> For the complete documentation index, see [llms.txt](https://docs.weka.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.weka.io/operation-guide/user-management/user-management-1.md). # Manage users using the CLI Manage local users, authentication tokens, and LDAP or Active Directory directories using the CLI. ## Create a local user Creates a local cluster user with a role that determines what the user can do. **Command:** `weka user add` ```sh weka user add [] [--posix-gid ] [--posix-uid ] ``` **Parameters** | Parameter | Description | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `username`\* | Username for new user. The user must present this to login. | | `role`\* | Role for new user. Possible values: `clusteradmin`, `csi`, `tenantadmin`, `readonly`, `regular`, `s3` | | `password` | Password for new user. Must contain at least 8 characters, and have at least one uppercase letter, one lowercase letter, and one number or special character. Typing special characters as arguments to this command might require escaping. | | `--posix-gid` \ | POSIX group ID for user. Used for S3 only. | | `--posix-uid` \ | POSIX user ID for user. Used for S3 only. | {% hint style="success" %} **Example:** `$ weka user add my_new_user regular S3cret` This command line creates a user with a username of `my_new_user`, a password of `S3cret` and a role of a Regular user. {% endhint %} ### Display list of users Run the `weka user` command to display the list of users defined in WEKA. ``` $ weka user Username | Source | Role ------------+----------+-------- my_new_user | Internal | Regular admin | Internal | Admin ``` ### Display current user information Run the `weka user whoami` command to receive information about the current user running the command. To use the new user credentials, use the`WEKA_USERNAME` and `WEKA_PASSWORD`environment variables: ``` $ WEKA_USERNAME=my_new_user WEKA_PASSWORD=S3cret weka user whoami Username | Source | Role ------------+----------+-------- my_new_user | Internal | Regular ``` ## Log-in to the WEKA cluster Authenticates to the cluster and saves a login token, so later commands run without prompting. **Command:** `weka user login` ```sh weka user login [] [] [--path ] [--tenant ] ``` **Parameters** | Parameter | Description | | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `username` | Username of user for authentication. Can be supplied in the envrionment as 'WEKA\_USERNAME'. Prompted for if not set. | | `password` | Password of the user to authenticate as. Can be supplied in the environment as 'WEKA\_PASSWORD'. Prompted for if not set. | | `-p`, `--path` \ | The path where the login token will be saved. This path can also be specified using the WEKA\_TOKEN environment variable. After logging in, use the WEKA\_TOKEN environment variable to specify where the login token is located. Deprecated: Use of profiles is a better solution, or use the weka user generate-token command to create a suitable API token. default: \~/.weka/auth-token.json). This path can also be specified using the WEKA\_TOKEN environment variable. After logging-in, use the WEKA\_TOKEN environment variable to specify where the login token is located | | `-g`, `--tenant` \ | Tenant where the user is located. | {% hint style="success" %} **Manage authentication tokens in WEKA** The `--path` parameter is used to control the directory and file where the authentication token is written. The specified path, which includes the filename, can then be assigned to the `WEKA_TOKEN` environment variable. **Example 1: Using the `--path` parameter** The following example demonstrates how to log in and specify the path for the authentication token. After logging in, the path is set to the `WEKA_TOKEN` environment variable. ```sh weka user login user1 password1 --path /home/user1/.weka/user1-token.json export WEKA_TOKEN=/home/user1/.weka/user1-token.json ``` **Example 2: Using the `WEKA_TOKEN` environment variable** Alternatively, you can set the `WEKA_TOKEN` environment variable first, which removes the need to use the `--path` parameter during the login process. ```sh export WEKA_TOKEN=/home/user1/.weka/user1-token.json weka user login user1 password1 ``` {% endhint %} **Related topic** [Obtain authentication tokens](/security/obtain-authentication-tokens.md) ## Change a local user password Changes a local user's password. **Command:** `weka user passwd` ```sh weka user passwd [] [--current-password ] [--username ] ``` **Parameters** | Parameter | Description | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `password` | New password. Must contain at least 8 characters, and have at least one uppercase letter, one lowercase letter, and one number or special character. Typing special characters as arguments to this command might require escaping. | | `--current-password` \ | Current password. Only required when changing the current user's own password. | | `--username` \ | User to change the password for. Defaults to the currently logged-in user. | {% hint style="info" %} * If necessary, provide or set`WEKA_USERNAME` or `WEKA_PASSWORD.` * To regain access to the system after changing the password, the user must re-authenticate using the new password. {% endhint %} ### Reset your own S3 credentials Reset the S3 API credentials for your user account by generating a new access key and secret key. **Before you begin** Confirm that you have existing S3 credentials. If you also need to reset your WEKA account password, note that the two operations are independent. Resetting your WEKA account password does not affect S3 credentials. **Procedure** 1. Run the following command: ```bash weka s3 user keys-generate ``` 2. At the prompt, review the message and type `yes` to confirm, or `no` to cancel. The system generates and displays a new access key and secret key for your S3 API access. **Result** Your new S3 credentials are displayed. Store the secret key securely, as it is not retrievable after the session ends. ## Revoke user access Revokes all of a user's login tokens, forcing the user to authenticate again. **Command:** `weka user revoke-tokens` ```sh weka user revoke-tokens ``` **Parameters** | Parameter | Description | | ------------ | -------------------------------------------------- | | `username`\* | Username of the user whose tokens will be revoked. | {% hint style="warning" %} NFS and SMB are different protocols from WekaFS, which require additional security considerations when used. For example, The system grants NFS permissions per server. Therefore, manage the permissions for accessing these servers for NFS export carefully. {% endhint %} ## Update a local user Changes a local user's role or password policy. **Command:** `weka user update` ```sh weka user update [--posix-gid ] [--posix-uid ] [--role ] ``` **Parameters** | Parameter | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------- | | `username`\* | Username of user to update. | | `--posix-gid` \ | POSIX group ID for user. Used for S3 only. | | `--posix-uid` \ | POSIX user ID for user. Used for S3 only. | | `--role` \ | New role to set for the user. Possible values: `regular`, `s3`,`readonly`, `tenantadmin` or `clusteradmin` | ## Delete a local user Deletes a local user from the cluster. **Command:** `weka user remove` ```sh weka user remove ``` **Parameters** | Parameter | Description | | ------------ | --------------------------- | | `username`\* | Username of user to delete. | {% hint style="success" %} **Example:** `$ weka user add my_new_user` Then run the`weka user` command to verify that the user was deleted: ``` $ weka user Username | Source | Role ---------+----------+------ admin | Internal | Admin ``` {% endhint %} ## Authenticate users from an LDAP user directory To authenticate users from an LDAP user directory, the LDAP directory must first be configured to the Weka system. This is performed as follows. ### Configure an LDAP user directory Configures the LDAP directory the cluster authenticates users against. Use `setup` for a generic LDAP server and `setup-ad` for Active Directory. **Command:** `weka user ldap setup` ```sh weka user ldap setup [] [--cluster-admin-group ] [--csi-group ] [--ignore-start-tls-failure] [--network-space-id ] [--protocol-version ] [--readonly-group ] [--regular-group ] [--server-timeout-secs ] [--start-tls] [--tenant-admin-group ] [--user-revocation-attribute ] [--user-uuid-attribute ] ``` **Command:** `weka user ldap setup-ad` ```sh weka user ldap setup-ad [] [--cluster-admin-group ] [--csi-group ] [--ignore-start-tls-failure] [--network-space-id ] [--readonly-group ] [--regular-group ] [--server-timeout-secs ] [--start-tls] [--tenant-admin-group ] [--user-revocation-attribute ] ``` **Parameters** | Parameter | Description | | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `server-uri`\* | LDAP server URI. Format is either \[ldap\://]hostname\[:port] or ldaps\://hostname\[:port]. | | `base-dn`\* | Base DN. | | `user-object-class`\* | User object class. | | `user-id-attribute`\* | User ID attribute. | | `group-object-class`\* | Group object class. | | `group-membership-attribute`\* | Group membership attribute. | | `group-id-attribute`\* | Group ID attribute. | | `reader-username`\* | Reader username. | | `reader-password` | Reader password. If omitted, you will be prompted. | | `--cluster-admin-group` \ | ClusterAdmin LDAP group. Users in this group are assigned the ClusterAdmin role. Only available for the root tenant. | | `--csi-group` \ | CSI LDAP group. Users in this group are assigned the CSI role. | | `--ignore-start-tls-failure` | Ignore StartTLS failure. If StartTLS fails, the connection will not use encryption. Possible values: `yes` or `no` | | `--network-space-id` \ | Network space ID in which to run LDAP queries. Defaults to the host network namespace. | | `--protocol-version` \ | LDAP protocol version. Possible values: `LDAP v2` or `LDAP v3` | | `--readonly-group` \ | ReadOnly LDAP group. Users in this group are assigned the ReadOnly role. | | `--regular-group` \ | Regular LDAP group. Users in this group are assigned the Regular role. | | `--server-timeout-secs` \ | LDAP server connection timeout, specified in seconds. | | `--start-tls` | Issue StartTLS after connecting. URL should not be used with ldaps\://. Possible values: `yes` or `no`Do not use with `ldaps://` | | `--tenant-admin-group` \ | TenantAdmin LDAP group. Users in this group are assigned the TenantAdmin role. | | `--user-revocation-attribute` \ | User revocation attribute. If provided, updating this attribute in the LDAP server automatically revokes all user tokens. | | `--user-uuid-attribute` \ | User UUID attribute. | | `domain`\* | Active Directory domain for principals. | {% hint style="info" %} The `sAMAccountName` (user logon name) for roles such as Cluster Admin, Tenant Admin, Regular User, and Read-only User is limited to 20 characters. {% endhint %} ### View a configured LDAP User Directory Shows the configured LDAP user directory and its current settings. **Command:** `weka user ldap` ```sh weka user ldap ``` ### Disable or enable a configured LDAP user directory Turns LDAP authentication off or back on without discarding the directory configuration. **Command:** `weka user ldap disable` ```sh weka user ldap disable [--force] ``` **Command:** `weka user ldap enable` ```sh weka user ldap enable ``` **Parameters** | Parameter | Description | | --------------- | --------------------------------------------------------------- | | `-f`, `--force` | Force action. Perform this action without further confirmation. | {% hint style="info" %} You can only disable an LDAP configuration, but not delete it. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.weka.io/operation-guide/user-management/user-management-1.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.