user

Identity v2, v3

user create

Create new user

openstack user create
    [--domain <domain>]
    [--project <project> [--project-domain <project-domain>]]
    [--password <password>]
    [--password-prompt]
    [--email <email-address>]
    [--description <description>]
    [--multi-factor-auth-rule <rule>]
    [--ignore-lockout-failure-attempts| --no-ignore-lockout-failure-attempts]
    [--ignore-password-expiry| --no-ignore-password-expiry]
    [--ignore-change-password-upon-first-use| --no-ignore-change-password-upon-first-use]
    [--enable-lock-password| --disable-lock-password]
    [--enable-multi-factor-auth| --disable-multi-factor-auth]
    [--enable | --disable]
    [--or-show]
    <user-name>
--domain <domain>

Default domain (name or ID)

New in version 3.

--project <project>

Default project (name or ID)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--password <password>

Set user password

--password-prompt

Prompt interactively for password

--email <email-address>

Set user email address

--description <description>

User description

New in version 3.

--ignore-lockout-failure-attempts

Opt into ignoring the number of times a user has authenticated and locking out the user as a result

--no-ignore-lockout-failure-attempts

Opt out of ignoring the number of times a user has authenticated and locking out the user as a result

--ignore-change-password-upon-first-use

Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt into ignoring the user to change their password during first time login in keystone.

--no-ignore-change-password-upon-first-use

Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt out of ignoring the user to change their password during first time login in keystone.

--ignore-password-expiry

Opt into allowing user to continue using passwords that may be expired

--no-ignore-password-expiry

Opt out of allowing user to continue using passwords that may be expired

--enable-lock-password

Disables the ability for a user to change its password through self-service APIs

--disable-lock-password

Enables the ability for a user to change its password through self-service APIs

--enable-multi-factor-auth

Enables the MFA (Multi Factor Auth)

--disable-multi-factor-auth

Disables the MFA (Multi Factor Auth)

--multi-factor-auth-rule <rule>

Set multi-factor auth rules. For example, to set a rule requiring the “password” and “totp” auth methods to be provided, use: “–multi-factor-auth-rule password,totp”. May be provided multiple times to set different rule combinations.

--enable

Enable user (default)

--disable

Disable user

--or-show

Return existing user

If the username already exist return the existing user data and do not fail.

<user-name>

New user name

user delete

Delete user(s)

openstack user delete
    [--domain <domain>]
    <user> [<user> ...]
--domain <domain>

Domain owning <user> (name or ID)

New in version 3.

<user>

User(s) to delete (name or ID)

user list

List users

openstack user list
    [--project <project>]
    [--domain <domain>]
    [--group <group> | --project <project>]
    [--long]
--project <project>

Filter users by <project> (name or ID)

--domain <domain>

Filter users by <domain> (name or ID)

Identity version 3 only

--group <group>

Filter users by <group> membership (name or ID)

Identity version 3 only

--long

List additional fields in output

user set

Set user properties

openstack user set
    [--name <name>]
    [--project <project> [--project-domain <project-domain>]]
    [--password <password>]
    [--password-prompt]
    [--email <email-address>]
    [--description <description>]
    [--multi-factor-auth-rule <rule>]
    [--ignore-lockout-failure-attempts| --no-ignore-lockout-failure-attempts]
    [--ignore-password-expiry| --no-ignore-password-expiry]
    [--ignore-change-password-upon-first-use| --no-ignore-change-password-upon-first-use]
    [--enable-lock-password| --disable-lock-password]
    [--enable-multi-factor-auth| --disable-multi-factor-auth]
    [--enable|--disable]
    <user>
--name <name>

Set user name

--domain <domain>

Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

New in version 3.

--project <project>

Set default project (name or ID)

--project-domain <project-domain>

Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--password <password>

Set user password

--password-prompt

Prompt interactively for password

--email <email-address>

Set user email address

--description <description>

Set user description

New in version 3.

--ignore-lockout-failure-attempts

Opt into ignoring the number of times a user has authenticated and locking out the user as a result

--no-ignore-lockout-failure-attempts

Opt out of ignoring the number of times a user has authenticated and locking out the user as a result

--ignore-change-password-upon-first-use

Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt into ignoring the user to change their password during first time login in keystone.

--no-ignore-change-password-upon-first-use

Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt out of ignoring the user to change their password during first time login in keystone.

--ignore-password-expiry

Opt into allowing user to continue using passwords that may be expired

--no-ignore-password-expiry

Opt out of allowing user to continue using passwords that may be expired

--enable-lock-password

Disables the ability for a user to change its password through self-service APIs

--disable-lock-password

Enables the ability for a user to change its password through self-service APIs

--enable-multi-factor-auth

Enables the MFA (Multi Factor Auth)

--disable-multi-factor-auth

Disables the MFA (Multi Factor Auth)

--multi-factor-auth-rule <rule>

Set multi-factor auth rules. For example, to set a rule requiring the “password” and “totp” auth methods to be provided, use: “–multi-factor-auth-rule password,totp”. May be provided multiple times to set different rule combinations.

--enable

Enable user (default)

--disable

Disable user

<user>

User to modify (name or ID)

user show

Display user details

openstack user show
    [--domain <domain>]
    <user>
--domain <domain>

Domain owning <user> (name or ID)

New in version 3.

<user>

User to display (name or ID)