Skip to main content

Cornelis Technical Documentation

Name

user — Manages BMC users.

Syntax

user list

user add <USERNAME> <ROLE>

user del <USERNAME>

user changepw <USERNAME>

user ldap [show | modify] [ad | openldap]

Options

list

Lists the users in the BMC and their privilege level.

add <USERNAME> <ROLE>

Creates a new user, by specifying their username and role (admin or operator). A password is required.

Passwords must be 8-32 characters (no spaces) containing at least one number, one uppercase letter, one lowercase letter, and one special character: !@#$%^&amp;*

del <USERNAME>

Deletes the specified user. Requires a confirmation.

changepw <USERNAME>

Changes the password of the specified user.

ldap

Manages OpenLDAP/Active Directory user authentication.

Options:

show

Shows the current configuration for the specified option: ad or openldap.

Refer to parameters under "modify".

modify

Modifies the current configuration for the specified option: ad or openldap.

Parameters include:

  • LDAPServerURI: Specifies the location of LDAP server, with prefix (usually ldap:// or ldaps://)

  • LDAPBindDN: Specifies the credential to LDAP server

  • LDAPBindDNPassword: Specifies the password associated to the BindDN to access the server

  • LDAPBaseDN: Specifies the starting point for user searches

  • LDAPSearchScope: Specifies the portion of the target subtree that should be considered. either *.base, *.one, or *.sub, such as xyz.openbmc_project.User.Ldap.Config.SearchScope.sub (refer to https://ldap.com/the-ldap-search-operation/)

  • LDAPType: Specifies the type of ldap server, either OpenLdap or ActiveDirectory, such as xyz.openbmc_project.User.Ldap.Config.OpenLdap

  • GroupNameAttribute: Specifies the attribute that contains group name

  • UserNameAttribute: Specifies the attribute name that contains user name

ad

Configures Active Directory.

openldap

Configures OpenLDAP.

Examples

user list
user add alice admin
user del bob
user changepw charlie
user ldap show ad
user ldap modify openldap