<commit_before>---
title: Creating and Managing Users with the UAA CLI (UAAC)
---

Using the UAA Command Line Interface (UAAC), an administrator can create users
and manage organization and space roles.

For additional details and information, refer to the following topics:

* [UAA Overview](../concepts/architecture/uaa.html)
* [UAA Sysadmin Guide](https://github.com/cloudfoundry/uaa/blob/master/docs/Sysadmin-Guide.rst)
* [Other UAA Documentation](https://github.com/cloudfoundry/uaa/tree/master/docs)

## <a id='creating-admin-users'></a>Creating an Admin User ##

1. Install the UAA CLI, `uaac`.
    <pre class="terminal">
    $ gem install cf-uaac
    </pre>

1. Use `uaac target uaa.YOUR-DOMAIN` to target your UAA server.
    <pre class="terminal">
    $ uaac target uaa.example.com
    </pre>

1. Record the **uaa:admin:client_secret** from your deployment manifest.

1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
obtain an access token for the admin client from the UAA server.
UAAC stores the token in `~/.uaac.yml`.
    <pre class="terminal">
    $ uaac token client get admin -s <PASSWORD>
    </pre>

1. Use `uaac contexts` to display the users and applications authorized by the
UAA server, and the permissions granted to each user and application.

    <pre class="terminal">
    $ uaac contexts

    [1]*[admin]
      client_id: admin
        access_token: <KEY>
        token_type: bearer
        expires_in: 43200
        scope: uaa.admin clients.secret scim.read
        jti: 91b3-abcd1233
    </pre>

1. In the output from `uaac contexts`, search in the `scope` section of the
`client_id: admin` user for **scim.write**.
The value **scim.write** represents sufficient permissions to create accounts.

1. If the admin user lacks permissions to create accounts:
    * Use `uaac client update admin --authorities "EXISTING-PERMISSIONS
    scim.write"` to add the necessary permissions to the admin user account on
	the UAA server. Replace EXISTING-PERMISSIONS with the current contents of
	the `scope` section from `uaac contexts`.
    * Use `uaac token delete` to delete the local token.
    * Use `uaac token client get admin` to obtain an updated access token from
	the UAA server.

    <pre class="terminal">
    $ uaac contexts

    [1]*[admin]
      client_id: admin
      . . .
      scope: uaa.admin clients.secret scim.read
	  . . .

    $ uaac client update admin --authorities "`uaac client get admin | \
      awk '/:/{e=0}/authorities:/{e=1;if(e==1){$1="";print}}'` scim.write"

    $ uaac token delete
    $ uaac token client get admin
    </pre>

1. Use `uaac user add NEW-ADMIN-USERNAME -p NEW-ADMIN-PASSWORD --emails NEW-ADMIN-EMAIL` to create an admin user.
    <pre class="terminal">
    $ uaac user add Adam -p newAdminSecretPassword --emails <EMAIL>
    </pre>

1. Use `uaac member add GROUP NEW-ADMIN-USERNAME` to add the
new admin to the groups `cloud_controller.admin`, `uaa.admin`, `scim.read`, 'scim.write`.
    <pre class="terminal">
    $ uaac member add cloud_controller.admin Adam
    $ uaac member add uaa.admin Adam
    $ uaac member add scim.read Adam
    $ uaac member add scim.write Adam
    </pre>

## <a id='ldap-group'></a>Granting Admin Permissions to an LDAP Group ##

To grant all users under an LDAP Group admin permissions:

1. Obtain the credentials of an admin client created using UAAC as above, or
refer to the the `uaa: scim` section of your deployment manifest for the user
name and password of an admin user.

1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
obtain an access token for the admin client from the UAA server.
UAAC stores the token in `~/.uaac.yml`.
    <pre class="terminal">
    $ uaac token client get admin -s <PASSWORD>
    </pre>

1. Use `uaac group map cloud_controller.admin GROUP-DISTINGUISHED-NAME` to grant
all user under the mapped LDAP Group admin permissions.

## <a id='creating-users'></a>Creating Users ##

1. Obtain the credentials of an admin client created using UAAC as above, or
refer to the the `uaa: scim` section of your deployment manifest for the user
name and password of an admin user.

1. Use `cf login -u NEW-ADMIN-USERNAME -p NEW-ADMIN-PASSWORD` to log in.
    <pre class="terminal">
    $ cf login -u Adam -p <PASSWORD>
    </pre>

1. Use `cf create-user NEW-USER-NAME NEW-USER-PASSWORD` to create a new
user.
    <pre class="terminal">
    $ cf create-user Charlie aNewPassword
    </pre>

## <a id='changing-passwords'></a>Changing Passwords ##

1. Obtain the credentials of an admin client created using UAAC as above, or
refer to the the `uaa: scim` section of your deployment manifest for the user
name and password of an admin user.

1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
obtain an access token for the admin client from the UAA server.
UAAC stores the token in `~/.uaac.yml`.
    <pre class="terminal">
    $ uaac token client get admin -s <PASSWORD>
    </pre>

1. Use `uaac contexts` to display the users and applications authorized by the
UAA server, and the permissions granted to each user and application.

    <pre class="terminal">
    $ uaac contexts

    [1]*[admin]
      client_id: admin
        access_token: <KEY>
        token_type: bearer
        expires_in: 43200
        scope: uaa.admin clients.secret password.read
        jti: 91b3-abcd1233
    </pre>

1. In the output from `uaac contexts`, search in the `scope` section of the
`client_id: admin` user for **password.<PASSWORD>**.
The value **password.write** represents sufficient permissions to change
passwords.

1. If the admin user lacks permissions to change passwords:<commit_msg>chnage 'the the' to 'the' in uaa-user-management.html<commit_after>---
title: Creating and Managing Users with the UAA CLI (UAAC)
---

Using the UAA Command Line Interface (UAAC), an administrator can create users
and manage organization and space roles.

For additional details and information, refer to the following topics:

* [UAA Overview](../concepts/architecture/uaa.html)
* [UAA Sysadmin Guide](https://github.com/cloudfoundry/uaa/blob/master/docs/Sysadmin-Guide.rst)
* [Other UAA Documentation](https://github.com/cloudfoundry/uaa/tree/master/docs)

## <a id='creating-admin-users'></a>Creating an Admin User ##

1. Install the UAA CLI, `uaac`.
    <pre class="terminal">
    $ gem install cf-uaac
    </pre>

1. Use `uaac target uaa.YOUR-DOMAIN` to target your UAA server.
    <pre class="terminal">
    $ uaac target uaa.example.com
    </pre>

1. Record the **uaa:admin:client_secret** from your deployment manifest.

1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
obtain an access token for the admin client from the UAA server.
UAAC stores the token in `~/.uaac.yml`.
    <pre class="terminal">
    $ uaac token client get admin -s <PASSWORD>
    </pre>

1. Use `uaac contexts` to display the users and applications authorized by the
UAA server, and the permissions granted to each user and application.

    <pre class="terminal">
    $ uaac contexts

    [1]*[admin]
      client_id: admin
        access_token: <KEY>
        token_type: bearer
        expires_in: 43200
        scope: uaa.admin clients.secret scim.read
        jti: 91b3-abcd1233
    </pre>

1. In the output from `uaac contexts`, search in the `scope` section of the
`client_id: admin` user for **scim.write**.
The value **scim.write** represents sufficient permissions to create accounts.

1. If the admin user lacks permissions to create accounts:
    * Use `uaac client update admin --authorities "EXISTING-PERMISSIONS
    scim.write"` to add the necessary permissions to the admin user account on
	the UAA server. Replace EXISTING-PERMISSIONS with the current contents of
	the `scope` section from `uaac contexts`.
    * Use `uaac token delete` to delete the local token.
    * Use `uaac token client get admin` to obtain an updated access token from
	the UAA server.

    <pre class="terminal">
    $ uaac contexts

    [1]*[admin]
      client_id: admin
      . . .
      scope: uaa.admin clients.secret scim.read
	  . . .

    $ uaac client update admin --authorities "`uaac client get admin | \
      awk '/:/{e=0}/authorities:/{e=1;if(e==1){$1="";print}}'` scim.write"

    $ uaac token delete
    $ uaac token client get admin
    </pre>

1. Use `uaac user add NEW-ADMIN-USERNAME -p NEW-ADMIN-PASSWORD --emails NEW-ADMIN-EMAIL` to create an admin user.
    <pre class="terminal">
    $ uaac user add Adam -p newAdminSecretPassword --emails <EMAIL>
    </pre>

1. Use `uaac member add GROUP NEW-ADMIN-USERNAME` to add the
new admin to the groups `cloud_controller.admin`, `uaa.admin`, `scim.read`, 'scim.write`.
    <pre class="terminal">
    $ uaac member add cloud_controller.admin Adam
    $ uaac member add uaa.admin Adam
    $ uaac member add scim.read Adam
    $ uaac member add scim.write Adam
    </pre>

## <a id='ldap-group'></a>Granting Admin Permissions to an LDAP Group ##

To grant all users under an LDAP Group admin permissions:

1. Obtain the credentials of an admin client created using UAAC as above, or
refer to the `uaa: scim` section of your deployment manifest for the user
name and password of an admin user.

1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
obtain an access token for the admin client from the UAA server.
UAAC stores the token in `~/.uaac.yml`.
    <pre class="terminal">
    $ uaac token client get admin -s <PASSWORD>
    </pre>

1. Use `uaac group map cloud_controller.admin GROUP-DISTINGUISHED-NAME` to grant
all user under the mapped LDAP Group admin permissions.

## <a id='creating-users'></a>Creating Users ##

1. Obtain the credentials of an admin client created using UAAC as above, or
refer to the `uaa: scim` section of your deployment manifest for the user
name and password of an admin user.

1. Use `cf login -u NEW-ADMIN-USERNAME -p NEW-ADMIN-PASSWORD` to log in.
    <pre class="terminal">
    $ cf login -u Adam -p <PASSWORD>SecretPassword
    </pre>

1. Use `cf create-user NEW-USER-NAME NEW-USER-PASSWORD` to create a new
user.
    <pre class="terminal">
    $ cf create-user Charlie aNewPassword
    </pre>

## <a id='changing-passwords'></a>Changing Passwords ##

1. Obtain the credentials of an admin client created using UAAC as above, or
refer to the `uaa: scim` section of your deployment manifest for the user
name and password of an admin user.

1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
obtain an access token for the admin client from the UAA server.
UAAC stores the token in `~/.uaac.yml`.
    <pre class="terminal">
    $ uaac token client get admin -s <PASSWORD>
    </pre>

1. Use `uaac contexts` to display the users and applications authorized by the
UAA server, and the permissions granted to each user and application.

    <pre class="terminal">
    $ uaac contexts

    [1]*[admin]
      client_id: admin
        access_token: <KEY>
        token_type: bearer
        expires_in: 43200
        scope: uaa.admin clients.secret password.read
        jti: 91b3-abcd1233
    </pre>

1. In the output from `uaac contexts`, search in the `scope` section of the
`client_id: admin` user for **password.write**.
The value **password.write** represents sufficient permissions to change
passwords.

1. If the admin user lacks permissions to change passwords:
{'fraction_non_alphanumeric': 0.09855453350854139, 'fraction_numerical': 0.008935611038107753, 'mean_word_length': 3.3456414160639514, 'pattern_counts': {'":': 0, '<': 82, '<?xml version=': 0, '>': 82, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '103286', 'n_tokens_mistral': 3676, 'n_tokens_neox': 3525, 'n_words': 1436}