ags local-database

The ags local-database command manages the local databases in which the user accounts are kept in the scenarios in which there is no external directory or identity provider. Every database carries its own password policy. Its panel equivalent is the Local Databases screen.

The database is only the container of the accounts; the accounts are opened with ags local-user and, in order for it to be able to be used in the authentication, it is bound to a provider of the localDb type.

Command Summary

TR7 WEB-CLI · ags local-database

admin@TR7LBWAF01> ags local-database list # list all of them

admin@TR7LBWAF01> ags local-database show <id> # show one

admin@TR7LBWAF01> ags local-database add name <name> … # new database

admin@TR7LBWAF01> ags local-database update id <id> … # change

admin@TR7LBWAF01> ags local-database delete <id> # delete

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	Value
1	name	Required	The unique name of the database

There is no other required field in this command: the whole of the password policy comes with its default values and is written only if it will be changed.

The Password Policy

Field	Default	Value
--passwordMinLength	8	The smallest number of characters of the password; between 4 and 128
--passwordComplexity	basic	none checks only the length · basic asks for at least one letter and one digit · strong asks for an upper case letter, a lower case letter, a digit and a special character
--passwordPreventReuse	false	While it is on, the new password cannot be the same as one of the last five passwords of the user (including the current password)
--allowSelfPasswordReset	true	It allows the user to reset their password with an e-mail link from the access pages
--allowSelfPasswordChange	true	It allows the user to determine a new password by entering their current password

When the policy is applied

The password rules are checked while a password is being assigned to the accounts and while the user is changing their own password; the policy is kept separately for every database.

Examples

TR7 WEB-CLI · A) A database with the default policy

admin@TR7LBWAF01> ags local-database add name customer-accounts

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A strict password policy

admin@TR7LBWAF01> ags local-database add name staff-accounts \

--passwordMinLength 12 --passwordComplexity strong --passwordPreventReuse true

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) Turning off the self-service password operations

admin@TR7LBWAF01> ags local-database update id <kimlik> \

--allowSelfPasswordReset false --allowSelfPasswordChange false

admin@TR7LBWAF01>  

Updating and Deleting

TR7 WEB-CLI · update and delete

admin@TR7LBWAF01> ags local-database update id <kimlik> --passwordMinLength 10

admin@TR7LBWAF01> ags local-database delete <kimlik>

admin@TR7LBWAF01>  

Things to Know

• The database alone does not authenticate. In order for it to be able to be used, a provider of the localDb type must be created and bound to this database.
• The accounts are opened with a separate command. The user adding, editing and password assigning operations are made with ags local-user.
• The name is unique. A second database cannot be created with the same name.
• The bindings must be checked before deleting. Even if there is a provider or an account bound to this database, the deletion is not blocked; the breaking of the binding is seen on the other side.