How to Import Bulk Users into Warpgate?

[vjmax]

We’re looking to bulk import users into Warpgate during a migration from another system.

We’ve tried inserting directly into the our postgres database like this:

`INSERT INTO users (id, username, credential_policy)
VALUES 
  ('<uuid-1>', '[email protected]', '{"ssh": ["web", "otp"], "http": ["sso"], "postgres": ["web"]}'::json),

  ('<uuid-2>', '[email protected]', '{"ssh": ["web", "otp"], "http": ["sso"], "postgres": ["web"]}'::json);
`

This works in our initial testing.

Questions:

1. Is direct DB insertion a supported method for bulk user import?

2. Are there other fields or related tables (e.g., roles, passwords) we should handle?

3. Is there a CLI or API-based way recommended for bulk user creation?

4.Is the users.id field referenced in any other tables (e.g., user-role mappings, audit logs, etc.) that we should be aware of when inserting users manually?

[Eugeny]

I wouldn't recommend touching the DB directly. Even though it would work in the current version, this can cause issues down the line.

Use the admin API instead, it provides a way to create users (although one by one only) as well as credentials management.

These user IDs are references across almost all other tables too.

[samtoxie]

Another option I'd recommend is implementing an identity provider, so you can use SSO via oidc. Especially if you're also using other applications besides warpgate.

We use a combination of warpgate and netbird, where SSO (zitadel) does role management and account creation for both.

[Christian-Little-Tava]

Any thoughts (Or is this possible?) on allowing targets, users, etc to be managed via a config file? Ideally we like any changes to be made exclusively through our internal github repo, so we can have the running instance as locked down as possible (Meaning approvals are given with any changes)

Part of our deploy process can copy any files to anywhere in the box on startup

Also, as far as Oauth, It seems like through Google Oauth you are unable to create users since Google's doesn't include the fields that Warpgate is expecting