Currently user/group management can be done using the following generic commands:

• pki user-*
• pki group-*

By default these commands will be directed to CA subsystem. To manage users/groups in other subsystem, the subsystem name can be specified in the server URL, for example:

$ pki -U https://server.example.com:8443/kra ... user-find

To simplify CLI usage, ideally the server URL should be identical for all CLI commands directed to the same server, so the subsystem name should not be included in the server URL. Instead, the subsystem name should be specified as part of the command name:

• pki ca-user/group-*
• pki kra-user/group-*
• pki ocsp-user/group-*
• pki tks-user/group-*
• pki tps-user/group-*

The above commands have already existed for some time. Most of these commands are identical except that the tps-user command might have specific input parameters/output for TPS user profiles.

In the future there might be more subsystem-specific input parameters/output, so it would make sense to deprecate the generic user/group commands now, and potentially remove them in the future.