mindconnect-nodejs cli - assign roles

[ValeWuerz]

Hello mindsphere developers.
Does anybody know how to assign roles to groups or users with the cli?
I can't find any commands that would serve this purpose.
Thanks a lot

[sn0wcat]

That doesn't work yet, because the Roles API is for some reason not an official API of MindSphere.

https://developer.mindsphere.io/apis/core-identitymanagement/api-identitymanagement-api-swagger-3-3-0.html

the roles are available on a special endpoint which is not documented : https://{yourtenantname}-settings.eu1.mindsphere.io/api/im/v3/myTenant/roles?page=0&size=50

and the policy for the CLI was to not use undocumented endpoints. // @ChristophDoehl

[sn0wcat]

But you can use the groups and membergroups interface to accomplish the same thing:

1. creating the group

the 4 default roles of mindsphere are called

mdsp:core:Developer
mdsp:core:StandardUser
mdsp:core:TenantAdmin
mdsp:core:DeveloperAdmin

so you can do something like this:

 mc iam --mode create --group MyAdmins

which creates a new user group (note that the CLI will automatically prefix the group with mdsp_usergroup:

User Group in the MindSphere

After that you can assign the roles and subgroups via the --assign command

2) lets give the users in the group the Admin Role

 mc iam --mode assign  --membergroup mdsp_usergroup:MyAdmins --group mdsp:core:TenantAdmin --raw

which assigns the role TenantAdmin to the group MyAdmins

please notice the --raw switch which lets the user type in all the prefixes like mdsp_usergroup and mdsp:core:

*note: there is apparently a copy paste error in the order of the parameters so that the CLI gives a bit of misleading output , apparently, mindsphere swaps the order of parameter when assigning the roles when compared to child groups for some reason, we will fix that in the next version, just remember that for now the --membergroup is the group you are assigning roles to :)

The group has now admin role:

Lets give the group also vfc admin role.

mc iam --mode assign  --membergroup mdsp_usergroup:MyAdmins --group mdsp:core:vfc.admin --raw

3) Assign the group to the user:

 mc iam --mode assign --user sn0wcat_at_mindsphere.io --group mdsp_usergroup:MyAdmins --raw

User assignement in mindsphere:

HTH
@ValeWuerz @ChristophDoehl

[ValeWuerz]

Perfect, that helps a lot. Thank you @sn0wcat.

[sn0wcat]

Update, there is now a role support in the CLI too.