// AddUserUserWithRole adds user with assigned role
351803
func (i *TeleInstance) AddUserWithRole(username string, role services.Role) *User {
	user := &User{
		Username: username,
		Roles:    []services.Role{role},
	}
	i.Secrets.Users[username] = user
	return user
}
171004
func RoleForUser(u User) Role {
	return &RoleV3{
		Kind:    KindRole,
		Version: V3,
		Metadata: Metadata{
			Name:      RoleNameForUser(u.GetName()),
			Namespace: defaults.Namespace,
		},
		Spec: RoleSpecV3{
			Options: RoleOptions{
				CertificateFormat: teleport.CertificateFormatStandard,
				MaxSessionTTL:     NewDuration(defaults.MaxCertDuration),
				PortForwarding:    NewBoolOption(true),
				ForwardAgent:      NewBool(true),
			},
			Allow: RoleConditions{
				Namespaces: []string{defaults.Namespace},
				NodeLabels: Labels{Wildcard: []string{Wildcard}},
				Rules:      CopyRulesSlice(AdminUserRules),
			},
		},
	}
}
970326
func (s *DescribedUser) SetRole(v string) *DescribedUser {
	s.Role = &v
	return s
}
595389
func (v *VoiceTarget) AddUser(user *User) {
	v.users = append(v.users, user)
}
370325
func (s *NFSFileShareInfo) SetRole(v string) *NFSFileShareInfo {
	s.Role = &v
	return s
}
793878
func AddOrgUser(c *m.ReqContext, cmd m.AddOrgUserCommand) Response {
	cmd.OrgId = c.ParamsInt64(":orgId")
	return addOrgUserHelper(cmd)
}
1260356
func (r *Client) AddActualOrgUser(userRole UserRole) (StatusMessage, error) {
	var (
		raw  []byte
		resp StatusMessage
		err  error
	)
	if raw, err = json.Marshal(userRole); err != nil {
		return StatusMessage{}, err
	}
	if raw, _, err = r.post("api/org/users", nil, raw); err != nil {
		return StatusMessage{}, err
	}
	if err = json.Unmarshal(raw, &resp); err != nil {
		return StatusMessage{}, err
	}
	return resp, nil
}
390225
func (e *Enforcer) AddRoleForUser(user string, role string) bool {
	return e.AddGroupingPolicy(user, role)
}
1037301
func (s *User) SetRole(v string) *User {
	s.Role = &v
	return s
}
468219
func (a *AuthWithRoles) currentUserAction(username string) error {
	if username == a.user.GetName() {
		return nil
	}
	return a.checker.CheckAccessToRule(&services.Context{User: a.user},
		defaults.Namespace, services.KindUser, services.VerbCreate, false)
}
334319
func (st *State) AddUser(name, displayName, password, creator string) (*User, error) {
	return st.addUser(name, displayName, password, creator, nil)
}
413697
func (c *Client) UpsertRole(role services.Role) error {
	data, err := services.GetRoleMarshaler().MarshalRole(role)
	if err != nil {
		return trace.Wrap(err)
	}
	_, err = c.PostJSON(c.Endpoint("roles"), &upsertRoleRawReq{Role: data})
	return trace.Wrap(err)
}
1139558
func (c *RolesStore) Add(ctx context.Context, u *chronograf.Role) (*chronograf.Role, error) {
	if err := c.Ctrl.CreateRole(ctx, u.Name); err != nil {
		return nil, err
	}
	if err := c.Ctrl.SetRolePerms(ctx, u.Name, ToEnterprise(u.Permissions)); err != nil {
		return nil, err
	}

	users := make([]string, len(u.Users))
	for i, u := range u.Users {
		users[i] = u.Name
	}
	if err := c.Ctrl.SetRoleUsers(ctx, u.Name, users); err != nil {
		return nil, err
	}
	return u, nil
}
547010
func (s *FunctionConfiguration) SetRole(v string) *FunctionConfiguration {
	s.Role = &v
	return s
}
364963
func NewUserContext(user services.User, userRoles services.RoleSet) (*userContext, error) {
	ctx := &services.Context{User: user}
	sessionAccess := newAccess(userRoles, ctx, services.KindSession)
	roleAccess := newAccess(userRoles, ctx, services.KindRole)
	authConnectors := newAccess(userRoles, ctx, services.KindAuthConnector)
	trustedClusterAccess := newAccess(userRoles, ctx, services.KindTrustedCluster)
	logins := getLogins(userRoles)

	acl := userACL{
		AuthConnectors:  authConnectors,
		TrustedClusters: trustedClusterAccess,
		Sessions:        sessionAccess,
		Roles:           roleAccess,
		SSHLogins:       logins,
	}

	// local user
	authType := authLocal

	// check for any SSO identities
	isSSO := len(user.GetOIDCIdentities()) > 0 ||
		len(user.GetGithubIdentities()) > 0 ||
		len(user.GetSAMLIdentities()) > 0

	if isSSO {
		// SSO user
		authType = authSSO
	}

	return &userContext{
		Name:     user.GetName(),
		ACL:      acl,
		AuthType: authType,
		Version:  teleport.Version,
	}, nil
}
522132
func SetupUser(process *service.TeleportProcess, username string, roles []services.Role) error {
	auth := process.GetAuthServer()
	teleUser, err := services.NewUser(username)
	if err != nil {
		return trace.Wrap(err)
	}
	if len(roles) == 0 {
		role := services.RoleForUser(teleUser)
		role.SetLogins(services.Allow, []string{username})

		// allow tests to forward agent, still needs to be passed in client
		roleOptions := role.GetOptions()
		roleOptions.ForwardAgent = services.NewBool(true)
		role.SetOptions(roleOptions)

		err = auth.UpsertRole(role)
		if err != nil {
			return trace.Wrap(err)
		}
		teleUser.AddRole(role.GetMetadata().Name)
		roles = append(roles, role)
	} else {
		for _, role := range roles {
			err := auth.UpsertRole(role)
			if err != nil {
				return trace.Wrap(err)
			}
			teleUser.AddRole(role.GetName())
		}
	}
	err = auth.UpsertUser(teleUser)
	if err != nil {
		return trace.Wrap(err)
	}
	return nil
}
1196365
func (conn *Connection) GrantRole(username string, role string,
	auth Auth) (string, error) {
	userDb := conn.SelectDB("_users", auth)
	namestring := "org.couchdb.user:" + username
	var userData interface{}

	rev, err := userDb.Read(namestring, &userData, nil)
	if err != nil {
		return "", err
	}
	if reflect.ValueOf(userData).Kind() != reflect.Map {
		return "", errors.New("Type Error")
	}
	userMap := userData.(map[string]interface{})
	if reflect.ValueOf(userMap["roles"]).Kind() != reflect.Slice {
		return "", errors.New("Type Error")
	}
	userRoles := userMap["roles"].([]interface{})
	//Check if our role is already in the array, so we don't add it twice
	for _, r := range userRoles {
		if r == role {
			return rev, nil
		}
	}
	userMap["roles"] = append(userRoles, role)
	return userDb.Save(&userMap, namestring, rev)
}