settings user-management

The settings user-management command determines whether the users who sign in with the central authentication will be opened by themselves on the device and how many sessions a user can hold at the same time.

Command Summary

TR7 WEB-CLI · settings user-management

# Tab after the command

admin@TR7LBWAF01> settings user-management

show update

 

admin@TR7LBWAF01> settings user-management show # show the settings

admin@TR7LBWAF01> settings user-management update … # change

admin@TR7LBWAF01>  

Fields

This resource is a single setting: no identifier is written, update is run directly and only the fields to be changed are given.

Field	What it does	What is written after it
--automaticUsers	Provides for the users who sign in with the central identity to be opened by themselves on the device	true · false (the default is false)
--automaticUsersSrc.N	Selects which identity sources the users to be opened will come from	ldap · radius · tacacs; each of them with its own index. It is opened only while --automaticUsers true
--automaticUsersDefaultUserType	Selects which role will be given to the user opened by itself	superAdmin (the default) · readOnly · cloudClient · monitor · networkManager · networkUser · trafficManager · trafficUser. It is opened only while --automaticUsers true
--maxSessionsPerUser	Limits how many sessions a user can hold at the same time	A number. When it is left empty, no limit is applied

Pay attention to the role of the user opened by itself

The default role is superAdmin. If it is not wanted for everyone coming from the central identity to be opened with full authorization, this field should be turned to a narrower role.

Examples

TR7 WEB-CLI · settings user-management

# the users coming from the directory should be opened as read-only

admin@TR7LBWAF01> settings user-management update --automaticUsers true \

--automaticUsersSrc.0 ldap --automaticUsersDefaultUserType readOnly --maxSessionsPerUser 3

admin@TR7LBWAF01>  

Things to Know

• The default role is authorized. The default of --automaticUsersDefaultUserType is superAdmin; in order to give a narrow role to the users opened by themselves, this field must definitely be changed.
• The opening does not work without a source being selected. When --automaticUsers true is written, which identity sources will be accepted is stated with --automaticUsersSrc.N.
• The identity sources are configured in separate commands. settings ldap, settings radius and settings tacacs.
• The session limit can be left empty. When --maxSessionsPerUser is not given, the number of sessions per user is not limited.