UIP 或用户

“uip 或用户”的语法和选项，用于管理 Orchestrator 租户用户及其文件夹和角色分配。

uip or users manages Orchestrator users at the tenant level. Orchestrator users are backed by Identity Service (IS) — this tool does not create standalone users from scratch. Instead, users import references an existing IS directory principal (a user, group, robot account, or external application) and provisions it into the tenant; users update then edits the tenant-side properties (license, session permissions, unattended credentials) that live on the Orchestrator side. There is no users delete — user removal is managed through Identity Service or the Orchestrator portal, not this CLI. For folder-level role management, see uip or roles.

大纲

uip or users list [options]
uip or users list-in-folder [--folder-path <path> | --folder-key <key>] [options]
uip or users list-available [--folder-path <path> | --folder-key <key>] [options]
uip or users get <user-key>
uip or users import (--username <name> | --directory-id <id>) --type <type> [--folder-path <path> | --folder-key <key>] [--role-keys <keys>]
uip or users assign --user-key <key> [--folder-path <path> | --folder-key <key>] [--role-keys <keys>]
uip or users unassign --user-key <key> [--folder-path <path> | --folder-key <key>]
uip or users update <user-key> [options]
uip or users current
uip or users assign-roles <user-key> --role-keys <keys>

动词

动词	用途
list	带有可选筛选器的租户用户列表。
list-in-folder	列出分配到文件夹的用户及其文件夹级别角色。
list-available	列出仍可分配至文件夹（尚未分配）的用户。
get	通过密钥获取一个用户。
import	Import an existing Identity Service directory principal into the tenant.
assign	将用户分配到文件夹，并可以选择使用文件夹级别角色。
unassign	从文件夹中删除用户。
update (alias edit)	Update a user's tenant-side properties (PATCH semantics).
current	返回当前经过身份验证的用户的详细信息。
assign-roles	替换用户的租户级别角色分配。

uip 或用户列表

列出租户中的用户。返回用户密钥 (GUID)、用户名、全名、电子邮件、类型和活动状态。

选项

短	长	值	默认	描述
—	--key	GUID	—	按用户密钥筛选（精确匹配）。
—	--username	text	—	按用户名筛选（包含匹配项）。
—	--email	text	—	按电子邮件地址筛选（包含匹配项）。
-l	--limit	数字	50	页面大小。
—	--offset	数字	0	跳过计数。
—	--sort-by	字段	—	OData 排序（例如， UserName asc ）。
—	--all-fields	标记	关闭	返回完整的 API 有效负载，而不是策划摘要。

示例

uip or users list --limit 10
uip or users list --username admin
uip or users list --output-filter 'Data[].{key:Key, name:UserName}'

数据形状（--输出 json）

{
  "Code": "UserList",
  "Data": [
    {
      "Key": "d4e5f6a7-0000-0000-0000-000000000001",
      "UserName": "[e-mail]",
      "FullName": "Admin User",
      "Email": "[e-mail]",
      "Type": "User",
      "IsActive": true
    }
  ],
  "Pagination": { "Returned": 1, "Limit": 50, "Offset": 0 }
}

uip 或文件夹中的用户列表

列出分配到文件夹的用户及其文件夹级别角色。需要--folder-path或--folder-key 。

选项

短	长	值	默认	描述
—	--folder-path	路径	—	目标文件夹。提供此项或--folder-key 。
—	--folder-key	GUID	—	目标文件夹。提供此项或--folder-path 。
—	--include-inherited	标记	关闭	同时显示从父文件夹继承的用户。
-l	--limit	数字	50	页面大小。
—	--offset	数字	0	跳过计数。
—	--sort-by	字段	Id desc	OData 排序。
—	--all-fields	标记	关闭	返回完整的 API 有效负载，而不是策划摘要。

示例

uip or users list-in-folder --folder-path "Shared"
uip or users list-in-folder --folder-path "Shared" --include-inherited
uip or users list-in-folder --folder-path "Shared" \
    --output-filter 'Data[].{name:UserName, roles:Roles}'

数据形状（--输出 json）

{
  "Code": "UserList",
  "Data": [
    {
      "Key": "d4e5f6a7-0000-0000-0000-000000000001",
      "UserName": "[e-mail]",
      "FullName": "Admin User",
      "Type": "User",
      "IsInherited": false,
      "Roles": "Folder Administrator"
    }
  ]
}

uip 或用户列表-可用

列出仍可分配给文件夹的租户用户。将返回的键与users assign或roles assign一起使用。

选项

短	长	值	默认	描述
—	--folder-path	路径	—	目标文件夹。提供此项或--folder-key 。
—	--folder-key	GUID	—	目标文件夹。提供此项或--folder-path 。
-s	--search	text	—	按用户名筛选（包含匹配项）。
-l	--limit	数字	50	页面大小。
—	--offset	数字	0	跳过计数。

示例

uip or users list-available --folder-path "Shared"
uip or users list-available --folder-path "Shared" --search admin
uip or users list-available --folder-path "Shared" \
    --output-filter 'Data[].Key'

数据形状（--输出 json）

{
  "Code": "UserAvailableList",
  "Data": [
    {
      "Key": "d4e5f6a7-0000-0000-0000-000000000003",
      "UserName": "[e-mail]",
      "Roles": ""
    }
  ]
}

uip 或用户获取

按 GUID 密钥获取用户。

参数

名称	必填	用途
<user-key>	是	用户密钥 (GUID)。

选项

短	长	值	默认	描述
—	--all-fields	标记	关闭	返回完整的 API 有效负载，而不是策划摘要。

示例

uip or users get d4e5f6a7-0000-0000-0000-000000000001
uip or users get d4e5f6a7-0000-0000-0000-000000000001 --all-fields
uip or users get d4e5f6a7-0000-0000-0000-000000000001 --output-filter 'Data.Email'

数据形状（--输出 json）

{
  "Code": "User",
  "Data": {
    "Key": "d4e5f6a7-0000-0000-0000-000000000001",
    "UserName": "[e-mail]",
    "FullName": "Admin User",
    "Email": "[e-mail]",
    "Type": "User",
    "IsActive": true
  }
}

uip or users import

Import a directory principal — an Identity Service user, group, robot account, or external application — into this tenant. This is the only way this CLI provisions a new tenant user; there is no standalone "create a user" verb, because Orchestrator users are always backed by an IS principal.

References an existing IS principal by --username or --directory-id, plus --type to declare which kind of principal it is (the CLI does not guess). Optionally assigns folder roles in the same call with --folder-path/--folder-key and --role-keys — both a folder and roles must be provided together, or neither. --directory-id imports are idempotent: importing an already-imported principal by directory ID returns the existing tenant record instead of failing.

Robot accounts and external applications must be imported with --directory-id (the IS UUID) — Orchestrator can't resolve them by <domain>\<name> the way it resolves a directory user. Find the ID with uip admin robot-accounts list --search <name> or uip admin external-apps list.

Arguments and required identifiers

名称	必填	用途
--username	one of --username/--directory-id	Identity Service username (typically an email).
--directory-id	one of --username/--directory-id	Identity Service directory identifier (OIDC subject / IS UUID). Required for DirectoryRobot and DirectoryExternalApplication types.

选项

短	长	值	默认	描述
—	--type	DirectoryUser | DirectoryGroup | DirectoryRobot | DirectoryExternalApplication	必填	Directory principal type.
—	--domain	text	—	Directory domain name as configured in Identity Service. Only needed for on-premises environments with configured AD domains.
—	--folder-path	路径	—	Folder to assign the imported principal to. Use with --role-keys.
—	--folder-key	GUID	—	Folder alternative to --folder-path. Use with --role-keys.
—	--role-keys	CSV 格式的 GUID	—	Folder role GUIDs to grant. Requires a folder option; a folder option without --role-keys is also rejected.

示例

uip or users import --username [e-mail]

uip or users import --username [e-mail] \
    --folder-path Shared --role-keys a1b2c3d4-0000-0000-0000-000000000001

# Robot account — directory ID required
uip or users import --directory-id 11111111-2222-3333-4444-555555555555 \
    --type DirectoryRobot

数据形状（--输出 json）

{
  "Code": "UserImported",
  "Data": {
    "UserName": "[e-mail]",
    "Type": "DirectoryUser",
    "AssignedFolderPath": "Shared",
    "AssignedRoleKeys": ["a1b2c3d4-0000-0000-0000-000000000001"]
  }
}

AlreadyImported: true is added when --directory-id matched a principal already present in the tenant.

UIP 或用户分配

将用户分配到文件夹，并可以选择使用文件夹级别角色。

备注：

CAUTION — destructive on roles. If --role-keys is passed, the server replaces all of the user's existing roles in the target folder with the ones supplied — roles not in the payload are removed silently. To preserve existing roles, read them first with roles user-roles list <principal-name> --type <type> and pass the full desired union to --role-keys. For additive tenant-level role membership on a role, use roles users set instead.

选项

短	长	值	默认	描述
—	--user-key	GUID	必填	用户密钥。
—	--role-keys	CSV 格式的 GUID	—	文件夹范围角色 GUID。
—	--folder-path	路径	—	目标文件夹。提供此项或--folder-key 。
—	--folder-key	GUID	—	目标文件夹。

示例

uip or users assign --user-key d4e5f6a7-0000-0000-0000-000000000001 \
    --folder-path "Shared"

uip or users assign --user-key d4e5f6a7-0000-0000-0000-000000000001 \
    --folder-path "Shared" \
    --role-keys a1b2c3d4-0000-0000-0000-000000000002

uip or users assign --user-key d4e5f6a7-0000-0000-0000-000000000001 \
    --folder-path "Shared" --output-filter 'Data.Status'

数据形状（--输出 json）

{
  "Code": "UserAssigned",
  "Data": {
    "UserKey": "d4e5f6a7-0000-0000-0000-000000000001",
    "FolderPath": "Shared",
    "Status": "Assigned successfully"
  }
}

uip 或用户取消分配

Remove a user from a folder. The user is not deleted — only their folder assignment is removed.

选项

短	长	值	默认	描述
—	--user-key	GUID	必填	用户密钥。
—	--folder-path	路径	—	要从中删除的文件夹。提供此项或--folder-key 。
—	--folder-key	GUID	—	要从中删除的文件夹。

示例

uip or users unassign --user-key d4e5f6a7-0000-0000-0000-000000000001 \
    --folder-path "Shared"

uip or users unassign --user-key d4e5f6a7-0000-0000-0000-000000000001 \
    --folder-key b1c2d3e4-0000-0000-0000-000000000001

uip or users unassign --user-key d4e5f6a7-0000-0000-0000-000000000001 \
    --folder-path "Shared" --output-filter 'Data.Status'

数据形状（--输出 json）

{
  "Code": "UserUnassigned",
  "Data": {
    "UserKey": "d4e5f6a7-0000-0000-0000-000000000001",
    "FolderPath": "Shared",
    "Status": "Unassigned successfully"
  }
}

uip or users update

Update a user's tenant-side properties by key (GUID). Reads current values, merges the supplied fields, and saves. Provide at least one option.

edit is a registered alias for this verb — uip or users edit works identically to uip or users update.

Reliably editable: license profile, session flags, and unattended robot credentials. Identity attributes (--name, --surname, --email, --type) are accepted by the API, but for directory principals (DirectoryUser/Group/Robot/ExternalApplication) those fields are normally synced from Identity Service — changing them here only edits the Orchestrator-side cached copy and may be overwritten on the next IS sync. For a durable identity change, edit the IS principal directly.

This command does not expose role assignments — use users assign (folder roles) or users assign-roles (tenant roles) for that; the current tenant role list is always re-sent unchanged so an update never touches it.

参数

名称	必填	用途
<user-key>	是	用户密钥 (GUID)。

选项

Identity (Orchestrator-side cache only for directory principals)

长	值	描述
--name	text	New first name.
--surname	text	New last name.
--email	text	New email address.
--type	text	New user type (for example User, DirectoryUser).

License and session permissions

长	值	描述
--license-type	text	For example Attended, Unattended, StudioPro.
--allow-unattended / --deny-unattended	标记	允许或拒绝执行 Unattended 作业。
--allow-attended / --deny-attended	标记	允许或拒绝 Attended 会话。
--allow-login / --deny-login	标记	允许或拒绝 Orchestrator 登录。
--allow-personal-workspace / --deny-personal-workspace	标记	允许或拒绝个人工作区。
--active / --inactive	标记	激活或停用用户。

Unattended 执行凭据

长	值	描述
--unattended-username	text	Windows account for unattended execution (for example DOMAIN\user).
--unattended-password	text	Password, or — for a read-only credential store — the external secret reference name.
--credential-store-key	GUID	Credential store for unattended execution credentials. Use credential-stores list to find it.
--credential-type	Default | SmartCard	Credential type.
--limit-concurrent / --no-limit-concurrent	标记	允许或禁止在多台计算机上并发执行。

If you set any unattended-credential flag on a user with no existing UnattendedRobot record, both --unattended-username and --unattended-password are required together — Orchestrator silently discards an incomplete record, so the CLI refuses to submit one rather than report a false success. Editing an existing record accepts any subset of these flags.

示例

uip or users update d4e5f6a7-0000-0000-0000-000000000001 --email [e-mail]

uip or users update d4e5f6a7-0000-0000-0000-000000000001 \
    --allow-unattended --license-type Unattended \
    --unattended-username DOMAIN\\bot --unattended-password s3cret

uip or users update d4e5f6a7-0000-0000-0000-000000000001 --inactive \
    --output-filter 'Data.Status'

数据形状（--输出 json）

{
  "Code": "UserUpdated",
  "Data": { "Key": "d4e5f6a7-0000-0000-0000-000000000001", "Status": "Updated successfully" }
}

uip 或用户当前值

返回当前经过身份验证的用户。用于验证会话和发现自己的用户密钥。

选项

短	长	值	默认	描述

示例

uip or users current
uip or users current --output-filter 'Data.Key'
uip or users current --output table

数据形状（--输出 json）

与User形状相同的users get 。

uip 或用户分配角色

Assign tenant-level roles to a user.

备注：

CAUTION — destructive. The server replaces the user's entire tenant-level role list with the keys passed via --role-keys — roles not in the payload are removed silently. To preserve existing tenant roles, read them first with roles user-roles list <principal-name> --type <type> and pass the full desired union to --role-keys. Unlike users assign (folder-level roles), this sets roles that apply across the entire tenant.

参数

名称	必填	用途
<user-key>	是	用户密钥 (GUID)。

选项

短	长	值	默认	描述
—	--role-keys	CSV 格式的 GUID	必填	要在租户作用域内分配的角色 GUID。

示例

uip or users assign-roles d4e5f6a7-0000-0000-0000-000000000001 \
    --role-keys a1b2c3d4-0000-0000-0000-000000000001

uip or users assign-roles d4e5f6a7-0000-0000-0000-000000000001 \
    --role-keys a1b2c3d4-0000-0000-0000-000000000001,a1b2c3d4-0000-0000-0000-000000000002

uip or users assign-roles d4e5f6a7-0000-0000-0000-000000000001 \
    --role-keys a1b2c3d4-0000-0000-0000-000000000001 \
    --output-filter 'Data.RolesAssigned'

数据形状（--输出 json）

{
  "Code": "UserRolesAssigned",
  "Data": {
    "UserKey": "d4e5f6a7-0000-0000-0000-000000000001",
    "RolesAssigned": 1,
    "Status": "Assigned successfully"
  }
}

退出代码

请参阅退出代码。没有动词特定的覆盖。

相关命令

• uip or roles — manage roles, role-user membership, and principal permission inspection (roles user-roles list, roles user-permissions list).
• uip or folders — 在unassign users assign文件夹密钥。
• uip or jobs — 尤其是jobs start --user-keys 。

另请参阅

• 身份验证。
• 全局选项。