This guide explains how to invite users to your project using the OpenStack CLI and the Adjutant service. It is the CLI counterpart of the Project Management dashboard page.

[NOTE] Before using these commands, make sure your CLI is configured as described in the OpenStack CLI Configuration.

Prerequisites

  • You have a working OpenStack CLI environment (openstack command available).
  • Your OS_CLOUD or other authentication environment variables are configured for the correct project.
  • Adjutant is enabled in your environment.
  • Your user has one of the roles that allow managing project users, typically:
    • project_admin
    • project_mod

To confirm your roles, you can run:

openstack role assignment list --user <your-user-id> --project <your-project-id>

1. List Current Project Users

To see all users associated with your current project:

openstack project user list

This is the CLI equivalent of viewing the User Management table in the dashboard. You should see existing members and any pending invitations created previously.

2. Inviting a New User (Standard Flow)

As a project owner or project administrator, you can invite new users to your project via Adjutant.

2.1 Choose the Role for the New User

Typical project-level roles are:

  • Member → Keystone role name : member
  • Project Moderator → Keystone role name : project_mod
  • Project Administrator → Keystone role name : project_admin
  • Load Balancer Reader → Keystone role name : load-balancer_observer
  • Load Balancer Member → Keystone role name : load-balancer_member
  • Secret Creator → Keystone role name : creator
  • Secret Reader → Keystone role name : observer

2.2 Send the Invitation

Use the Adjutant extension to the OpenStack CLI:

openstack project user invite <email-address> <role-name>

Example:

openstack project user invite [email protected] member project_admin
  • <email-address>: Email of the person you want to invite.
  • <role-name>: The role you want to grant to the user (for example member, project_mod, or project_admin).

If the command succeeds, Adjutant creates an invitation task and sends an email to the invitee.

2.3 Verify the Invitation

List the project users again:

openstack project user list

The invited user should now appear in the output. Depending on your deployment, the user may show with a status indicating that the account is not yet activated.

2.4 What the Invited User Sees

The invited user receives an email with a link to the dashboard where he can complete the account setup.

The invitee follows the dashboard link, chooses an initial password, and completes the account setup via the web interface. After completion, they can log in to the dashboard or use the CLI with their new credentials.

3. Completing an Invitation via CLI (Advanced)

In environments without access to the dashboard, or for automation purposes, you can complete the invitation using the CLI only. This uses Adjutant’s admin task interface.

3.1 Extract the Invitation Token

From the invitation email, locate the URL that looks similar to:

https://<dashboard-host>/token/e86cbfb187d34222ace90845f900893c

The part after /token/ is the invitation token:

e86cbfb187d34222ace90845f900893c

3.2 Submit the Token with an Initial Password

Use the following command to submit the token and set an initial password for the invited user:

openstack admin task token submit <invitation-token> '{"password": "<initial-password>"}'

Example:

openstack admin task token submit e86cbfb187d34222ace90845f900893c '{"password": "S3cureP@ssw0rd!"}'

After this, the invitation task should complete and the user account becomes active.

3.3 Confirm the New User

You can now verify that the user is active and associated with the project:

openstack project user list

You should see the new user listed as a member of the project.

For a conceptual overview of roles and best practices, refer to the dashboard guide