Add user management API

[j99ca]

Description

The Geti SDK is missing user management. Creating users is another important feature to allow outside integration and avoid manually going through Geti's web client to create users

Suggested Solution

Create a rest client that allows the creation of users

[leoll2]

Hi Joel, thanks for the suggestion! I think I can implement a simple client for user management for the next release, will keep you posted about the progress. As for the functionalities, would these be enough to support your usecase?

• List users
• Invite a new user
• Remove a user
• Add user to project
• Remove user from project

If I have enough time, I can also implement the update methods (e.g. edit user name / roles).

[j99ca]

@leoll2 that would be absolutely amazing! Is it possible to reset a users password from an Admin account via rest? I noticed in the Geti webview a user can change their password once they are logged in, but I am curious about the eventuality of when a user forgets their password?

[AlexanderBarabanov]

1. Access to user management API with Geti personal access token (PAT, that is used by geti-sdk) is restricted by design on Geti side to enforce least privilege access as such operations are considered as risky and our current implementation does not allow to create fine-grained access tokens, also core functionality of geti-sdk is to provide access to core Geti functions.
   For reference - endpoint with PAT access, endpoint without PAT access - therefore to enable it in geti-sdk we will need to align with Geti and it will require changes on Geti side as well.

@j99ca Could you please elaborate your use case - do you want to automate user accounts creation in internal Geti LDAP based on user accounts in existing user directory?

2. Password reset with geti-sdk: I do not think it is possible/reasonable to automate this flow as our implementation was based on reset password link sent to user via email, user needs to navigate via this link and submit new password. Also, please note that this functionality was temporary disabled in 2.12 version and we plan to improve implementation a little bit.

[j99ca]

@AlexanderBarabanov Yes, we plan to automate account creation. We haven't fully mapped out how to handle every aspect of our integration, but all roads lead to having our backend generate Geti accounts for our users. We are hosting Geti ourselves and not using the Intel hosting service.

For password reset, I haven't seen that functionality exposed anywhere in Geti. The landing page before login does not contain any "forgot your password" type dialogue. For an admin user, I was wondering if there was anyway to trigger this. As I mentioned we aren't using Intel accounts. We also haven't configured the SMTP settings on our Geti instances yet, but I don't see where the trigger for sending an email for password reset would be?

[leoll2]

Access to user management API with Geti personal access token (PAT, that is used by geti-sdk) is restricted by design on Geti side

Thanks for pointing out Alexander, I wasn't aware of this limitation.
Fortunately, Geti SDK also supports credentials-based (user-pass) authentication in addition to token-based (PAT) one. I believe we can still implement the user management API with the former authentication method.

[AlexanderBarabanov]

For password reset, I haven't seen that functionality exposed anywhere in Geti. The landing page before login does not contain any "forgot your password" type dialogue. For an admin user, I was wondering if there was anyway to trigger this. As I mentioned we aren't using Intel accounts. We also haven't configured the SMTP settings on our Geti instances yet, but I don't see where the trigger for sending an email for password reset would be?

@j99ca The "Forgot Password" link was visible in the UI only in deployments with an SMTP server (this functionality was disabled starting from 2.11 version).
Also, previously we had a script (as part of the installation package) that allowed a user to generate a new password if they forgot their password on an instance without an SMTP server configured, we are discussing internally whether it is possible to add this script back.

[jcchr]

The script to change the password for admins will be created within the open-edge-platform/geti#1109 issue.