userExecute (Command)

The userExecute command executes user–related administrative operations.

Parameters

The following field attributes are available for the operations of this command:

USERCMD_CREATE

USERCMD_CREATE creates a new user account.

This command supports maker–checker authorization.

The following attributes can be specified in the attributeSet input parameter of this command:

Any trailing and leading spaces are removed from USERFLD_USERID and USERFLD_USERNAME.

The following attributes will be specified in the results output parameter of this command:

USERCMD_VIEW

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_GET_ADMIN_DOMAINS

The following attributes can be specified in the attributeSet input parameter of this command:

The same user attributes will always be returned by the results output parameter of this command. The USERCMD_GET_ADMIN_DOMAINS command will fail under any of the following conditions:

• The user specified is not an administrator.
• The user specified is an administrator from the master domain.

This command will only return a list of domains to which the administrator has access. This list will not include the domain in which the administrator was created.

USERCMD_SET_ADMIN_DOMAINS

The following attributes can be specified in the attributeSet input parameter of this command:

This command also requires a list of domains to which the administrator should be a member (other than the domain where the administrator was created).

An administrator was created in domainb and is already a member of domaind. The following domain list will add that administrator to both domaina and domainc:

<adminDomainInfoListxmlns="">
  <adminDomains>
    <adminDomain>domaina</adminDomain>
  </adminDomains>
  <adminDomains>
    <adminDomain>domainc</adminDomain>
  </adminDomains>
</adminDomainInfoList>

In this example, the administrator would become an administrator for the domains domaina, domainb, and domainc, and will no longer be an administrator for domaind. The USERCMD_SET_ADMIN_DOMAINS command will fail under any of the following conditions:

• The user specified is not an administrator.
• The user specified is an administrator from the master domain.
• The administrator running the command does not have domain scope over any specified domain.
• The administrator and user specified are the same.

The same user attributes used in the input parameters will always be returned by the results output parameter of this command.

USERCMD_DELETE

The USERCMD_DELETE command allows you to delete user accounts. You can only delete user accounts within your own administrative scope.

If the target user account has authenticators assigned, they are unassigned and become available again. Authenticator instances are deleted.

Removable user data, i.e. custom user attributes, stored reports, and offline authentication data, will be deleted.

The target user account can have items assigned that cannot be deleted, which prevents the deletion of the user account, e.g. reports, recurring tasks, or pending operations (maker or checker role). To delete the user account, you can specify a successor user who will take ownership of those items. The successor must be an administrative user account in the same domain as the user to be deleted.

This command supports maker–checker authorization.

Parameters

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

Requirements

Required administrative privileges:

• Delete User

Additional considerations

• The target user, successor user, and checker administrator must all be different user accounts.
• If the target user has non-removable items assigned and you do not specify a successor user, the command will fail.
• To ensure proper access to the transferred items after the deletion, the successor user should have the same administrative privileges as the user account to be deleted. This is not verified by the command.

USERCMD_UPDATE

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_LINK_USER

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_UNLINK_USER

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_MOVE

The USERCMD_MOVE command can be used to move user accounts from one organizational unit to another (USERFLD_NEW_ORGANIZATIONAL_UNIT) or from one domain to another (USERFLD_NEW_DOMAIN). It can also be used to change the user id (USERFLD_NEW_USERID). You can even change the organizational unit, domain, and the user ID with one call if you specify all respective parameters at the same time.

You can only move user accounts within your own administrative scope. You cannot use this command to move the user account owning the current administrative session.

Parameters

The following attributes can be specified in the attributeSet input parameter of this command:

USERFLD_NEW_DOMAIN, USERFLD_NEW_ORGANIZATIONAL_UNIT, and USERFLD_NEW_USERID are all optional, but at least one of them must be specified.

Any trailing and leading spaces are removed from USERFLD_NEW_USERID.

The following attributes will be specified in the results output parameter of this command:

Example

Move a user account from the master domain to another domain and another organizational unit in one step:

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Header/>
  <SOAP-ENV:Body>
    <adm:userExecute xmlns:adm="http://www.vasco.com/IdentikeyServer/IdentikeyTypes/Administration" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <sessionID>u-i1U0_TrqlNg~l|_yhnIIdREy1UGla]</sessionID>
      <cmd>USERCMD_MOVE</cmd>
      <attributeSet>
        <attributes>
          <value xsi:type="xsd:string">jane.doe</value>
          <attributeID>USERFLD_USERID</attributeID>
        </attributes>
        <attributes>
          <value xsi:type="xsd:string">master</value>
          <attributeID>USERFLD_DOMAIN</attributeID>
        </attributes>
        <attributes>
          <value xsi:type="xsd:string">myDomainA</value>
          <attributeID>USERFLD_NEW_DOMAIN</attributeID>
        </attributes>
        <attributes>
          <value xsi:type="xsd:string">myOU</value>
          <attributeID>USERFLD_NEW_ORGANIZATIONAL_UNIT</attributeID>
        </attributes>
      </attributeSet>
    </adm:userExecute>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Rename a user account:

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Header/>
  <SOAP-ENV:Body>
    <adm:userExecute xmlns:adm="http://www.vasco.com/IdentikeyServer/IdentikeyTypes/Administration" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <sessionID>66h.0T_6|ot4hm27nIMUE-ma941oBQl7</sessionID>
      <cmd>USERCMD_MOVE</cmd>
      <attributeSet>
        <attributes>
          <value xsi:type="xsd:string">johnny.doe</value>
          <attributeID>USERFLD_USERID</attributeID>
        </attributes>
        <attributes>
          <value xsi:type="xsd:string">domainA</value>
          <attributeID>USERFLD_DOMAIN</attributeID>
        </attributes>
        <attributes>
          <value xsi:type="xsd:string">john.doe</value>
          <attributeID>USERFLD_NEW_USERID</attributeID>
        </attributes>
      </attributeSet>
    </adm:userExecute>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Requirements

Required administrative privileges:

• Move User

Additional considerations

• When moving a user account, the respective target organizational unit or target domain must already exist.

• When moving a user account with administrative privileges from one domain to another one, the assigned administrative privileges are retained. However, the administrative scope will be adapted accordingly from the source domain to the target domain. Other domains in the administrative scope will not be affected.

• When moving a user account with administrative privileges down in the organizational hierarchy, the assigned administrative privileges are retained, except for any privileges that no longer apply to the respective hierarchy level.

  • Moving a global administrator account from the master domain to another domain effectively demotes it to a delegated administrator account. The administrative scope is reduced to the target domain.

    The following administrative privileges are revoked:

    • Access Data in All Domains
    • Create Domain
    • Create EMV-CAP Application
    • Delete Domain

  • Moving a domain administrator account to an organizational unit effectively demotes it to an organizational unit administrator account. The administrative scope is reduced to the target organizational unit.

    The following administrative privileges are revoked:

    • Access Domain
    • Set Administration Domains
    • Update Domains

• When moving a user account with administrative privileges up in the organizational hierarchy, the assigned administrative privileges are retained, but no additional administrative privileges are assigned.

  • Moving an organizational unit administrator to a domain changes the administrative scope to the target domain. The user account is not automatically assigned domain administrative privileges!

  • Moving a delegated administrator from a domain to the master domain changes the administrative scope to the master domain. The user account is not automatically promoted to a global administrator!

• When moving a user account with assigned authenticators to another domain or organizational unit, the assigned authenticators are moved along with the user account.

• When moving or renaming a user account with an assigned authenticator with generated offline authentication data (OAD), the existing offline authentication data is invalidated and will be deleted on the server. Upon the next online authentication with the updated user account, new offline authentication data will be generated and retrieved from the server.

• Any user accounts linked to the user account being moved are not moved along, but remain in their original domain and/or organizational unit.

USERCMD_GET_PERMISSION

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_SET_PERMISSION

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_COPY_PERMISSION

Parameters

The following attributes can be specified in the attributeSet input parameter of this command:

This command returns no result attributes.

Additional considerations

• If the target user account has privileges assigned that the source user account does not have, then the target user account will lose those privileges.
• If you specify a user account that does not have any administrative privileges assigned, the command will return an error.

USERCMD_ENABLE

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_DISABLE

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_UNLOCK

As part of the unlock procedure, the User Lock Count will be set to 0.

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_RESET_PASSWORD

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_SET_PASSWORD

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

USERCMD_SET_EXPIRATION

The following attributes can be specified in the attributeSet input parameter of this command:

This command returns no result attributes.

To reset the expiration date and time, use the null attribute option (see  Attribute options).

USERCMD_RESET_LAST_AUTH_TIME

The following attributes can be specified in the attributeSet input parameter of this command:

This command returns no result attributes.

USERCMD_GET_DEPENDING_PERMISSION

The following attributes can be specified in the attributeSet input parameter of this command:

The following attributes will be specified in the results output parameter of this command:

Attribute options

You can use different attribute options for each attribute to change the state of the attribute when required.