As a complement to adding a user, the following detail shows how to remove a user using the
ux-tenant-
remove-user
command:
if ! ux-tenant-remove-user -u "${u}" ; then
echo "WARNING: removing user '${u}' failed, skipping this user"
continue
fi
It is also possible to simply remove a user from a tenant without removing the user altogether if tenant
membership changes. This is shown below:
if ! ux-tenant-remove-user -u "${u}" "${tenant}" ; then
echo "WARNING: removing user '${u}' failed, skipping this user"
continue
fi
Here
${tenant}
is the name of the tenant from which to remove the user. This form of the command only
removes tenant membership, it does not remove the user, even if the user is no longer a member of any tenant.
The preceding form of the command is required to remove a user entirely from the Urika-GX authorized user list.
While not shown in the sample script, it may be required to obtain the list of users in the authorized user list. This
would be useful, for example, in removing users who are removed from the site's authentication data. This can be
achieved by using the
ux-tenant-list-users
command in the raw (
-R
) mode. The following shell function
can help do this:
get_user_list() {
ux-tenant-list-users -F name -R | while read expr; do
eval "${expr}"
echo "${name}"
done
return 1
}
A slight modification can help retrieve all the users in a given tenant, as shown below:
get_user_list() {
tenant="${1}"
ux-tenant-list-users -F name -R "${tenant}"| while read expr; do
eval "${expr}"
echo "${name}"
done
return 1
}
In this case the
${tenant}
argument filters the list of users for users who are authorized for the specified tenant.
If multiple tenants are specified, the tenant list selects users who are present in at least one of the specified
tenants.
User Secrets
Urika-GX uses 'secret' files to authenticate users to both Kerberos (keytabs) and Mesos (principal/secret pairs).
Whenever the contents of the Urika-GX authorized users list change, these secrets need to be synchronized with
the authorized user list using the
usm-sync-users
command. Run this command on the SMW after updating
the Urika-GX authorized users list.
When Mesos secrets change, the Mesos cluster needs to be restarted. This is done using the following command
sequence:
smw#
urika-stop -s mesos_cluster
smw#
urika-start -s mesos_cluster
Security
S3016
215
