opschain admin groups add-member
Included from Basic tier
Adds a user to a local group: add-member <group> <username>. Since
the verb rides the v2 lane: the username resolves to its user id through
UserService.GetUser (honouring --provider), then
GroupService.AddMember records the membership against that id — so a
same-named local/federated pair is two distinguishable members. The group
must exist (not_found otherwise — create it first; the v1 surface's
implicit create-on-first-add does not carry over), and adding an existing
member is an idempotent no-op. Because local and directory group names
share one namespace, adding a user to a directory-named group grants them
every policy assigned to that group name. Any user may be a member — local
or federated — but service accounts refuse: machine identities take their
authority from trust grants, not groups (a named server refusal).
opschain admin groups add-member platform-admins alice
Added alice to platform-admins
Flags
| Flag | Meaning |
|---|---|
--provider <instance> | Select the identity provider instance (an auth_provider value: local, ldap:<key>, oidc:<key>, …) when the username exists under more than one; without it an ambiguous name is refused with the matches listed. |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
Exit codes: 0 on success, 1 when the server refused (unknown user or group,
service account, ambiguous username without --provider) or the token is
rejected, 2 for usage — wrong argument count, or the connection errors on
opschain docs cli/admin-users.
See also
opschain docs cli/admin-groups-remove-member— the inverse.opschain docs cli/admin-authz-policies-assign— giving the group its authority.