Creating Admin Users | Deployment, Administration, and User Guides

Deployment, Administration, and User Guides › SUSE Cloud Application Platform Administration › Creating Admin Users

ContentsContents

Deployment, Administration, and User Guides

Navigation←→

Applies to SUSE Cloud Application Platform 2.1.1

15 Creating Admin Users #

File Name: cap_admin_create_admin.xml
ID: no ID found

15.1 Prerequisites
15.2 Creating an Example Cloud Application Platform Cluster Administrator

This chapter provides an overview on how to create additional administrators for your Cloud Application Platform cluster.

15.1 Prerequisites #

File Name: cap_admin_create_admin.xml
ID: sec-cap-create-admin-prereqs

The following prerequisites are required in order to create additional Cloud Application Platform cluster administrators:

cf, the Cloud Foundry command line interface. For more information, see https://docs.cloudfoundry.org/cf-cli/.
For SUSE Linux Enterprise and openSUSE systems, install using zypper.
```
tux > sudo zypper install cf-cli
```
For SLE, ensure the SUSE Cloud Application Platform Tools Module has been added. Add the module using YaST or SUSEConnect.
```
tux > SUSEConnect --product sle-module-cap-tools/15.1/x86_64
```
For other systems, follow the instructions at https://docs.cloudfoundry.org/cf-cli/install-go-cli.html.
uaac, the Cloud Foundry uaa command line client (UAAC). See https://docs.cloudfoundry.org/uaa/uaa-user-management.html for more information and installation instructions.
On SUSE Linux Enterprise systems, ensure the ruby-devel and gcc-c++ packages have been installed before installing the cf-uaac gem.
```
tux > sudo zypper install ruby-devel gcc-c++
```

15.2 Creating an Example Cloud Application Platform Cluster Administrator #

File Name: cap_admin_create_admin.xml
ID: sec-cap-create-admin-procedure

The following example demonstrates the steps required to create a new administrator user for your Cloud Application Platform cluster. Note that creating administrator accounts must be done using the UAAC and cannot be done using the cf CLI.

Use UAAC to target your uaa server.

tux > uaac target --skip-ssl-validation https://uaa.example.com

Authenticate to the uaa server as admin using the uaa_admin_client_secret set in your kubecf-config-values.yaml file.
```
tux > uaac token client get admin --secret PASSWORD
```

Create a new user:

tux > uaac user add NEW_ADMIN --password PASSWORD --emails new-admin@example.com --zone kubecf

Add the new user to the following groups to grant administrator privileges to the cluster (see https://docs.cloudfoundry.org/concepts/architecture/uaa.html#uaa-scopes for information on privileges provided by each group):

tux > uaac member add scim.write NEW_ADMIN --zone kubecf

tux > uaac member add scim.read NEW_ADMIN --zone kubecf

tux > uaac member add cloud_controller.admin NEW_ADMIN --zone kubecf

tux > uaac member add clients.read NEW_ADMIN --zone kubecf

tux > uaac member add clients.write NEW_ADMIN --zone kubecf

tux > uaac member add doppler.firehose NEW_ADMIN --zone kubecf

tux > uaac member add routing.router_groups.read NEW_ADMIN --zone kubecf

tux > uaac member add routing.router_groups.write NEW_ADMIN --zone kubecf

Log into your Cloud Application Platform deployment as the newly created administrator:

tux > cf api --skip-ssl-validation https://api.example.com

tux > cf login -u NEW_ADMIN

The following commands can be used to verify the new administrator account has sufficient permissions:
```
tux > cf create-shared-domain TEST_DOMAIN.COM

tux > cf set-org-role NEW_ADMIN org OrgManager

tux > cf create-buildpack TEST_BUILDPACK /tmp/ruby_buildpack-cached-sle15-v1.7.30.1.zip 1
```
If the account has sufficient permissions, you should not receive any authorization message similar to the following:
```
FAILED
Server error, status code: 403, error code: 10003, message: You are not authorized to perform the requested action
```
See https://docs.cloudfoundry.org/cf-cli/cf-help.html for other administrator-specific commands that can be run to confirm sufficient permissions are provided.

Print this page