14.8. Administering User Tasks From the Command Line

Procedure 14.12. Creating a User

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Create a new user account. Optionally use --attribute to specify account details. For a full list of options, run ovirt-aaa-jdbc-tool user add --help.

   # ovirt-aaa-jdbc-tool user add test1 --attribute=firstName=John --attribute=lastName=Doe 
   adding user test1...
   user added successfully

   Copy to Clipboard
3. Set a password. You must set a value for --password-valid-to, otherwise the password expiry time defaults to the current time. The date format is yyyy-MM-dd HH:mm:ssX. In this example, -0800 stands for GMT minus 8 hours. For more options, run ovirt-aaa-jdbc-tool user password-reset --help.

   # ovirt-aaa-jdbc-tool user password-reset test1 --password-valid-to="2025-08-01 12:00:00-0800"
   Password:
   updating user test1...
   user updated successfully
   

   Copy to Clipboard

   Note

   By default, the password policy for user accounts on the internal domain has the following restrictions:

   • A minimum of 6 characters.
   • Three previous passwords used cannot be set again during the password change.

   For more information on the password policy and other default settings, run ovirt-aaa-jdbc-tool settings show.
4. Add the newly created user in the Administration Portal and assign the user appropriate roles and permissions. See Section 14.7.1, “Adding Users and Assigning User Portal Permissions” for more information.

Procedure 14.13. Viewing User Information

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Run the following command:

   # ovirt-aaa-jdbc-tool user show test1

   Copy to Clipboard

Procedure 14.14. Editing User Information

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Run the following command to edit user information. This example updates the email address.

   # ovirt-aaa-jdbc-tool user edit test1 --attribute=email=jdoe@example.com

   Copy to Clipboard

Procedure 14.15. Removing a User

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Delete the user:

   # ovirt-aaa-jdbc-tool user delete test1

   Copy to Clipboard
3. Remove the user from the Administration Portal. See Section 14.7.4, “Removing Users” for more information.

Procedure 14.16. Resetting the Password for the Internal Administrative User

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. To change the password in interactive mode, run the following command. You must set a value for --password-valid-to, otherwise the password expiry time defaults to the current time. The date format is yyyy-MM-dd HH:mm:ssX. In this example, Z stands for UTC time. For more options, run ovirt-aaa-jdbc-tool user password-reset --help.

   # ovirt-aaa-jdbc-tool user password-reset admin --password-valid-to="2025-08-01 12:00:00Z"

   Copy to Clipboard

Procedure 14.17. Disabling the Internal Administrative User

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Make sure another user with the SuperUser role has been added to the environment. See Section 14.7.1, “Adding Users and Assigning User Portal Permissions” for more information.
3. Disable the default admin user:

   # ovirt-aaa-jdbc-tool user edit admin --flag=+disabled

   Copy to Clipboard

   Note

   To enable a disabled user, run ovirt-aaa-jdbc-tool user edit username --flag=-disabled

Procedure 14.18. Creating a Group

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Create a new group:

   # ovirt-aaa-jdbc-tool group add group1

   Copy to Clipboard
3. Add users to the group. The users must be created already.

   # ovirt-aaa-jdbc-tool group-manage useradd group1 --user=test1

   Copy to Clipboard

   Note

   For a full list of the group-manage options, run ovirt-aaa-jdbc-tool group-manage --help.
4. View group account details:

   # ovirt-aaa-jdbc-tool group show group1

   Copy to Clipboard
5. Add the newly created group in the Administration Portal and assign the group appropriate roles and permissions. The users in the group inherit the roles and permissions of the group. See Section 14.7.1, “Adding Users and Assigning User Portal Permissions” for more information.

Procedure 14.19. Creating Nested Groups

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Create the first group:

   # ovirt-aaa-jdbc-tool group add group1

   Copy to Clipboard
3. Create the second group:

   # ovirt-aaa-jdbc-tool group add group1-1

   Copy to Clipboard
4. Add the second group to the first group:

   # ovirt-aaa-jdbc-tool group-manage groupadd group1 --group=group1-1

   Copy to Clipboard
5. Add the first group in the Administration Portal and assign the group appropriate roles and permissions. See Section 14.7.1, “Adding Users and Assigning User Portal Permissions” for more information.

Procedure 14.20. Listing All User or Group Account Details

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. • List all user account details:

     # ovirt-aaa-jdbc-tool query --what=user

     Copy to Clipboard
   • List all group account details:

     # ovirt-aaa-jdbc-tool query --what=group

     Copy to Clipboard

Procedure 14.21. Listing Filtered Account Details

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. • List user account details with names that start with the character j.

     # ovirt-aaa-jdbc-tool query --what=user --pattern="name=j*"

     Copy to Clipboard
   • List groups that have the department attribute set to marketing:

     # ovirt-aaa-jdbc-tool query --what=group --pattern="department=marketing"

     Copy to Clipboard

Procedure 14.22. Updating Account Settings

1. Log in to the machine on which the Red Hat Enterprise Virtualization Manager is installed.
2. Run the following command to show all the settings available:

   # ovirt-aaa-jdbc-tool setting show

   Copy to Clipboard
3. Change the desired settings:

   • This example updates the default log in session time to 60 minutes for all user accounts. The default value is 10080 minutes.

     # ovirt-aaa-jdbc-tool setting set --name=MAX_LOGIN_MINUTES --value=60

     Copy to Clipboard
   • This example updates the number of failed login attempts a user can perform before the user account is locked. The default value is 5.

     # ovirt-aaa-jdbc-tool setting set --name=MAX_FAILURES_SINCE_SUCCESS --value=3

     Copy to Clipboard

     Note

     To unlock a locked user account, run ovirt-aaa-jdbc-tool user unlock test1.