# Add/Configure Users and Groups
For most of the time having local users and groups is not a good idea as it does not scale well. Or you run into collisions concerning the user or group id.

If they reside in the Active Directory, they can be used by multiple devices and allow for kerberized data exchange, e.g. using CIFS or NFSv4.

## Order/Manage a Linux Group in AD

A new Linux group can be ordered using a [free text request in ServiceNow](https://psi.service-now.com/psisp?id=psi_report_new_incident&sys_id=797c79ebdbf20454d648f90532961982).
There are automated processes to [add](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=84f2c0c81b04f110679febd9bb4bcbb1) and [remove](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=f1a86bb71b094e90d6a82f4aab4bcb87) members from Linux groups.

## Order User in AD

Following user types can be ordered:

- [personal user account](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=c4849b181b27b050679febd9bb4bcb5f)
- [external user account](https://intranet.psi.ch/en/computing/external-vpnto-psiform)
- [user account with shared password aka global user account aka GAC account](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=ef349a8adb5c9c50db20890b06961973)
- [service user (free text request)](https://psi.service-now.com/psisp?id=psi_report_new_incident&sys_id=797c79ebdbf20454d648f90532961982)
- experiment accounts aka eaccounts are managed via [DUO](https://duo.psi.ch)

## Configure Local Users

The definition of a local user in Hiera is done below the `local_accounts::user_defs` key:

```
local_accounts::user_defs:
  'archadm':
    'uid': 503
    'gid': 503
    'home': '/home/archadm'
    'shell': '/bin/bash'
    'password': ENC[...
    'managehome': true
    'comment': 'Archiver Admin'
  'twlhaop':
    'uid': 884
    'gid': 884
    'home': '/home/twlhaop'
    'shell': '/bin/bash'
    'password': ENC[...
    'managehome': true
    'comment': 'TWLHA Operator'
```
The password is the password hash as in `/etc/shadow`. It can be generated with `openssl passwd -6`. Ideally the password hash is stored encrypted with [`eyaml`](../../puppet/eyaml) in Hiera.

To have the user actually configured on a given node, it needs to be added to the `local_accounts::users` Hiera key:

```
local_accounts::users:
  - 'archadm'
```

Note that this configures the user on the system, but login is only possible if there are [access permissions](../access/system_access) in place too.

## Configure Local Groups

The configuration of a local group in Hiera consists first of a group definition below the `local_accounts::group_defs` key:
```
local_accounts::group_defs:
  'archadm': 503
  'twlhaop': 884
```
As you see the group name is the key and the according group id the value.

To have the group actually configured on a given node, it needs to be added to the `local_accounts::groups` Hiera key:

```
local_accounts::groups:
  - 'twlhaop'
```

## Configure Local Group Members
Below example adds AD users to a local, already predefined group `dialout` (which is allows to access serial interfaces):

```
local_accounts::group_defs:
  dialout:
     members:
       - 'lx_test'
       - 'svcusr-lx_test'

local_accounts::groups:
  - 'dialout'
```