[id='creating-users_{context}']
= Creating and modifying {brandname} users
Add {brandname} user credentials and assign permissions to control access to data.

{brandname} server installations use a property realm to authenticate users for the Hot Rod and REST endpoints.
This means you need to create at least one user before you can access {brandname}.

By default, users also need roles with permissions to access caches and interact with {brandname} resources.
You can assign roles to users individually or add users to groups that have role permissions.

You create users and assign roles with the [command]`user` command in the {brandname} command line interface (CLI).

[TIP]
====
Run [command]`help user` from a CLI session to get complete command details.
====

== Adding credentials

You need an `admin` user for the {brandname} Console and full control over your {brandname} environment.
For this reason you should create a user with `admin` permissions the first time you add credentials.

.Procedure

. Open a terminal in `{server_home}`.
. Create an `admin` user with the [command]`user create` command.
+
* Add a user assigned to the `admin` group.
+
[source,sh,options="nowrap",subs=attributes+]
----
include::cmd_examples/user_create_group.adoc[]
----
+
* Use implicit authorization to gain `admin` permissions.
+
[source,sh,options="nowrap",subs=attributes+]
----
include::cmd_examples/user_tool_nix.adoc[]
----
+
. Open `user.properties` and `groups.properties` with any text editor to verify users and groups.
+
[source,options="nowrap",subs=attributes+]
----
$ cat server/conf/users.properties

#$REALM_NAME=default$
#$ALGORITHM=encrypted$
myuser=scram-sha-1\:BYGcIAwvf6b...

$ cat server/conf/groups.properties

myuser=admin
----

== Assigning roles to users

Assign roles to users so they have the correct permissions to access data and modify {brandname} resources.

.Procedure

. Start a CLI session with an `admin` user.
+
[source,sh,options="nowrap",subs=attributes+]
----
$ bin/cli.sh
----
+
. Assign the `deployer` role to "katie".
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user roles grant --roles=deployer katie
----
+
. List roles for "katie".
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user roles ls katie
["deployer"]
----

== Adding users to groups

Groups let you change permissions for multiple users.
You assign a role to a group and then add users to that group.
Users inherit permissions from the group role.

.Procedure

. Start a CLI session with an `admin` user.
. Use the [command]`user create` command to create a group.
.. Specify "developers" as the group name with the `--groups` argument.
.. Set a username and password for the group.
+
In a property realm, a group is a special type of user that also requires a username and password.
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user create --groups=developers developers -p changeme
----
+
. List groups.
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user ls --groups
["developers"]
----
+
. Assign the `application` role to the "developers" group.
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user roles grant --roles=application developers
----
+
. List roles for the "developers" group.
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user roles ls developers
["application"]
----
+
. Add existing users, one at a time, to the group as required.
+
[source,sh,options="nowrap",subs=attributes+]
----
[//containers/default]> user groups john --groups=developers
----
