How to create a new user in OpenShift?

Question

I am trying to find out how to create a new user in OpenShift enterprise.

According to the documentation (on https://docs.openshift.com/enterprise/3.0/architecture/core_concepts/projects_and_users.html):

Regular users are created automatically in the system upon first login...

This sounds illogical. How does a user login if they dont have a username and password?

Can someone please clarify this - I'm sure there must be some command for creating a new user, but it is not clear.

Thanks

Answer 1

The OpenShift master-config (/etc/openshift/master/master-config.yaml) describes the configuration about authentication. By default the master-config shows something like this for the authentication-part:

 identityProviders:
  - challenge: true
    login: true
    name: anypassword
    provider:
      apiVersion: v1
      kind: AllowAllPasswordIdentityProvider

This means that every user with every password can authenticate. By performing oc get users as system:admin you'll see all the users. This configuration is not recommended. You're able to configure another form of authentication (htpasswd, ldap, github, ...).

I'm using htpasswd. So than you have to create a file (with htpasswd) which will contain your username + encrypted password. After that you'll need to edit your master-config.yaml. You have to tell it to use HTPasswdPasswordIdentityProvider and link to your file.

You can find those steps here. Don't forget to restart your OpenShift master after performing those steps: sudo service openshift-master restart (origin-master for origin).

After creating users you can assign roles to users Log in with the default admin (system:admin) and assign roles.

Answer 2

I am creating a script for simply adding a user if OpenShift using HTPasswdPasswordIdentityProvider

wget https://github.com/stedolan/jq/releases/download/jq-1.5/jq-linux64
mv jq-linux64 jq && chmod 755 jq

FILE=$(cat /etc/origin/master/master-config.yaml | python -c 'import sys, yaml, json; y=yaml.load(sys.stdin.read()); print json.dumps(y,indent=4, sort_keys=True)' | ./jq '.oauthConfig.identityProviders[0].provider.file')
FILE=$(sed -e 's/^"//' -e 's/"$//' <<<"$FILE")

htpasswd $FILE user1