This command queries providers and the user database for a user entry. A provider query can be aggregated across providers to yield a merged result, or it can be provider-specific. See Querying Users for more information.
You can also use this command to:
Attach S3 identity policies to users or remove S3 identity policies from users, and
Grant or remove create bucket, delete bucket and super user permissions for users on external providers.
Note
Permission allowed or denied by identity policies to create or delete buckets overrides explicit create bucket and delete bucket permission settings.
Note
To grant or remove the explicit create bucket, delete bucket and super user permissions for local provider users, use the user modify command.
Usage for Retrieving a User Entry
user query {--uid UID | --username USERNAME | --login-name LOGINNAME | --sid SID}
[--context local|udb|ad|ldap|nis|aggregated]
[--tenant-id ID]
Usage for Setting S3 Permissions
user query {--uid UID | --username USERNAME | --login-name LOGINNAME | --sid SID}
[--allow-create-bucket|--disallow-create-bucket]
[--allow-delete-bucket|--disallow-delete-bucket]
[--s3-superuser|--not-s3-superuser]
[--identity-policies-ids [IDs]]
[--tenant-id ID]
Required Parameters
| Identifies a user by POSIX (NFS) UID number. |
| identifies a user by user name. |
| Identifies a user by login name. |
| Identifies a user by Security Identifier (SID). |
Options
| Specify one of the following contexts:
|
| Allows the user to create buckets when connecting to the cluster via S3. |
| Prohibits the user to create buckets when connecting to the cluster via S3. |
| Allows the user to delete buckets when connecting to the cluster via S3. |
| Prohibits the user to delete buckets when connecting to the cluster via S3. |
| Grants the user S3 super user permission, which enables the user to override S3 ACLs. |
| Removes S3 super user permission from the user. |
| Assigns one or more S3 identity policies to the user. Specify Each time you run the command with this option, the list overrides the entire previous list of S3 identity policies that were attached to the user. To remove a policy from a user, specify a list that does not include the policy you wish to remove. To remove all policies from the user, do not specify a list of IDs. |
| Specify the ID of the tenant with which the user is associated. |
Example
vcli: admin> user query --uid 1000
+---------------------+------------------------------------------------------------------------+
| uid | 1000 (LDAP) |
| sid | |
| leading_group | {'gid': 10000, 'sid': -1, 'name': -1} (LDAP) |
| leading_group_name | -1 |
| leading_group_gid | 10000 |
| primary_group_name | -1 |
| primary_group_sid | -1 |
| name | test-user-1000 (LDAP) |
| login_name | test-user-1000 |
| historical_sids | [] |
| groups | [] ([]) |
| group_count | 0 |
| allow_create_bucket | True |
| allow_delete_bucket | True |
| s3_superuser | False |
| s3_policies | [] |
| s3_policies_ids | [] |
| s3_remote_policies | [] |
| access_keys | [] |
| origins | {'uid': 'LDAP', 'leading_group': 'LDAP', 'name': 'LDAP', 'groups': []} |
| user_qos_policies | [] |
| quotas | [] |
| s3_vid | None |
+---------------------+------------------------------------------------------------------------+In the command output:
The provider from which an attribute was retrieved is indicated in parentheses (
(LDAP)in the example).leading group is the POSIX attribute for the user's group(s). A leading group is identified with its group ID (GID).
primary group is an Active Directory group identified by its security identifier (SID).
-1is returned for fields where an empty string was retrieved from the provider.