users

The users command manages the users who can log in to the device: it determines the type of the user, where their identity will be verified from, which objects they will be authorized on and by which paths they can access.

Command Summary

TR7 WEB-CLI · users

# Tab after the command

admin@TR7LBWAF01> users

add delete list show update

 

admin@TR7LBWAF01> users list

admin@TR7LBWAF01> users add userType readOnly username <name> …

admin@TR7LBWAF01> users show <name>

admin@TR7LBWAF01> users update username <name> …

admin@TR7LBWAF01> users delete <name>

admin@TR7LBWAF01>  

The record takes its identity from the user name. In the update command username <name> is written; in the show and delete commands the user name is written directly as a value, without a field name (users delete <name>).

Required Fields

In the add command the CLI asks for the mandatory fields one by one, in the order below; it does not show the next one before one is written. The first two are written with the field name and the value together, and the password is not written on the command line.

Order	Field	Status	Value
1	userType	Required	One of the sixteen types below; it determines which authorization areas will be opened
2	username	Required	A name of 3–32 characters; the same name cannot be used on two users
3	password	Required	It is not written on the command line; after Enter is pressed, it is asked on a separate line without appearing on the screen. Even if the identity source is turned into a central server with --isLdapUser, it is asked in the add command

TR7 WEB-CLI · the password is asked secretly

admin@TR7LBWAF01> users add userType readOnly username viewer

Password: # the characters that are typed do not appear on the screen

admin@TR7LBWAF01>  

The User Types

Value	The authorization areas opened for that type
superAdmin	There is no field with a type restriction
readOnly	--userPools.N
monitor	--userPools.N
cloudClient	--v-device · --allowedFrontend.N.* · --backendNetworks.N.* · --maxPools · --cpuCores.N · --bwLimit
networkManager	There is no field with a type restriction
networkUser	--userZones.N
trafficManager	--certificatePermission
trafficUser	--userPools.N · --backendPermission
wafManager	There is no field with a type restriction
wafReadOnly	There is no field with a type restriction
wafUser	--userPools.N
fullLbManager	--certificatePermission
fullLbUser	--userPools.N · --backendPermission
certificateManager	There is no field with a type restriction
gtmUser	There is no field with a type restriction

Authentication and Password

Field	What it does	What is written after it
--isLdapUser	Selects where the identity of the user will be verified from	false — TR7, the device's own password database (the default) · true — LDAP · radius · tacacs
--giveNewPassword	Enables a new password to be assigned to an existing user	true · false (the default is false). It is listed only in the update command and while the identity source is TR7; when true is written, the new password is asked secretly after the command

The Authorization Areas

Field	What it does	What is written after it
--userPools.N	Determines which vService records the user will be authorized on	vService records; each one with its own index. The default list is empty. It is opened for the readOnly, monitor, trafficUser, wafUser and fullLbUser types
--userZones.N	Determines which vDevice records the user will be authorized on	vDevice records; by default the device on which the command runs is selected. It is opened only for the networkUser type
--backendPermission	Allows the user to manage the backend servers	true · false (the default is false). It is opened for the trafficUser and fullLbUser types
--certificatePermission	Allows the user to manage certificates	true · false (the default is false). It is opened for the trafficManager and fullLbManager types
--certificatePoolPermission	It is the field that allows the user to select a certificate	Because there is no user type in this version that meets the condition of the field, the field is not enabled for any type

The cloudClient Fields

The fields below are listed only while userType cloudClient is selected. They limit the resources that the user can use.

Field	What it does	What is written after it
--v-device	Selects which vDevice the user will work on	A vDevice; by default, the device on which the command runs
--allowedFrontend.N.ip	Determines which listener address the user can use	An address defined on the device; each entry with its own index
--allowedFrontend.N.port	Determines which port they can use on that address	A port number or a port range
--allowedFrontend.N.domains.N	Determines which domain names they can use on that listener address	A domain name; each domain name with its own index, the same domain name cannot be written twice
--backendNetworks.N.ip	Determines which network the user can use as a backend	A network address
--backendNetworks.N.cidr	Determines the mask length of that network	A CIDR value
--maxPools	Limits how many vServices the user can create at most	An integer of 1 or greater. When it is left empty, no limit is applied
--cpuCores.N	Determines which processor cores the user can use	An integer between 0 and 255; each core with its own index, the same core cannot be written twice. At least one core must be given
--bwLimit	Limits the bandwidth of the user	An integer of 0 or greater. When it is left empty, no limit is applied

Contact, Session and Access

Field	What it does	What is written after it
--emailAddress	Determines the e-mail address of the user	An e-mail address
--phoneNumber	Determines the phone number of the user	A phone number
--sessionDur.val	Determines the idle session duration specific to this user	A number. When it is left empty, the general session duration of the device applies
--sessionDur.unit	Selects the unit of that duration	m (the default) · h · d; the total duration cannot be shorter than 1 minute or longer than 30 days
--ssh	Allows the user to access WEB-CLI over SSH	true · false (the default is false)
--webCli	Allows the user to access WEB-CLI over the management interface	true · false (the default is false)

Examples

TR7 WEB-CLI · A) A local and a directory user

# a local user who only monitors and has WEB-CLI access

admin@TR7LBWAF01> users add userType readOnly username viewer \

--userPools.0 <vservice> --webCli true --emailAddress viewer@kurum.com.tr

Password:

 

# an administrator whose identity is verified from the directory

admin@TR7LBWAF01> users add userType trafficManager username jsmith --isLdapUser true \

--certificatePermission true --ssh true

Password:

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) cloudClient and maintenance

# a customer user whose resources are limited

admin@TR7LBWAF01> users add userType cloudClient username customer1 \

--maxPools 5 --bwLimit 100 --cpuCores.0 2 --cpuCores.1 3 \

--allowedFrontend.0.ip <address> --allowedFrontend.0.port 443 \

--allowedFrontend.0.domains.0 www.customer1.com \

--backendNetworks.0.ip 10.20.0.0 --backendNetworks.0.cidr 16

Password:

 

# password renewal and a session duration specific to the user

admin@TR7LBWAF01> users update username viewer --giveNewPassword true

Password:

admin@TR7LBWAF01> users update username viewer --sessionDur.val 30 --sessionDur.unit m

 

admin@TR7LBWAF01> users delete viewer

admin@TR7LBWAF01>  

Things to Know

• The distinguishing field is written first. The userType value determines which authorization areas will be listed; it must be given before any other field is written.
• The required fields do not take --. userType and username are written with the field name and the value side by side; the optional fields are in the --field value form. The detail is on the API Commands page.
• The password is not written on the command line. After the command is run, it is asked on the Password: line without appearing on the screen; it does not fall into the command history.
• The password is asked independently of the identity source. According to the condition in the schema, the password is requested in the add command in every case; the --isLdapUser field does not take part in this condition.
• The central identity is configured in separate commands. settings ldap, settings radius and settings tacacs. The automatic creation of the users coming from the central identity is in the settings user-management command.
• A new password is assigned only in an update. The --giveNewPassword field is not listed in the add command; the password of a new user is already asked during creation.
• A session duration specific to the user replaces the general setting. When --sessionDur is left empty, the general duration in the settings access command is applied.
• WEB-CLI access is two separate permissions. --ssh opens the access over SSH and --webCli over the management interface; the two are independent of each other.
• The cloudClient fields are a resource limit. The listener addresses, the backend networks, the number of vServices, the cores and the bandwidth are asked only for this type.