NAME

otpme-role - manage OTPme roles

SYNOPSIS

otpme-role command [options] [role]

DESCRIPTION

otpme-role manages roles in the OTPme system. Roles are groups of tokens or other roles that can be nested.

COMMANDS

Role Management

add [--groups group1,group2] [--roles role1,role2] role
Create a new role. Optionally add it directly to groups or other roles.

del role
Delete a role.

show [role]
Display role information. Without arguments, shows all roles.

list [regex]
List roles, optionally filtered by regex pattern.

enable role
Enable a disabled role.

disable role
Disable a role without deleting it.

rename role new_name
Rename a role.

move [--keep-acls] role unit
Move role to a different unit.

touch role
Re-index the object to fix potential index problems.

Token Assignment

add_token [-i interfaces] [--no-auto-sign] [--sign --tags tag1,tag2] role token_path
Add a token to the role. Use -i to limit login to specific interfaces (e.g. tty, gui, ssh).

remove_token [--keep-sign] role token_path
Remove a token from the role.

list_tokens role
List tokens assigned to the role.

Role Nesting

add_role role child_role
Add a child role to this role.

remove_role role child_role
Remove a child role from this role.

list_roles [-r] role
List roles assigned to the role. Use -r for recursive listing.

User and Group Listing

list_users role
List users of the role.

list_dynamic_groups role
List dynamic groups of the role.

Dynamic Groups

add_dynamic_group role group
Add a dynamic group to the role.

remove_dynamic_group role group
Remove a dynamic group from the role.

Sync Users

add_sync_user role user
Add a sync user to the role.

remove_sync_user role user
Remove a sync user from the role.

list_sync_users role
List sync users of the role.

Policy Management

add_policy role policy
Attach a policy to the role.

remove_policy role policy
Remove a policy from the role.

list_policies role
List policies attached to the role.

ACL Management

add_acl role owner_type owner acl
Add an access control entry.

del_acl role acl
Remove an access control entry.

show_acls role
Display all ACLs for the role.

enable_acl_inheritance role
Enable ACL inheritance from parent objects.

disable_acl_inheritance role
Disable ACL inheritance.

Extension and Attribute Management

add_extension role extension
Add an extension to the role.

remove_extension role extension
Remove an extension from the role.

add_attribute role attribute=value
Add an LDAP attribute to the role.

del_attribute role attribute=value
Remove an LDAP attribute from the role.

add_object_class role class
Add an LDAP object class to the role.

del_object_class role class
Remove an LDAP object class from the role.

show_ldif [-a attributes] role
Show LDIF representation of the role. Use -a to show only specific attributes.

Configuration and Attributes

config [-d] role parameter [value]
Set a configuration parameter. Use -d to delete (reset to default).

show_config role [parameter]
Show all configuration parameters.

description role [description]
Set role description.

info role [info]
Set free-form info text. If info is omitted, the current info text is opened in the editor specified by the EDITOR environment variable.

dump_info role
Dump the info text to stdout.

Import/Export

export [--password PASS] role
Export role configuration.

remove_orphans role
Remove orphaned object references.

OPTIONS

Display Options

-a
Show all roles (across all units).

-z SIZE
Limit output size.

--fields FIELD1,FIELD2
Display only specified fields.

--token-limit N
Limit number of tokens shown.

--role-limit N
Limit number of roles shown.

--accessgroup-limit N
Limit number of access groups shown.

--group-limit N
Limit number of groups shown.

--policy-limit N
Limit number of policies shown.

--sort-by FIELD
Sort output by field.

--reverse
Reverse sort order.

--raw
Output without headers/borders.

--csv
Output as CSV.

--csv-sep SEP
CSV separator character.

--attribute ATTR
Display specific attribute in list command.

Token Options

-i interfaces
Limit login to given interfaces (e.g. tty, gui, ssh).

--sign
Sign the object with default tags.

--tags tag1,tag2
Add tags to signature.

--no-auto-sign
Do not automatically sign when adding a token.

--keep-sign
Do not remove any signature when removing a token.

General Options

--keep-acls
Preserve ACLs when moving role.

--password PASS
Password for encrypting exports.

-r
List roles recursively.

Global options are available for all commands. See otpme(1) for details.

CONFIG PARAMETERS

Configuration parameters can be set with the config command and displayed with show_config. For a complete description of all available parameters and their applicable object types, see otpme(7).

EXAMPLES

Managing Roles

otpme-role add admins
Create a new role

otpme-role add --groups sysadmins --roles operators
Create a role and add it to groups and roles

Token Assignment

otpme-role add_token admins admin/totp
Add admin's TOTP token to the role

otpme-role add_token -i ssh admins admin/ssh_key
Add SSH key for SSH interface only

Role Nesting

otpme-role add_role super_admins admins
Add admins role as child of super_admins

otpme-role list_roles -r super_admins
List all nested roles recursively

Policy Assignment

otpme-role add_policy admins require_2fa
Attach a policy to the role

FILES

/var/lib/otpme/
OTPme data directory

SEE ALSO

otpme(1), otpme(7), otpme-user(1), otpme-token(1), otpme-group(1), otpme-accessgroup(1), otpme-policy(1)

AUTHOR

the2nd \<the2nd@otpme.org>

NOTE

This manual page was created with AI assistance.

COPYRIGHT

Copyright © 2014-2025 the2nd. License: GPLv3