Hfrhyu

I've tried posting this xml:

<user>
 <userName>Jim</userName>
 <password>password</password>
 <enabled>true</enabled>
</user>

to these addresses:

http://localhost:8080/geoserver/rest/usergroup/user
404 - "Not Found"
http://localhost:8080/geoserver/rest/usergroup/users/user
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/user
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/users/
500 - "Server Error"
http://localhost:8080/geoserver/rest/security/usergroup/users/user
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/user/Jim
500 - "Server Error"
http://localhost:8080/geoserver/rest/security/usergroup/users/Jim
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/users/user/Jim
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/service/MyGroup/user
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/service/MyGroup/users
500 - "Server Error"
http://localhost:8080/geoserver/rest/security/usergroup/service/MyGroup/users/user
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/service/MyGroup/user/Jim
500 - "Server Error"
http://localhost:8080/geoserver/rest/security/usergroup/service/MyGroup/users/Jim
404 - "Not Found"
http://localhost:8080/geoserver/rest/security/usergroup/service/MyGroup/users/user/Jim
404 - "Not Found"

I've tried with and without the GeoFence plugin.

Is this actually possible?

I have succeeded in creating roles, usergroups, workspaces, coverageStores and raster layers from GeoTiff files, and dataStores and vector layers from shapefiles, but no progress on creating users.

I gather that some modules require you to change the admin password from the default, so I've done that too. My admin account has ADMIN, GROUP_ADMIN, and ROLE_ADMIN roles, and I've even added a USER_ADMIN role in the case such a thing exists.

I'm running geoserver-2.12-SNAPSHOT from 18 September.

You are very close. The documentation shows that you need to POST to

http://localhost:8080/geoserver/rest/usergroup/service/users/

As long as you are executing the POST as a user with the role ROLE_ADMIN it should work as expected.

I have found temporary solution for this.

The reason of this is that the XStream cannot map XML/JSON to org.geoserver.rest.security.xml.JaxbUser because there is no alias "user" for this.

There are two solutions for it.

1. Use full class name with package in your XML/JSON.

Something like this:

"org.geoserver.rest.security.xml.JaxbUser":

 "userName": "test",
 "password": "test",
 "enabled": true

If you use XML there is propably the same way.

2. Edit org.geoserver.rest.security.UsersRestController class.

Add super class org.geoserver.rest.RestBaseController to it and override two methods

@Override
 public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) 
 return JaxbUser.class.isAssignableFrom(methodParameter.getParameterType());
 

 @Override
 public void configurePersister(XStreamPersister persister, XStreamMessageConverter converter) 
 persister.setHideFeatureTypeAttributes();

 persister.getXStream().alias("user", JaxbUser.class);
 

After one of those solutions you need to add JaxbUser.class to XStream whitelist. The simplest way to do it is adding system/environment/context variable GEOSERVER_XSTREAM_WHITELIST like GEOSERVER_DATA_DIR.
E.g -DGEOSERVER_XSTREAM_WHITELIST=org.geoserver.rest.security.xml.JaxbUser

I hope this will be fixed in next versions of Geoserver. By the way the GeoServer Documentation is full of lack and need to be polished.

I have posted the same on Jira.