mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 10:25:32 +08:00
Paul Gottschling
91c89b6126
* Organize docs guide sections chronologically This change aims to make docs navigation easier by organizing some docs sections according to the sequence of steps a user would take to set up Teleport. The current docs organization uses a variety of categories and schemes to organize the docs. For example, there is a "Home" section that includes the Changelog, Installation page, and Getting Started guides; a "Setup" section that includes references and admin guides; and edition-specific sections (Enterprise, Cloud). For a user who is setting up Teleport--or who has already done some setup work and wants more advanced instructions--it's difficult to know where in the docs to find the right information. This change organizes our how-to guides into the following categories that describe the process of setting up Teleport: - Try out Teleport - Deploy a Cluster (including choosing an edition) - Configure Access (including SSO, RBAC, and Access Requests) - Manage your Cluster (admin guides, operations, etc.) - Use Teleport (this section already exists) I moved the Reference section after this chronology, since users can access the reference guides anywhere in the setup process. As part of the change, I have also moved the content from the "Enterprise" and "Cloud" sections into "Deploy a Cluster", since this content has to do with how to deploy a specific edition of Teleport. Note that this change does _not_ attempt to reorganize our protocol-specific sections. While adding resources is part of the Teleport setup process, we have a lot of content in our protocol-specific sections, and moving it all into a single section related to adding resources to a cluster would (a) exceed the maximum depth for subsections in the nav bar and (b) cause more confusion than it alleviates. * Respond to PR feedback - Create a "Compliance Frameworks" section of "Configure Access" with the FedRAMP and SOC 2 guides - Rename "Use Teleport" to "Connect your Client" - Move the database GUI client guide into "Connect your Client" * Add redirects * Fix linter issues
134 lines
3.8 KiB
Plaintext
134 lines
3.8 KiB
Plaintext
---
|
|
title: Local Users
|
|
description: Adding and deleting local users
|
|
---
|
|
|
|
In Teleport, **local users** are users managed directly via Teleport, rather
|
|
than a third-party identity provider.
|
|
|
|
Local user accounts can be used alongside external user accounts managed via
|
|
GitHub<ScopedBlock scope={["enterprise", "cloud"]}> as well as OIDC and SAML
|
|
2.0</ScopedBlock>.
|
|
|
|
This guide shows you how to:
|
|
|
|
- [Add local users](./users.mdx#adding-local-users)
|
|
- [Edit existing users](./users.mdx#editing-users)
|
|
- [Delete users](./users.mdx#deleting-users)
|
|
|
|
## Prerequisites
|
|
|
|
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
|
|
|
|
(!docs/pages/includes/tctl.mdx!)
|
|
|
|
## Adding local users
|
|
|
|
A user identity in Teleport exists in the scope of a cluster.
|
|
A Teleport administrator creates Teleport user accounts and maps them to the roles they can use.
|
|
|
|
Let's look at this table:
|
|
|
|
| Teleport User | Allowed OS Logins | Description |
|
|
| - | - | - |
|
|
| `joe` | `joe`, `root` | Teleport user `joe` can log in to member Nodes as user `joe` or `root` on the OS. |
|
|
| `bob` | `bob` | Teleport user `bob` can log in to member Nodes only as OS user `bob`. |
|
|
| `kim` | | If no OS login is specified, it defaults to the same name as the Teleport user, `kim`. |
|
|
|
|
Let's add a new user to Teleport using the `tctl` tool:
|
|
|
|
```code
|
|
$ tctl users add joe --logins=joe,root --roles=access,editor
|
|
```
|
|
|
|
Teleport generates an auto-expiring token (with a TTL of one hour) and prints
|
|
the token URL, which must be used before the TTL expires.
|
|
|
|
```code
|
|
User "joe" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
|
|
https://<proxy_host>:443/web/invite/<token>
|
|
|
|
NOTE: Make sure <proxy_host>:443 points at a Teleport proxy which users can access.
|
|
```
|
|
|
|
The user completes registration by visiting this URL in their web browser,
|
|
picking a password, and configuring second-factor authentication. If the
|
|
credentials are correct, the Teleport Auth Server generates and signs a new
|
|
certificate, and the client stores this key and will use it for subsequent
|
|
logins.
|
|
|
|
The key will automatically expire after 12 hours by default, after which
|
|
the user will need to log back in with their credentials. This TTL can be
|
|
configured to a different value.
|
|
|
|
Once authenticated, the account will become visible via `tctl`:
|
|
|
|
```code
|
|
$ tctl users ls
|
|
|
|
# User Allowed Logins
|
|
# ---- --------------
|
|
# admin admin,root
|
|
# kim kim
|
|
# joe joe,root
|
|
```
|
|
|
|
## Editing users
|
|
|
|
Admins can edit user entries via `tctl`.
|
|
|
|
For example, to see the full list of user records, an administrator can execute:
|
|
|
|
```code
|
|
$ tctl get users
|
|
```
|
|
|
|
To edit the user `joe`:
|
|
|
|
```code
|
|
# Dump the user definition into a file:
|
|
$ tctl get user/joe > joe.yaml
|
|
# ... edit the contents of joe.yaml
|
|
|
|
# Update the user record:
|
|
$ tctl create -f joe.yaml
|
|
```
|
|
|
|
## Deleting users
|
|
|
|
Admins can delete a local user via `tctl`:
|
|
|
|
```code
|
|
$ tctl users rm joe
|
|
```
|
|
|
|
## Next steps
|
|
|
|
<Tabs>
|
|
<TabItem scope={["enterprise", "cloud"]} label="Commercial">
|
|
|
|
In addition to users, you can use `tctl` to manage roles and other dynamic
|
|
resources. See our [Teleport Resources Reference](../../reference/resources.mdx).
|
|
|
|
For all available `tctl` commands and flags, see our [CLI Reference](../../reference/cli.mdx#tctl).
|
|
|
|
You can also configure Teleport so that users can log in using an SSO provider.
|
|
For more information, see:
|
|
|
|
- [Single Sign-On](../../access-controls/sso.mdx)
|
|
|
|
</TabItem>
|
|
<TabItem scope={["oss"]} label="Open Source">
|
|
|
|
In addition to users, you can use `tctl` to manage roles and other dynamic
|
|
resources. See our [Teleport Resources Reference](../../reference/resources.mdx).
|
|
|
|
For all available `tctl` commands and flags, see our
|
|
[CLI Reference](../../reference/cli.mdx#tctl).
|
|
|
|
You can also configure Teleport so that users can log in using GitHub. For more
|
|
information, see [GitHub SSO](../../access-controls/sso/github-sso.mdx).
|
|
|
|
</TabItem>
|
|
</Tabs>
|