command line before they can be added and assigned roles
and permissions through the Administration Portal.
The roles and permissions assigned give the user the ability to manage elements of the
cloud environment, for example using the VM Portal to start creating virtual machines.
The permissions can also be associated to users through group accounts.
The ovirt-aaa-jdbc-tool command manages user accounts on the internal domain.
Changes made with the tool take effect immediately and do not require you to restart the ovirt-engine
service.
Passwords for users are set and reset using the command line tool.
By default, the following password policy applies to user accounts on the internal domain.
Passwords must be a minimum of 6 characters.
Three previous passwords used cannot be used again when changing the password.
Using the command ovirt-aaa-jdbc-tool settings show will inform about the various password
policy settings and default settings.
Internal domain, also called local users, and created through command line are local
to the ovirt database for the system.
External directory servers such as LDAP or Active Directory can be attached and offer
users to the system from external domains.
All user types are easily added to the system in the same way through an Administration
Portal dialog.
After adding both user types to the oVirt database, they are treated similarly in the
Administration Portal when granting permissions.
Passwords for the users are managed by the respective tool or system that was used to
initially create them.
Groups are first created and managed with the command line tool also.
Users can be associated with groups, and inherit group permissions.
Groups are first created with the command line tool and then imported into the Administration
Portal.
In the portal, roles with associated permissions can be assigned to groups, which are then
inherited by their users.
So lets look at the use of the tool to create and manage users and groups.
I have already established a ssh connection to the host runnng the ovirt engine and we
are looking at the command line.
I earlier changed to have root level privileges to run these commands.
First, I will look at ovirt-aaa-jdbc-tool command help information.
To get this I run the command with the --help option.
We see in the output the command options that can be applied to the command and the modules
that can be implemented.
For example the user, group or query module.
Running the command again, but this time looking for help for the user module, we run the command
specifying the module user followed by the --help option.
This time we can see modules such as add, edit, delete, password-reset are available
to use.
And if you query help for the user add modules, it shows many options that can be associated
with a new user.
But it also shows there is no more command modules that can be run with the add module.
So to show the command working lets add a new user with the command.
First lets clear the screen with the clear command.
To add a new user we run the command ovirt-aaa-jdbc-tool user add followed by the name of the new user,
in this case trnuser1.
The output show the user was added successfully.
To set a password for the new user of to reset the password for an existing user, we use
the command ovirt-aaa-jdbc-tool user password-reset and identify the user.
You must also set a value for the --password-valid-to option, otherwise the password expiry time
defaults to the time of the last login.
Passwords must be at least six characters long, and when resetting a password, the new
password cannot be the same as the last three ones used.
Here we set the password expiry date with the --password-valid-to option to be 1st August
2025 and a time of 12 noon at GMT minus eight hours.
We enter the password twice and its set.
We can verify the added user with user show modules followed by the user name.
It shows us any modified settings we have applied, in this case the password valid setting.
Just like setting the password, we can use the --password-reset option to modify it.
And we must give the --password-valid-to option also.
Here we set it for the year month day and time, with the zero eight zero zero identifying
GMT minus eight hours.
Now lets look at adding another user called trnuser2, this time setting the first and
last name attributes.
With the attribute firstname we give a first name of Bill and the attribute lastname we
give a lastname of Smith.
Again, for every new user we must set a password, here we simply use the same password valid
to setting as the previous user.
We can also use the tool to disable a user account.
Using the command module user edit, identifying the username, and set the flag to plus disabled.
To remove a user we use the command with the user delete module, and identify the username.
Here we delete the recently added user trnuser2.
Just like users, groups must be created first with the tool before they can be imported
and managed through the Administration portal.
Using the command with the module group add, we add a group called trngroup10.
If we want to add additional users to a group, we use the group-manage useradd module and
identify the users to add with the string --user= followed by user name.
We can add multiple users to a group by repeatedly adding the same option string to the command
identifying all the users to add.
Here we are adding users trnuser11 and trnuser12 to the same group trngroup10.
We can see details of the group using the command with the group show module and the
name of the group.
Deleting a group means using the group delete module and identifying the name of the group.
Here we are deleting the group trngroup10.
To see the default account settings applied with the commands, we can use the command
with the settings show module.
These default settings can also be changed using the command.
In this video we looked at the use of a command line tool to manage users and groups for the
Oracle Linux Virtualization Manager system.
We described the need to use command line to add users and groups to the system before
managing them through the Administration Portal.
Using the command line tool we saw how to add and remove users and groups to the system.
We saw how to view account settings and set user passwords.
Then we saw how to query user and group information using the command line tool.
Oracle provides an extensive number of resources which you can use to find out more about this
subject and others.
You can find documentation on Oracle Linux Virtualization Manager at the link shown.
There is a comprehensive Oracle Linux curriculum available to support a full range of Linux
administration skills for cloud, on-premise and hybrid users.
For more information or to get started on Oracle Cloud Infrastructure, go to cloud.oracle.com.
And for more training on Linux on Oracle Cloud Infrastructure go to the link shown here.
Thats the end of the video, thanks for watching.