User Management

This document will walk you through all the necessary commands/actions required for different operations in the new migrated style system.

The new system will have an org with an Org Owner (initially Admin role), HS team with Super Admin role in it (initially Super Admin role) and Root Pool (initially just one pool which was shared by all roles). Inside the org, we will have different teams. Teams are nothing but wrapper around roles. A team will by default have Admin and Team member roles. Also each team will have its own pool and own permissions.

Creating new org

This will create a new org with default Org Owner role, default support team and default root pool created for you. The standard HeadSpin team will be added to the Core role in Support Team.

You can inspect the org using hsops org inspect <org_id> to get the org owner role id, support team id, hosts in the root pool and teams in the org.

Adding Org Owners to the org

Org Owners are the users with maximum permissions in the org. They can create/delete teams, add/remove GEOs/members in Teams. So just be careful when you make someone Org Owner. Navigate to the Admins Tab

You can see the list of pending invite list as you go.

Or if you prefer to use command line, you can do

hsops signup-token create --org_id=<org_id> --role_id=<role_id> [--duration=<duration>] [--uses=<uses>] [--allowed_domains=<domains>] [--email_address=<email_address>]

where role id is the Org Owner Role ID which you can find after you inspect the org.

If the user already exists in the org, it will appear in the drop down list in the UI or you may also use hsops2 to do the same

hsops org-admin add <org_id> (--user_id=<user_id> | --email=<email>)
hsops org-admin delete <org_id> --user_id=<user_id>

Creating a team

Navigate to the Teams tab and as you can see, there are no teams in the org. So lets get started, Use New Team to create new team

Create the team by typing in the name and description for it.

Editing the team

Create Team will redirect you to teams-edit page for adding members and geos to the team.

Inviting members to the Team

Start by typing the email of the concerned person to invite them to the team

Choose the role for the person (Admin/Team member)

You will be able to see the pending invites under the pending invite list.

Adding members to the Team

If the users already exist in the org, you will be able to see them in the dropdown list and add them directly

You may also user hsops2 team-user add <team_id> (--user_id=<user_id> | --email=<email>) [--role_name=<role_name>] where you can get the respective <team_id> by inspecting the org.

Removing users from the Team

This will delete the lease of the user for the role, but it continues to stay in the org and can be added to other teams Command line for the same hsops2 team-user delete <team_id> --user_id=<user_id>

Furthermore, you can use Promote to change the role of the user from Team member to Admin OR Demote to change the role from Admin to Team member

Admin role has the permission to add/remove users from the teams and also to write notes on the hosts. So make sure when you promote or demote someone.

Adding Hosts to the Team

Every team can have its own pool and the roles in the team will have access to only the hosts present in that team. A team can only add hosts from the hosts present in the root pool of that org. Navigate to the hosts sub tab under the teams-edit page. Add Hosts will show you the list of hosts the org has access to. You can choose hosts from that list to be added to your team.

Removing Hosts from a Team

The roles in the team will no longer have access to that host.

To see the hosts/members of the team in the command prompt, use hsops team inspect <team_id>

Creating users for the org

hsops user create --email=<email> --name=<name> --org_id=<org_id>

The users created will be seen under the Users tab.

If a user has signed up, you should be able to see them under this list.

Modifying permissions

Say you need to add UNIFIED_DEVICE_LIST_FEATURE to the Super Admin role in HS team. Use this flow:

hsops org inspect <org_id>
hsops team inspect <team_id>
hsops role modify <role_id> [--enable|--disable] [--name=<name>] [--add_permissions=<permission>] [--rm_permissions=<permission>]

Inspect the org to find team_id of the HS (HeadSpin) team.

Inspect the team to find Super Admin role id.

Modify the permissions of that role