'\" te
.\" Portions Copyright (c) 2008, 2016, Oracle and/or its affiliates. All                rights reserved.
.\" Copyright 1989 AT&T
.TH useradd 1M "18 Feb 2016" "SunOS 5.11" "System Administration Commands"
.SH NAME
useradd \- administer a new user login on the system
.SH SYNOPSIS
.LP
.nf
\fBuseradd\fR [\fB-A\fR \fIauthorization\fR [,\fIauthorization...\fR]] 
     [\fB-b\fR \fIbase_dir\fR | \fB-d\fR \fIdir\fR] [\fB-c\fR \fIcomment\fR] [\fB-e\fR \fIexpire\fR] 
     [\fB-f\fR \fIinactive\fR] [\fB-g\fR \fIgroup\fR] [\fB-G\fR \fIgroup\fR [,\fIgroup\fR]...] 
     [\fB-K\fR \fIkey=value\fR] [\fB-m\fR [\fB-k\fR \fIskel_dir\fR]] [\fB-p\fR \fIprojname\fR] 
     [\fB-P\fR \fIprofile\fR [,\fIprofile...\fR]] [\fB-R\fR \fIrole\fR [,\fIrole...\fR]] 
     [\fB-s\fR \fIshell\fR] [\fB-S\fR \fIrepository\fR] [\fB-u\fR \fIuid\fR [\fB-o\fR]] \fIlogin\fR
.fi

.LP
.nf
\fBuseradd\fR \fB-D\fR [\fB-A\fR \fIauthorization\fR [,\fIauthorization...\fR]] 
     [\fB-b\fR \fIbase_dir\fR] [\fB-s\fR \fIshell\fR [\fB-k\fR \fIskel_dir\fR]] [\fB-e\fR \fIexpire\fR] 
     [\fB-f\fR \fIinactive\fR] [\fB-g\fR \fIgroup\fR] [\fB-K\fR \fIkey=value\fR] [\fB-p\fR \fIprojname\fR] 
     [\fB-P\fR \fIprofile\fR [,\fIprofile...\fR]] [\fB-R\fR \fIrole\fR [,\fIrole...\fR]]
.fi

.LP
.nf
useradd -S ldap [-c comment] [-d dir] [-K key=value]
            [-m] [-s shell] [-u uid] default@
.fi

.SH DESCRIPTION
.sp
.LP
\fBuseradd\fR adds a new user to the \fBpasswd\fR, \fBshadow\fR, and \fBuser_attr\fR databases in the \fBfiles\fR and \fBldap\fR repositories. The \fB-A\fR and \fB-P\fR options respectively assign authorizations and profiles to the user. The \fB-R\fR option assigns roles to a user. The \fB-p\fR option associates a project with a user. The \fB-K\fR option adds a \fIkey=value\fR pair to \fBuser_attr\fR entry for the user. Multiple \fIkey=value\fR pairs may be added with multiple \fB-K\fR options.
.sp
.LP
\fBuseradd\fR also creates supplementary group memberships for the user (\fB-G\fR option) and creates the home directory (\fB-m\fR option) for the user if requested. The new login remains locked until the \fBpasswd\fR(1) command is executed.
.sp
.LP
Specifying \fBuseradd\fR \fB-D\fR with the \fB-s\fR, \fB-k\fR,\fB-g\fR, \fB-b\fR, \fB-f\fR, \fB-e\fR, \fB-A\fR, \fB-P\fR, \fB-p\fR, \fB-R\fR, or \fB-K\fR option (or any combination of these options) sets the default values for the respective fields. See the \fB-D\fR option, below. Subsequent \fBuseradd\fR commands without the \fB-D\fR option use these arguments.
.sp
.LP
Alternatively, default settings may be specified that are applied dynamically at run time. For accounts that are created using \fB-S\fR \fBldap\fR, the default values for any of the \fB-K\fR attributes may be specified by using \fB-S\fR \fBldap\fRand the special value \fBdefault@\fR as the account name. The \fBdefault@\fR account is automatically locked since it is not intended to be used for logins. Additional default values may be specified in \fBpolicy.conf\fR(4).
.sp
.LP
The system file entries created with this command have a limit of 2048 characters per line. Specifying long arguments to several options can exceed this limit.
.sp
.LP
\fBuseradd\fR requires that usernames be in the format described in \fBpasswd\fR(4). A warning message is displayed if these restrictions are not met. See \fBpasswd\fR(4) for the requirements for usernames.
.sp
.LP
An administrator must be granted the User Management Profile to be able to create a new user. The authorizations required to set the various fields in \fBpasswd\fR, \fBshadow\fR and \fBuser_attr\fR can be found in \fBpasswd\fR(4), \fBshadow\fR(4), and \fBuser_attr\fR(4). The authorizations required to assign groups and projects can be found in \fBgroup\fR(4) and \fBproject\fR(4).
.SH OPTIONS
.sp
.LP
The following options are supported:
.sp
.ne 2
.mk
.na
\fB\fB-A\fR \fIauthorization\fR\fR
.ad
.sp .6
.RS 4n
One or more comma-separated authorizations defined in \fBauth_attr\fR(4). Only a user or role who has \fBgrant\fR rights to the authorization can assign it to an account.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-b\fR \fIbase_dir\fR\fR
.ad
.sp .6
.RS 4n
The base directory for new login home directories (see the \fB-d\fR option below. When a new user account is being created, \fIbase_dir\fR must already exist unless the \fB-m\fR option or the \fB-d\fR option is also specified.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-c\fR \fIcomment\fR\fR
.ad
.sp .6
.RS 4n
Any text string. It is generally a short description of the login, and is currently used as the field for the user's full name. This information is stored in the user's \fBpasswd\fR entry.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-d\fR \fIdir\fR | \fIserver\fR:\fIdir\fR\fR
.ad
.sp .6
.RS 4n
Specifies the home directory path for the new user. If no server name is specified, the specified directory is maintained in the \fBpasswd\fR(4) database.
.sp
The optional server name specifies the host on which the home directory resides. Entries in this form depend on the automounter, and are maintained in the \fBauto_home\fR map. The path \fB/home/\fIusername\fR\fR is maintained in the \fBpasswd\fR(4) database. When the user subsequently references \fB/home/\fIusername\fR\fR, the automounter will mount the specified directory on \fB/home/\fIusername\fR\fR.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-D\fR\fR
.ad
.sp .6
.RS 4n
Display the default values for \fBgroup\fR, \fBbase_dir\fR, \fBskel_dir\fR, \fBshell\fR, \fBinactive\fR, \fBexpire\fR, \fBproj\fR, \fBprojname\fR and \fBkey=value\fR pairs. When used with the \fB-g\fR, \fB-b\fR, \fB-f\fR, \fB-e\fR, \fB- A\fR, \fB-P\fR, \fB-p\fR, \fB-R\fR, or \fB- K\fR options, the \fB-D\fR option sets the default values for the specified fields. The default values are:
.sp
.ne 2
.mk
.na
\fBgroup\fR
.ad
.sp .6
.RS 4n
\fBstaff\fR (\fBGID\fR of 10)
.RE

.sp
.ne 2
.mk
.na
\fBbase_dir\fR
.ad
.sp .6
.RS 4n
\fB/export/home\fR
.RE

.sp
.ne 2
.mk
.na
\fBskel_dir\fR
.ad
.sp .6
.RS 4n
\fB/etc/skel\fR
.RE

.sp
.ne 2
.mk
.na
\fBshell\fR
.ad
.sp .6
.RS 4n
\fB/usr/bin/bash\fR
.RE

.sp
.ne 2
.mk
.na
\fBinactive\fR
.ad
.sp .6
.RS 4n
\fB0\fR
.RE

.sp
.ne 2
.mk
.na
\fBexpire\fR
.ad
.sp .6
.RS 4n
null
.RE

.sp
.ne 2
.mk
.na
\fBauths\fR
.ad
.sp .6
.RS 4n
null
.RE

.sp
.ne 2
.mk
.na
\fBprofiles\fR
.ad
.sp .6
.RS 4n
null
.RE

.sp
.ne 2
.mk
.na
\fBauth_profiles\fR
.ad
.sp .6
.RS 4n
null
.RE

.sp
.ne 2
.mk
.na
\fBproj\fR
.ad
.sp .6
.RS 4n
\fB3\fR
.RE

.sp
.ne 2
.mk
.na
\fBprojname\fR
.ad
.sp .6
.RS 4n
\fBdefault\fR
.RE

.sp
.ne 2
.mk
.na
\fBkey=value (pairs defined in \fBuser_attr\fR(4)\fR
.ad
.sp .6
.RS 4n
not present
.RE

.sp
.ne 2
.mk
.na
\fBroles\fR
.ad
.sp .6
.RS 4n
null
.RE

.RE

.sp
.ne 2
.mk
.na
\fB\fB-e\fR \fIexpire\fR\fR
.ad
.sp .6
.RS 4n
Specify the expiration date for a login. After this date, no user will be able to access this login. The expire option argument is a date entered using one of the date formats included in the template file \fB/etc/datemsk\fR. See \fBgetdate\fR(3C). 
.sp
If the date format that you choose includes spaces, it must be quoted. For example, you can enter \fB10/6/90\fR or \fBOctober 6, 1990\fR. A null value (\fB" "\fR) defeats the status of the expired date. This option is useful for creating temporary logins.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-f\fR \fIinactive\fR\fR
.ad
.sp .6
.RS 4n
The maximum number of days allowed between uses of a login ID before that \fBID\fR is declared invalid. Normal values are positive integers. A value of \fB0\fR defeats the status.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-g\fR \fIgroup\fR\fR
.ad
.sp .6
.RS 4n
An existing group's integer \fBID\fR or character-string name. Without the \fB-D\fR option, it defines the new user's primary group membership and defaults to the default group. You can reset this default value by invoking \fBuseradd\fR \fB-D\fR \fB-g\fR \fIgroup\fR. GIDs 0-99 are reserved for allocation by the Solaris Operating System.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-G\fR \fIgroup\fR\fR
.ad
.sp .6
.RS 4n
An existing group's integer \fBID\fR or character-string name. It defines the new user's supplementary group membership. Duplicates between \fIgroup\fR with the \fB-g\fR and \fB-G\fR options are ignored. No more than \fBNGROUPS_MAX\fR groups can be specified. GIDs 0-99 are reserved for allocation by the Solaris Operating System.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-K\fR \fIkey=value\fR\fR
.ad
.sp .6
.RS 4n
A \fIkey=value\fR pair to add to the user's attributes. Multiple \fB-K\fR options may be used to add multiple \fIkey=value\fR pairs. The generic \fB-K\fR option with the appropriate key may be used instead of the specific implied key options (\fB-A\fR, \fB-P\fR, \fB-R\fR, \fB-p\fR). See \fBuser_attr\fR(4) for a list of valid \fIkey=value\fR pairs. The "type" key is not a valid key for this option. Keys may not be repeated. 
.RE

.sp
.ne 2
.mk
.na
\fB\fB-k\fR \fIskel_dir\fR\fR
.ad
.sp .6
.RS 4n
A directory that contains skeleton information (such as \fB\&.profile\fR) that can be copied into a new user's home directory. This directory must already exist. The system provides the \fB/etc/skel\fR directory that can be used for this purpose.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-m\fR\fR
.ad
.sp .6
.RS 4n
Create the new user's home directory if it does not already exist. If the directory already exists, it must have read, write, and execute permissions by \fIgroup\fR, where \fIgroup\fR is the user's primary group. If the server name specified to the \fB-d\fR option is a remote host then the system will not attempt to create the home directory.
.sp
If the directory does not already  exist and the parent directory is the mount point of a ZFS dataset, then a child of that dataset will be created and mounted at the specified location. The user is delegated permissions to create ZFS snapshots and promote them. The newly created dataset will inherit the encryption setting from its parent. If it is encrypted, the user is granted permission to change its wrapping key.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-o\fR\fR
.ad
.sp .6
.RS 4n
This option allows a \fBUID\fR to be duplicated (non-unique).
.RE

.sp
.ne 2
.mk
.na
\fB\fB-P\fR \fIprofile\fR\fR
.ad
.sp .6
.RS 4n
One or more comma-separated execution profiles defined in \fBprof_attr\fR(4).
.RE

.sp
.ne 2
.mk
.na
\fB\fB-p\fR \fIprojname\fR\fR
.ad
.sp .6
.RS 4n
Name of the project with which the added user is associated. See the \fIprojname\fR field as defined in \fBproject\fR(4).
.RE

.sp
.ne 2
.mk
.na
\fB\fB-R\fR \fIrole\fR\fR
.ad
.sp .6
.RS 4n
One or more comma-separated execution profiles defined in \fBuser_attr\fR(4). Roles cannot be assigned to other roles.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-s\fR \fIshell\fR\fR
.ad
.sp .6
.RS 4n
Full pathname of the program used as the user's shell on login. If unspecified, it will default to any value previously configured with the \fB-D\fR \fB-s\fR  option. If no default has been set with  \fB-D\fR \fB-s\fR,  then \fB/usr/bin/bash\fR will be used. The value of \fIshell\fR must be a valid executable file.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-S\fR \fIrepository\fR\fR
.ad
.sp .6
.RS 4n
The valid repositories are \fBfiles\fR, \fBldap \fR. The repository specifies which name service will be updated. The default repository is \fBfiles\fR. When the repository is \fBfiles \fR, the authorizations, profiles, and roles can be present in other name service repositories and can be assigned to a user in the \fBfiles\fR repository. When the repository is \fBldap\fR, both the LDAP server and client must be configured with \fBEnableShadowUpdate=true\fR. Also, all the assignable attributes must be present in the \fBldap\fR repository.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-u\fR \fIuid\fR\fR
.ad
.sp .6
.RS 4n
The \fBUID\fR of the new user. This \fBUID\fR must be a non-negative decimal integer below \fBMAXUID\fR as defined in \fB<sys/param.h>\fR\&. The \fBUID\fR defaults to the next available (unique) number above the highest number currently assigned. For example, if \fBUID\fRs 100, 105, and 200 are assigned, the next default \fBUID\fR number will be 201. \fBUID\fRs \fB0\fR-\fB99\fR are reserved for allocation by the Solaris Operating System.
.RE

.SH EXIT STATUS
.sp
.LP
In case of an error, \fBuseradd\fR command prints an error message and exits with one of the following values. If the error occurred because LDAP is misconfigured, the following values are preceded by "LDAP configuration problem":
.sp
.ne 2
.mk
.na
\fB\fB1\fR\fR
.ad
.RS 6n
.rt  
No permission for attempted operation.
.RE

.sp
.ne 2
.mk
.na
\fB\fB2\fR\fR
.ad
.RS 6n
.rt  
The command syntax was invalid. A usage message for the \fBusermod\fR command is displayed.
.RE

.sp
.ne 2
.mk
.na
\fB\fB3\fR\fR
.ad
.RS 6n
.rt  
An invalid argument was provided to an option.
.RE

.sp
.ne 2
.mk
.na
\fB\fB4\fR\fR
.ad
.RS 6n
.rt  
The \fIgid\fR or \fIuid\fR given with the \fB-u\fR option is already in use.
.RE

.sp
.ne 2
.mk
.na
\fB\fB5\fR\fR
.ad
.RS 6n
.rt  
The \fBpassword\fR and \fBshadow\fR files are not consistent with each other. \fBpwconv\fR(1M) might be of use to correct possible errors. See \fBpasswd\fR(4) and \fBshadow\fR(4).
.RE

.sp
.ne 2
.mk
.na
\fB\fB6\fR\fR
.ad
.RS 6n
.rt  
The login to be modified does not exist, the \fIgid\fR or the \fIuid\fR does not exist.
.RE

.sp
.ne 2
.mk
.na
\fB\fB7\fR\fR
.ad
.RS 6n
.rt  
The \fBgroup\fR, \fBpasswd\fR, or \fBshadow\fR file is missing.
.RE

.sp
.ne 2
.mk
.na
\fB\fB9\fR\fR
.ad
.RS 6n
.rt  
A group or user name is already in use.
.RE

.sp
.ne 2
.mk
.na
\fB\fB10\fR\fR
.ad
.RS 6n
.rt  
Cannot update the \fBpasswd\fR, \fBshadow\fR, or \fBuser_attr\fR file.
.RE

.sp
.ne 2
.mk
.na
\fB\fB11\fR\fR
.ad
.RS 6n
.rt  
Insufficient space to move the home directory (\fB-m\fR option).
.RE

.sp
.ne 2
.mk
.na
\fB\fB12\fR\fR
.ad
.RS 6n
.rt  
Unable to create, remove, or move the new home directory.
.RE

.sp
.ne 2
.mk
.na
\fB\fB13\fR\fR
.ad
.RS 6n
.rt  
Requested login is already in use.
.RE

.sp
.ne 2
.mk
.na
\fB\fB14\fR\fR
.ad
.RS 6n
.rt  
Unexpected failure.
.RE

.sp
.ne 2
.mk
.na
\fB\fB16\fR\fR
.ad
.RS 6n
.rt  
Unable to update the group database.
.RE

.sp
.ne 2
.mk
.na
\fB\fB17\fR\fR
.ad
.RS 6n
.rt  
Unable to update the project database.
.RE

.sp
.ne 2
.mk
.na
\fB\fB18\fR\fR
.ad
.RS 6n
.rt  
Insufficient authorization.
.RE

.sp
.ne 2
.mk
.na
\fB\fB19\fR\fR
.ad
.RS 6n
.rt  
Does not have role.
.RE

.sp
.ne 2
.mk
.na
\fB\fB20\fR\fR
.ad
.RS 6n
.rt  
Does not have profile.
.RE

.sp
.ne 2
.mk
.na
\fB\fB21\fR\fR
.ad
.RS 6n
.rt  
Does not have privilege.
.RE

.sp
.ne 2
.mk
.na
\fB\fB22\fR\fR
.ad
.RS 6n
.rt  
Does not have label.
.RE

.sp
.ne 2
.mk
.na
\fB\fB23\fR\fR
.ad
.RS 6n
.rt  
Does not have group.
.RE

.sp
.ne 2
.mk
.na
\fB\fB24\fR\fR
.ad
.RS 6n
.rt  
System not running Trusted Extensions.
.RE

.sp
.ne 2
.mk
.na
\fB\fB25\fR\fR
.ad
.RS 6n
.rt  
Does not have project.
.RE

.sp
.ne 2
.mk
.na
\fB\fB26\fR\fR
.ad
.RS 6n
.rt  
Unable to update \fBauto_home\fR.
.RE

.SH FILES
.sp
.LP
\fB/etc/datemsk\fR
.sp
.LP
\fB/etc/passwd\fR
.sp
.LP
\fB/etc/shadow\fR
.sp
.LP
\fB/etc/group\fR
.sp
.LP
\fB/etc/skel\fR
.sp
.LP
\fB/usr/include/limits.h\fR
.sp
.LP
\fB/etc/user_attr\fR
.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
tab() box;
cw(2.75i) |cw(2.75i) 
lw(2.75i) |lw(2.75i) 
.
ATTRIBUTE TYPEATTRIBUTE VALUE
_
Availabilitysystem/core-os
_
Interface StabilityCommitted
.TE

.SH SEE ALSO
.sp
.LP
\fBauths\fR(1), \fBpasswd\fR(1), \fBprofiles\fR(1), \fBroles\fR(1), \fBgroupadd\fR(1M), \fBgroupdel\fR(1M), \fBgroupmod\fR(1M), \fBgrpck\fR(1M), \fBlogins\fR(1M), \fBpwck\fR(1M), \fBuserdel\fR(1M), \fBusermod\fR(1M), \fBgetdate\fR(3C), \fBauth_attr\fR(4), \fBgroup\fR(4), \fBpasswd\fR(4), \fBprof_attr\fR(4), \fBproject\fR(4), \fBuser_attr\fR(4), \fBattributes\fR(5)
.sp
.LP
\fIWorking With Oracle Solaris 11.3 Directory and         Naming Services: LDAP\fR, \fIManaging User Accounts and User Environments in Oracle Solaris 11.3\fR
.SH DIAGNOSTICS
.sp
.LP
In case of an error, \fBuseradd\fR displays an error message and exits with a non-zero status.
.sp
.LP
The following indicates that \fBlogin\fR specified is already in use:
.sp
.in +2
.nf
UX: useradd: ERROR: login is already in use. Choose another.
.fi
.in -2
.sp

.sp
.LP
The following indicates that the \fIuid\fR specified with the \fB-u\fR option is not unique:
.sp
.in +2
.nf
UX: useradd: ERROR: uid \fIuid\fR is already in use. Choose another. 
.fi
.in -2
.sp

.sp
.LP
The following indicates that the \fIgroup\fR specified with the \fB-g\fR option has not yet been created:
.sp
.in +2
.nf
UX: useradd: ERROR: group \fIgroup\fR does not exist. Choose another. 
.fi
.in -2
.sp

.sp
.LP
The following indicates that the \fIuid\fR specified with the \fB-u\fR option is in the range of reserved \fBUID\fRs (from \fB0\fR-\fB99\fR):
.sp
.in +2
.nf
UX: useradd: WARNING: uid \fIuid\fR is reserved.
.fi
.in -2
.sp

.sp
.LP
The following indicates that the \fIuid\fR specified with the \fB-u\fR option exceeds \fBMAXUID\fR as defined in \fB<sys/param.h>\fR:
.sp
.in +2
.nf
UX: useradd: ERROR: uid \fIuid\fR is too big. Choose another.
.fi
.in -2
.sp

.sp
.LP
The following indicates that the \fB/etc/passwd\fR or \fB/etc/shadow\fR files do not exist:
.sp
.in +2
.nf
UX: useradd: ERROR: Cannot update system files - login cannot be created.
.fi
.in -2
.sp

.sp
.LP
The following indicates that the user executing the command does not have sufficient authorization to perform the operation:
.sp
.in +2
.nf
UX: roleadd: ERROR: Permission denied.
.fi
.in -2
.sp

.sp
.LP
The following indicates that an invalid directory was specified in a \fBuseradd\fR command:
.sp
.in +2
.nf
UX: \fIinvalid_directory\fR is not a valid directory. Choose another.
.fi
.in -2
.sp

.SH NOTES
.sp
.LP
The \fBuseradd\fR utility adds definitions to the \fBpasswd\fR, \fBshadow\fR, \fBgroup\fR, \fBproject \fR, and \fBuser_attr\fR databases in the scope (default or specified). It will verify the uniqueness of the user name (or role) and user id and the existence of any group names specified against the external name service.