<commit_before>---
title: Onboarding Existing LDAP Users to a PCF Deployment
---

This topic describes the procedure for onboarding existing LDAP users to an LDAP-enabled Pivotal Cloud Foundry (PCF) deployment.

<p class='note'><strong>Note</strong>: You must have admin privileges to use this procedure.</p>

## <a id='admin-only'></a>Step 1: Configure User Management to Admin Only ##

Follow this procedure to disable **Invitations**, **Create Account** and **Reset Password** from the Apps Manager console so that users are not allowed to register new accounts. Pivotal recommends this because invitations create duplicate accounts, which can cause difficult to fix authentication problems.

1. Launch Apps Manager at `https://apps.{system-domain}`.

1. Login with admin user credentials.

1. Select your **System** org.

1. Select your **apps_manager** space and click the **apps_manager** app.

1. Select **Environment Variables**.
<%= image_tag 'apps_manager_environment_variables.png' %>

1. Locate **ENABLE\_NON\_ADMIN\_USER\_MANAGEMENT** and set it to **false**.
<%= image_tag 'set_ENABLE_NON_ADMIN_USER_MANAGEMENT_false.png' %>

1. Restart the app to apply the new configuration.

<p class='note'><strong>Note</strong>: After this change, Org Managers are unable to change space and org roles for users. This constraint will be removed in a future release.</p>

## <a id='onboard-users'></a>Step 2: Onboard LDAP Users ##

<p class='note'><strong>Note</strong>: Do not create new users in Pivotal Cloud Foundry via CF CLI, by UAAC, or by using invitations in Apps Manager. This will create a user identity in the internal user store separate from the LDAP user identity. Follow the procedure described here instead.</p>

LDAP Users can be onboarded in two ways:

- In bulk, using the UAA-LDAP Bulk Import Tool. See [the readme](https://github.com/pivotalservices/uaaldapimport/blob/master/README.md) for instructions on installing and using the tool.

- Individually, through the CF CLI, as described below:
	1. The new user must log in as an end user, with LDAP credentials, either to the CF CLI or Apps Manager. At this point the new user will not have access to any org or space.
	1. Log in to the CF CLI as the PCF Admin and associate the user with the right org and space roles. See [Org and App Space Roles](./cli-user-management.html#orgs-spaces).


## <a id='enterprise'></a> (Optional/Advanced): Integrate with Enterprise Identity Management System ##

If your organization is using an Enterprise Identity Management System for centralized provisioning and deprovisioning of users, the following APIs can be used to write a connector to manage users and permissions in PCF.


### <a id='step-id'></a>Step 1: Create User ##


1. Create the User in UAA by running
<pre class='terminal'>
 curl -H "Content-Type: application/json" \
 -k /Users -X POST \
 -d '{"userName":"marissa4", \
 "emails":[{"value":"<EMAIL>"}] , \
 "origin":"ldap","externalId":"cn=marissa4,ou=Users,dc=test,dc=com"}'
</pre>

1. Create a User record in the Cloud Controller Database with the User ID from the previous step, using the [Users API](http://apidocs.cloudfoundry.org/201/users/creating_a_user.html).


### <a id='prov-user'></a>Step 2: Provide the user access to PCF orgs ##

Associate the user with the appropriate PCF orgs, using the [Organizations API](http://apidocs.cloudfoundry.org/201/organizations/associate_user_with_the_organization.html).


### <a id='user-role'></a>Step 3: Associate User with Space or Org Role ##

- Associate an Auditor with a Space, using the [Spaces API](http://apidocs.cloudfoundry.org/201/spaces/associate_auditor_with_the_space.html).
- Associate a Developer with a Space, using the [Spaces API](http://apidocs.cloudfoundry.org/201/spaces/associate_developer_with_the_space.html).
- Associate a Manager with a Space, using the [Spaces API](http://apidocs.cloudfoundry.org/201/spaces/associate_manager_with_the_space.html).

- Associate an Auditor with a Organization using the [Organizations API](http://apidocs.cloudfoundry.org/201/organizations/associate_auditor_with_the_organization.html).
- Associate a Manager with a Organization using the [Organizations API](http://apidocs.cloudfoundry.org/201/organizations/associate_manager_with_the_organization.html).





<commit_msg>edits in response to peer review [#101245380]<commit_after>---
title: Onboarding Existing LDAP Users to Your PCF Deployment
---

This topic describes the procedure for onboarding existing LDAP users to an LDAP-enabled Pivotal Cloud Foundry (PCF) deployment.

<p class='note'><strong>Note</strong>: You must have admin access to the PCF Ops Manager Installation Dashboard for your deployment.
</p>

## <a id='admin-only'></a>Step 1: Restrict User Management to Admin Only ##

<p class='note'><strong>Note</strong>: After this change, Org Managers are unable to change space and org roles for users.</p>

Follow this procedure to disable **Invitations**, **Create Account**, and **Reset Password** from the Apps Manager console so that users are not allowed to register new accounts. Pivotal recommends this because invitations create duplicate accounts, which can cause authentication problems that are difficult to resolve.

1. Launch Apps Manager at `https://apps.SYSTEM-DOMAIN`.

1. Login with UAA admin user credentials. To find your UAA admin credentials in the PCF Ops Manager Installation Dashboard, click the **Elastic Runtime** tile, select **Credentials**, and find **UAA**.

1. Select your **System** org.

1. Select your **apps_manager** space and click the **apps_manager** app.

1. Select **Environment Variables**.
<%= image_tag 'apps_manager_environment_variables.png' %>

1. Locate **ENABLE\_NON\_ADMIN\_USER\_MANAGEMENT** and set it to **false**.
<%= image_tag 'set_ENABLE_NON_ADMIN_USER_MANAGEMENT_false.png' %>

1. Restart the app to apply the new configuration.

## <a id='onboard-users'></a>Step 2: Onboard LDAP Users ##

<p class='note'><strong>Note</strong>: Do not create new users in <%= vars.product_full %> via the Cloud Foundry command line interface (CF CLI), by UAAC, or by using invitations in Apps Manager. This will create a user identity in the internal user store separate from the LDAP user identity. Instead, follow the procedure described below.</p>

There are two ways to onboard LDAP users:

- In bulk, using the UAA-LDAP Bulk Import Tool. See [the readme](https://github.com/pivotalservices/uaaldapimport/blob/master/README.md) for instructions on installing and using the tool.

- Individually, through the CF CLI, as described below:
	1. Each existing LDAP user must log in to Apps Manager or to the CF CLI using their LDAP credentials. Users will not have access to any org or space until these are granted by an Org Manager.
	1. The PCF Admin must log in to the CF CLI and associate the user with the desired org and space roles. See [Org and App Space Roles](./cli-user-management.html#orgs-spaces).

## <a id='enterprise'></a> <strong>(Advanced Option)</strong> Integrate with Enterprise Identity Management System ##

If your organization uses an Enterprise Identity Management System for centralized provisioning and deprovisioning of users, you can use the following APIs to write a connector to manage users and permissions in Cloud Foundry.

### <a id='step-id'></a>Step 1: Create User ##

1. Create the user in UAA by running the following command. Replace 'EXAMPLE-USERNAME' with the username of the LDAP user you wish to add.
<pre class='terminal'>
 $ curl -H "Content-Type: application/json" \
 -k /Users -X POST \
 -d '{"userName":"EXAMPLE-USERNAME", \
 "emails":[{"value":"<EMAIL>"}] , \
 "origin":"ldap","externalId":"cn=EXAMPLE-USERNAME,ou=Users,dc=test,dc=com"}'
</pre>

1. Use the [Users API](http://apidocs.cloudfoundry.org/201/users/creating_a_user.html) to create a User record in the Cloud Controller Database with the existing user's LDAP GUID.
<pre class='terminal'>
$ curl "https://api.YOUR-DOMAIN/v2/users" -d '{
  "guid": "YOUR-USER-LDAP-GUID"
}' -X POST \
	-H "Authorization: bearer YOUR-BEARER-TOKEN" \
	-H "Host: YOUR-HOST-URL" \
	-H "Content-Type: application/x-www-form-urlencoded" \
	-H "Cookie: "
</pre>

### <a id='prov-user'></a>Step 2: Provide User Access to Orgs ##

Associate the user with the appropriate orgs in your <%= vars.product_full %> deployment, using the [Organizations API](http://apidocs.cloudfoundry.org/201/organizations/associate_user_with_the_organization.html).


### <a id='user-role'></a>Step 3: Associate User with Space or Org Role ##

Users can be given Space and Org roles using the following API calls:

- [Associate an Auditor with a Space](http://apidocs.cloudfoundry.org/201/spaces/associate_auditor_with_the_space.html).

- [Associate a Developer with a Space](http://apidocs.cloudfoundry.org/201/spaces/associate_developer_with_the_space.html).

- [Associate a Manager with a Space](http://apidocs.cloudfoundry.org/201/spaces/associate_manager_with_the_space.html).

- [Associate an Auditor with a Organization](http://apidocs.cloudfoundry.org/201/organizations/associate_auditor_with_the_organization.html).

- [Associate a Manager with a Organization](http://apidocs.cloudfoundry.org/201/organizations/associate_manager_with_the_organization.html).






{'fraction_non_alphanumeric': 0.10922016372253339, 'fraction_numerical': 0.00926324859974149, 'mean_word_length': 4.828625235404896, 'pattern_counts': {'":': 11, '<': 67, '<?xml version=': 0, '>': 67, 'https://': 5, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4759139', 'n_tokens_mistral': 2851, 'n_tokens_neox': 2681, 'n_words': 1057}