Chapter 8. Managing users and roles

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Click Create User.
3. Enter the account details for the new user.

4. Click Submit to create the user.

   The user account details that you can specify include the following:

   • On the User tab, select an authentication source from the Authorized by list:

     • INTERNAL: to manage the user inside Satellite Server.
     • EXTERNAL: to manage the user with external authentication. For more information, see Configuring authentication for Red Hat Satellite users.
   • On the Organizations tab, select organizations for the user. Select the default organization from the Default on login list. Satellite uses this organization for the user after login.
   • On the Locations tab, select locations for the user. Select the default location from the Default on login list. Satellite uses this location for the user after login.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.

2. Click the username of the user to be assigned one or more roles.

   Note

   If a user account is not listed, check that you are currently viewing the correct organization. To list all the users in Satellite, click Default Organization and then Any Organization.

3. Click the Locations tab, and select a location if none is assigned.
4. Click the Organizations tab, and check that an organization is assigned.
5. Click the Roles tab to display the list of available roles.

6. Select the roles to assign from the Roles list.

   To grant all the available permissions, select the Administrator checkbox.

7. Click Submit.

   To view the roles assigned to a user, click the Roles tab; the assigned roles are listed under Selected items. To remove an assigned role, click the role name in Selected items.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.

2. To the right of the user that you want to impersonate, from the list in the Actions column, select Impersonate.

   When you want to stop the impersonation session, in the upper right of the main menu, click the impersonation icon.

Procedure

1. Log in to your Satellite as admin.
2. Navigate to Administer > Users and select a user.

3. On the User tab, set a password. Do not save or communicate this password with others. You can create pseudo-random strings on your console:

   # openssl rand -hex 32

4. Create a Personal Access Token for the user. For more information, see Section 8.3.1, “Creating a Personal Access Token”.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. From the Username column, click on the username of the required user.

3. Click on the SSH Keys tab.

   • To Add SSH key

     1. Prepare the content of the public SSH key in a clipboard.
     2. Click Add SSH Key.
     3. In the Key field, paste the public SSH key content from the clipboard.
     4. In the Name field, enter a name for the SSH key.
     5. Click Submit.

   • To Remove SSH key

     1. Click Delete on the row of the SSH key to be deleted.
     2. Click OK in the confirmation prompt.

Procedure

1. To add an SSH key to a user, you must specify either the path to the public SSH key file, or the content of the public SSH key copied to the clipboard:

   • If you have the public SSH key file, enter the following command:

     $ hammer user ssh-keys add \
     --user-id user_id \
     --name key_name \
     --key-file ~/.ssh/id_rsa.pub

   • If you have the content of the public SSH key, enter the following command:

     $ hammer user ssh-keys add \
     --user-id user_id \
     --name key_name \
     --key ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNtYAAABBBHHS2KmNyIYa27Qaa7EHp+2l99ucGStx4P77e03ZvE3yVRJEFikpoP3MJtYYfIe8k 1/46MTIZo9CPTX4CYUHeN8= host@user

2. To delete an SSH key from a user, enter the following command:

   $ hammer user ssh-keys delete --id key_id --user-id user_id

3. To view an SSH key attached to a user, enter the following command:

   $ hammer user ssh-keys info --id key_id --user-id user_id

4. To list SSH keys attached to a user, enter the following command:

   $ hammer user ssh-keys list --user-id user_id

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Select a user for which you want to create a Personal Access Token.
3. On the Personal Access Tokens tab, click Add Personal Access Token.
4. Enter a Name for you Personal Access Token.
5. Optional: Select the Expires date to set an expiration date. If you do not set an expiration date, your Personal Access Token will never expire unless revoked.

6. Click Submit. You now have the Personal Access Token available to you on the Personal Access Tokens tab.

   Important

   Ensure to store your Personal Access Token as you will not be able to access it again after you leave the page or create a new Personal Access Token. You can click Copy to clipboard to copy your Personal Access Token.

Verification

1. Make an API request to your Satellite Server and authenticate with your Personal Access Token:

   $ curl \
   --user My_Username:My_Personal_Access_Token \
   https://satellite.example.com/api/status

2. You should receive a response with status 200, for example:

   {"satellite_version":"6.19.0","result":"ok","status":200,"version":"3.5.1.10","api_version":2}

   If you go back to Personal Access Tokens tab, you can see the updated Last Used time next to your Personal Access Token.

Procedure

1. In the Satellite web UI, navigate to Administer > Users.
2. Select a user for which you want to revoke the Personal Access Token.
3. On the Personal Access Tokens tab, locate the Personal Access Token you want to revoke.
4. Click Revoke in the Actions column next to the Personal Access Token you want to revoke.

Verification

1. Make an API request to your Satellite Server and try to authenticate with the revoked Personal Access Token:

   $ curl \
   --user My_Username:My_Personal_Access_Token \
   https://satellite.example.com/api/status

2. You receive the following error message:

   {
     "error": {"message":"Unable to authenticate user My_Username"}
   }

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups.
2. Click Create User group.

3. On the User Group tab, specify the name of the new user group and select group members:

   • Select the previously created user groups from the User Groups list.
   • Select users from the Users list.
4. On the Roles tab, select the roles you want to assign to the user group. Alternatively, select the Admin checkbox to assign all available permissions.
5. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Administer > User Groups.
2. Click Delete to the right of the user group you want to delete.
3. Click Confirm to delete the user group.