15.7. Administering User Tasks From the Command Line

You can create a new user account. The optional --attribute command specifies account details. For a full list of options, run ovirt-aaa-jdbc-tool user add --help.

# ovirt-aaa-jdbc-tool user add test1 --attribute=firstName=John --attribute=lastName=Doe
adding user test1...
user added successfully

You can add the newly created user in the Administration Portal and assign the user appropriate roles and permissions. See Section 15.6.1, “Adding Users and Assigning VM Portal Permissions” for more information.

You can create a password. You must set a value for --password-valid-to, otherwise the password expiry time defaults to the current time. The date format is yyyy-MM-dd HH:mm:ssX. In this example, -0800 stands for GMT minus 8 hours. For more options, run ovirt-aaa-jdbc-tool user password-reset --help.

# ovirt-aaa-jdbc-tool user password-reset test1 --password-valid-to="2025-08-01 12:00:00-0800"
Password:
updating user test1...
user updated successfully

You can set the user timeout period:

# engine-config --set UserSessionTimeOutInterval=integer

You can create a pre-encrypted user password using the ovirt-engine-crypto-tool script. This option is useful if you are adding users and passwords to the database with a script.

You can view detailed user account information:

# ovirt-aaa-jdbc-tool user show test1

This command displays more information than in the Administration Portal’s Administration Users screen.

You can update user information, such as the email address:

# ovirt-aaa-jdbc-tool user edit test1 --attribute=email=jdoe@example.com

You can remove a user account:

# ovirt-aaa-jdbc-tool user delete test1

Remove the user from the Administration Portal. See Section 15.6.4, “Removing Users” for more information.

You can disable users on the local domains including the admin@internal user created during engine-setup. Make sure you have at least one user in the envrionment with full administrative permissions before disabling the default admin user.

Disabling the Internal Administrative User

You can use the ovirt-aaa-jdbc-tool tool to manage group accounts on your internal domain. Managing group accounts is similar to managing user accounts. For a full list of group options, run ovirt-aaa-jdbc-tool group --help. Common examples are provided in this section.

Creating a Group

This procedure shows you how to create a group account, add users to the group, and view the details of the group.

Creating Nested Groups

This procedure shows you how to create groups within groups.

The query module allows you to query user and group information. For a full list of options, run ovirt-aaa-jdbc-tool query --help.

Listing All User or Group Account Details

This procedure shows you how to list all account information.

Listing Filtered Account Details

This procedure shows you how to apply filters when listing account information.

To change the default account settings, use the ovirt-aaa-jdbc-tool settings module.

Updating Account Settings

This procedure shows you how to update the default account settings.