Tentris Documentation

User Management

When auth is enabled, users must log in. Use the user subcommand to manage users. It works like the Linux commands useradd and usermod.

Note: The user commands cannot change anything while the server is running. They stop with Unable to lock datastore, it may be currently open and change nothing. Stop the server, run the command, then start the server again.

Listing all Users

tentris user list

Creating a User

Creating a user with query and update permissions

tentris user add -G query,update admin

Creating a user with query permissions only

tentris user add -G query employee

Note: By default, users are not assigned any groups, which means that they do not have any rights. Their groups need to be specified by providing the option -G with the appropriate groups.

Modifying existing Users

Changing the password of an existing user

tentris user modify employee -p

Adding a Group to an existing User

tentris user modify employee -a -G update

Deleting a User

tentris user delete employee

Tokens

A token acts as its user: it has the permissions of the user's groups. A change to the groups also applies to existing tokens.

Note: Currently, only the MCP endpoint accepts tokens.

Each token has a name, for example laptop. Names use lowercase letters, digits, _ and -, with a maximum of 31 characters (the same rules as user names). A name starts with a letter or _ and does not end with -. A user can have many tokens, but each name only one time.

Adding a Token

tentris user token add employee laptop

Tentris prints the token (tnt_ and 43 characters) only one time. Copy it to a safe location. Tentris stores only a hash of the token.

By default, a token does not expire. To set an expiry time, use --valid-for with a number and a unit: s, m (minutes), h, d, w, M (months) or y, for example 90d, 12h or 1y. Units can be combined, for example --valid-for "1w 2d" (with quotes because of the space).

tentris user token add employee ci --valid-for 90d

If the user does not exist or already has a token with that name, the command fails.

Listing Tokens

Without a user name, the list shows the tokens of all users.

tentris user token list

To show the tokens of one user only, add the user name.

tentris user token list employee

The list shows the user, the token name and the dates. It never shows the token.

Deleting a Token

tentris user token delete employee laptop

If the user does not exist or has no token with that name, the command fails.

To revoke a token, stop the server, delete the token, then start the server again.

When you delete a user, Tentris also deletes all tokens of that user.

Detailed Information

For more details for the operations on users, use the --help option.

tentris user modify --help

tentris user add --help

tentris user delete --help

tentris user token add --help