Smarter by Design.Simpler for Business
ags local-user
The ags local-user command manages the user accounts in a local database: the user name, the password, the profile and institution information, the groups and the custom attributes. Its panel equivalent is the Users tab of the Local Databases screen.
The accounts are bound to a database; the database is created with ags local-database and the password rules come from there.
Command Summary
admin@TR7LBWAF01> ags local-user list # list all of them
admin@TR7LBWAF01> ags local-user show <id> # show one
admin@TR7LBWAF01> ags local-user add databaseId <database> username <name> …
admin@TR7LBWAF01> ags local-user update id <id> … # change
admin@TR7LBWAF01> ags local-user delete <id> # delete
admin@TR7LBWAF01>
Required Fields
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | databaseId | Required | The database in which the account will be opened (it is selected with Tab) |
| 2 | username | Required | The user name that will be used in the login form; it must be unique in the same database |
| 3 | newPassword | Conditionally required | Only when --assignNewPassword true is written; it is asked for secretly after the command |
An account can be opened without a password being assigned
If --assignNewPassword is not written, the account is created without a password. Such an account is not expected to pass the password verification; a password must be assigned while the account is being opened.
Assigning a Password
The password is not written on the command line. When --assignNewPassword true is given, it is asked for on a separate line after the command is run, without appearing on the screen. The password entered is checked according to the policy of the database; a password that does not fit the rule returns an error.
admin@TR7LBWAF01> ags local-user add databaseId <database> username ahmet --assignNewPassword true
New password: ••••••••
admin@TR7LBWAF01>
Optional Fields
| Field | Default | Value |
|---|---|---|
--enabled | true | Whether the account is active or not; the closed accounts are considered out of service in the access flow |
--email | — | The e-mail address of the account; it is used in the password resetting and the sending of a code by e-mail flows |
--displayName · --firstName · --lastName | — | The name information |
--phone | — | The telephone number |
--picture | — | The address of the account picture |
--company · --department · --title · --employeeId | — | The institution information |
--groups.0 | Empty | The groups of which the account is a member; every group is written as free text with its own index |
--customAttributes.0.name · --customAttributes.0.value | Empty | The name and value pairs kept in the account record; every pair with its own index |
--passwordHistory.0 | Empty | The previous password hashes of the account; it carries the list that prevents the new password from being the same as one of the old ones, every entry with its own index |
The fields are carried to the session
The default mapping of the local database provider carries these fields that are left filled in to the session attributes with the same name. In this way they can be used while an identity is being transferred to the back end or while a condition is being written.
Examples
admin@TR7LBWAF01> ags local-user add databaseId <database> username ahmet \
--assignNewPassword true --email ahmet@institution.local --displayName "Ahmet Yılmaz"
New password: ••••••••
admin@TR7LBWAF01>
admin@TR7LBWAF01> ags local-user add databaseId <database> username ayse \
--assignNewPassword true --department "Information Technology" --title "System Specialist" --employeeId 10428 \
--groups.0 managers --groups.1 it
New password: ••••••••
admin@TR7LBWAF01>
admin@TR7LBWAF01> ags local-user update id <kimlik> \
--customAttributes.0.name branch --customAttributes.0.value ankara
admin@TR7LBWAF01>
Updating and Deleting
The updating asks for the identifier with the id field. In order to change the password, --assignNewPassword true is written again and the new password is asked for secretly.
admin@TR7LBWAF01> ags local-user update id <id> --enabled false # take the account out of service
admin@TR7LBWAF01> ags local-user update id <id> --assignNewPassword true # renew the password
admin@TR7LBWAF01> ags local-user update id <id> --groups.delete # empty the groups
admin@TR7LBWAF01> ags local-user delete <kimlik>
admin@TR7LBWAF01>
Things to Know
- The user name is unique within the database. The same name can be used in different databases; if it clashes in the same database, the record is not created.
- The password does not appear on the screen. It is not written on the command line, it is asked for secretly after the running and is checked according to the policy of the database.
- An account can be taken out of service. Writing
--enabled falseinstead of deleting leaves the account outside the access while its record is preserved. - The values with spaces require quotation marks. The fields such as the display name, the department and the title are written with double quotation marks.
