11# Users and Registration
22
3- There are two classes of Workflow users: normal users and administrators.
4-
5- * Users can use most of the features of Workflow - creating and deploying applications, adding/removing domains, etc.
6- * Administrators can perform all the actions that users can, but they also have owner access to all applications.
7-
8- The first user created on a Workflow installation is automatically an administrator.
9-
10- ## Register with a Controller
11-
12- Use ` drycc register ` with the [ Controller] [ ] URL (supplied by your Drycc administrator)
13- to create a new account. After successful registration you will be logged in as the new user.
14-
15- $ drycc register http://drycc.example.com
16- username: myuser
17- password:
18- password (confirm):
19- email: myuser@example.com
20- Registered myuser
21- Logged in as myuser
22-
23- !!! important
24- The first user to register with Drycc Workflow automatically becomes an administrator. Additional users who register will be ordinary users.
3+ Workflow use the passport component to create and authorize users
254
265## Login to Workflow
276
287If you already have an account, use ` drycc login ` to authenticate against the Drycc Workflow API.
298
309 $ drycc login http://drycc.example.com
31- username: drycc
32- password:
33- Logged in as drycc
3410
3511## Logout from Workflow
3612
@@ -49,107 +25,4 @@ You can verify your client configuration by running `drycc whoami`.
4925!!! note
5026 Session and client configuration is stored in the ` ~/.drycc/client.json ` file.
5127
52- ## Registering New Users
53-
54- By default, new users are not allowed to register after an initial user does. That initial user
55- becomes the first "admin" user. Others will now receive an error when trying to register, but when
56- logged in, an admin user can register new users:
57-
58- ``` shell
59- $ drycc register --login=false --username=newuser --password=changeme123 --email=newuser@drycc.cc
60- ```
61-
62- ## Controlling Registration Modes
63-
64- After creating your first user, you may wish to change the registration mode for Drycc Workflow.
65-
66- Drycc Workflow supports three registration modes:
67-
68- | Mode | Description |
69- | --- | --- |
70- | admin\_ only (default) | Only existing admins may register new users |
71- | enabled | Registration is enabled and anyone can register |
72- | disabled | Does not allow anyone to register new users. |
73-
74- To modify the registration mode for Workflow you may add or modify the ` REGISTRATION_MODE ` environment variable for the
75- controller component. If Drycc Workflow is already running, use:
76-
77- ` kubectl --namespace=drycc patch deployments drycc-controller -p '{"spec":{"template":{"spec":{"containers":[{"name":"drycc-controller","env":[{"name":"REGISTRATION_MODE","value":"disabled"}]}]}}}}' `
78-
79- Modify the ` value ` portion to match the desired mode.
80-
81- Kubernetes will automatically deploy a new ReplicaSet and corresponding Pod with the new environment variables set.
82-
83- ## Managing Administrative Permissions
84-
85- You can use the ` drycc perms ` command to promote a user to an admin:
86-
87- ```
88- $ drycc perms:create john --admin
89- Adding john to system administrators... done
90- ```
91-
92- View current admins:
93-
94- ```
95- $ drycc perms:list --admin
96- === Administrators
97- admin
98- john
99- ```
100-
101- Demote admins to normal users:
102-
103- ```
104- $ drycc perms:delete john --admin
105- Removing john from system administrators... done
106- ```
107-
108- ## Re-issuing User Authentication Tokens
109-
110- The controller API uses a simple token-based HTTP Authentication scheme. Token authentication is appropriate for
111- client-server setups, such as native desktop and mobile clients. Each user of the platform is issued a token the first
112- time that they sign up on the platform. If this token is compromised, it will need to be regenerated.
113-
114- A user can regenerate their own token like this:
115-
116- $ drycc auth:regenerate
117-
118- An administrator can also regenerate the token of another user like this:
119-
120- $ drycc auth:regenerate -u test-user
121-
122- At this point, the user will no longer be able to authenticate against the controller with his auth token:
123-
124- $ drycc apps
125- 401 UNAUTHORIZED
126- Detail:
127- Invalid token
128-
129- They will need to log back in to use their new auth token.
130-
131- If there is a cluster wide security breach, an administrator can regenerate everybody's auth token like this:
132-
133- $ drycc auth:regenerate --all=true
134-
135-
136- ## Changing Account Password
137-
138- A user can change their own account's password like this:
139-
140- ```
141- $ drycc auth:passwd
142- current password:
143- new password:
144- new password (confirm):
145- ```
146-
147- An administrator can change the password of another user's account like this:
148-
149- ```
150- $ drycc auth:passwd --username=<username>
151- new password:
152- new password (confirm):
153- ```
154-
15528[ controller ] : ../understanding-workflow/components.md#controller
0 commit comments