Which CF admin privileges should user have so he can create "cloudfoundry_org_role" for new on-boarded user using terraform?

[ashjadhav1]

Hi,
As I came across with the issue that I'm not able to assign "cloudfoundry_org_role" to new on-boarded user. So have referred below bug. So in that bug you have mentioned user should have cf admin privileges.
Can you help with that what exactly user access should have to that user and what role ?

SAP/terraform-provider-cloudfoundry#189

[Dray56]

Hi @ashjadhav1,

What exactly do you mean by new on-boarded user? Have they logged in to the particular cloud foundry region atleast once. Can you please explain your setup of onboarding users in cloud foundry?

[ashjadhav1]

Hi @Dray56 ,

I'm trying to give access to org and space to user which has no access to subaccount and also not logged in to cloud foundry. So which CF admin privilege should I have to assign user roles in org and space using terraform cloud foundry.
Assign any org role to user which CF admin access should I need ?

[Dray56]

Hi @ashjadhav1,

Since the user has not logged into that cloud foundry deployment even once, the user does not exist in the cloud controller database and so roles cannot be assigned to it.

If you are using vanilla (Open Source) Cloudfoundry deployment, the CF Administrator can add/create a new user explicitly. The user needs to have the cloud_controller.admin scope in the UAA server to be a CF admin. Please get in touch with your deployment's CF administrator to add you for the same.

If you are using Cloudfoundry from SAP BTP, it is not possible to access the CF admin user. The highest privilege that a user gets is the organization_manager role. organization_manager cannot create new users or add non existent users to CF.
So first user needs to exist in the cloud foundry database for a role to be assigned. Which means user should login atleast once. After the user has logged in atleast once, the organization_manager can add the user to a specific org.

The user must first be assigned the organization_user role and thereafter any necessary space roles.