# user (Identity v3)

## user create

Create new user

    openstack user create
        [--domain <domain>]
        [--project <project>]
        [--project-domain <project-domain>]
        [--password <password>]
        [--password-prompt]
        [--email <email-address>]
        [--description <description>]
        [--ignore-lockout-failure-attempts]
        [--no-ignore-lockout-failure-attempts]
        [--ignore-password-expiry]
        [--no-ignore-password-expiry]
        [--ignore-change-password-upon-first-use]
        [--no-ignore-change-password-upon-first-use]
        [--enable-lock-password]
        [--disable-lock-password]
        [--enable-multi-factor-auth]
        [--disable-multi-factor-auth]
        [--multi-factor-auth-rule <rule>]
        [--enable
        |
        --disable
        ]
        [--or-show]
        <name>

--domain <domain>

  Default domain (name or ID)

--project <project>

  Default project (name or ID)

--project-domain <project-domain>

  Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--password <password>

  Set user password

--password-prompt

  Prompt interactively for password

--email <email-address>

  Set user email address

--description <description>

  User description

--ignore-lockout-failure-attempts

  Opt into ignoring the number of times a user has authenticated and locking out the user as a result

--no-ignore-lockout-failure-attempts

  Opt out of ignoring the number of times a user has authenticated and locking out the user as a result

--ignore-password-expiry

  Opt into allowing user to continue using passwords that may be expired

--no-ignore-password-expiry

  Opt out of allowing user to continue using passwords that may be expired

--ignore-change-password-upon-first-use

  Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt into ignoring the user to change their password during first time login in keystone

--no-ignore-change-password-upon-first-use

  Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt out of ignoring the user to change their password during first time login in keystone

--enable-lock-password

  Disables the ability for a user to change its password through self-service APIs

--disable-lock-password

  Enables the ability for a user to change its password through self-service APIs

--enable-multi-factor-auth

  Enables the MFA (Multi Factor Auth)

--disable-multi-factor-auth

  Disables the MFA (Multi Factor Auth)

--multi-factor-auth-rule <rule>

  Set multi-factor auth rules. For example, to set a rule requiring the “password” and “totp” auth methods to be provided, use: “–multi-factor-auth-rule password,totp”. May be provided multiple times to set different rule combinations.

--enable

  Enable user (default)

--disable

  Disable user

--or-show

  Return existing user

name

  New user name

## user delete

Delete user(s)

    openstack user delete [--domain <domain>] <user> [<user> ...]

--domain <domain>

  Domain owning <user> (name or ID)

user

  User(s) to delete (name or ID)

## user list

List users

    openstack user list
        [--format-config-file FORMAT_CONFIG]
        [--sort-column SORT_COLUMN]
        [--sort-ascending
        |
        --sort-descending
        ]
        [--domain <domain>]
        [--group <group> | --project <project>]
        [--long]
        [--enabled]
        [--disabled]

--format-config-file <FORMAT_CONFIG>

  Config file for the dict-to-csv formatter

--sort-column SORT_COLUMN

  specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending

  sort the column(s) in ascending order

--sort-descending

  sort the column(s) in descending order

--domain <domain>

  Filter users by <domain> (name or ID)

--group <group>

  Filter users by <group> membership (name or ID)

--project <project>

  Filter users by <project> (name or ID)

--long

  List additional fields in output

--enabled

  List only enabled users, does nothing with –project and –group

--disabled

  List only disabled users, does nothing with –project and –group

## user password set

Change current user password

    openstack user password set
        [--password <new-password>]
        [--original-password <original-password>]

--password <new-password>

  New user password

--original-password <original-password>

  Original user password

## user set

Set user properties

    openstack user set
        [--name <name>]
        [--domain <domain>]
        [--project <project>]
        [--project-domain <project-domain>]
        [--password <password>]
        [--password-prompt]
        [--email <email-address>]
        [--description <description>]
        [--ignore-lockout-failure-attempts]
        [--no-ignore-lockout-failure-attempts]
        [--ignore-password-expiry]
        [--no-ignore-password-expiry]
        [--ignore-change-password-upon-first-use]
        [--no-ignore-change-password-upon-first-use]
        [--enable-lock-password]
        [--disable-lock-password]
        [--enable-multi-factor-auth]
        [--disable-multi-factor-auth]
        [--multi-factor-auth-rule <rule>]
        [--enable
        |
        --disable
        ]
        <user>

--name <name>

  Set user name

--domain <domain>

  Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--project <project>

  Set default project (name or ID)

--project-domain <project-domain>

  Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--password <password>

  Set user password

--password-prompt

  Prompt interactively for password

--email <email-address>

  Set user email address

--description <description>

  Set user description

--ignore-lockout-failure-attempts

  Opt into ignoring the number of times a user has authenticated and locking out the user as a result

--no-ignore-lockout-failure-attempts

  Opt out of ignoring the number of times a user has authenticated and locking out the user as a result

--ignore-password-expiry

  Opt into allowing user to continue using passwords that may be expired

--no-ignore-password-expiry

  Opt out of allowing user to continue using passwords that may be expired

--ignore-change-password-upon-first-use

  Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt into ignoring the user to change their password during first time login in keystone

--no-ignore-change-password-upon-first-use

  Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt out of ignoring the user to change their password during first time login in keystone

--enable-lock-password

  Disables the ability for a user to change its password through self-service APIs

--disable-lock-password

  Enables the ability for a user to change its password through self-service APIs

--enable-multi-factor-auth

  Enables the MFA (Multi Factor Auth)

--disable-multi-factor-auth

  Disables the MFA (Multi Factor Auth)

--multi-factor-auth-rule <rule>

  Set multi-factor auth rules. For example, to set a rule requiring the “password” and “totp” auth methods to be provided, use: “–multi-factor-auth-rule password,totp”. May be provided multiple times to set different rule combinations.

--enable

  Enable user (default)

--disable

  Disable user

user

  User to modify (name or ID)

## user show

Display user details

    openstack user show [--domain <domain>] <user>

--domain <domain>

  Domain owning <user> (name or ID)

user

  User to display (name or ID)

this page last updated: 2026-04-01 09:44:20

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.