@@ -282,6 +282,38 @@ Make project network global

 ====

+== oadm policy add-role-to-user

+Add users or serviceaccounts to a role in the current project

+

+====

+

+[options="nowrap"]

+----

+  # Add the 'view' role to user1 in the current project

+  $ oadm policy add-role-to-user view user1

+

+  # Add the 'edit' role to serviceaccount1 in the current project

+  $ oadm policy add-role-to-user edit -z serviceaccount1

+----

+====

+

+

+== oadm policy add-scc-to-user

+Add users or serviceaccount to a security context constraint

+

+====

+

+[options="nowrap"]

+----

+  # Add the 'restricted' security context contraint to user1 and user2

+  $ oadm policy add-scc-to-user restricted user1 user2

+

+  # Add the 'privileged' security context contraint to the service account serviceaccount1 in the current namespace

+  $ oadm policy add-scc-to-user privileged -z serviceaccount1

+----

+====

+

+

 == oadm policy reconcile-cluster-role-bindings

 Replace cluster role bindings to match the recommended bootstrap policy

@@ -626,6 +626,22 @@ Update field(s) of a resource using strategic merge patch.

 ====

+== oc policy add-role-to-user

+Add users or serviceaccounts to a role in the current project

+

+====

+

+[options="nowrap"]

+----

+  # Add the 'view' role to user1 in the current project

+  $ oc policy add-role-to-user view user1

+

+  # Add the 'edit' role to serviceaccount1 in the current project

+  $ oc policy add-role-to-user edit -z serviceaccount1

+----

+====

+

+

 == oc port-forward

 Forward one or more local ports to a pod.

@@ -27,6 +27,14 @@ const (

 	RemoveClusterRoleFromUserRecommendedName  = "remove-cluster-role-from-user"

 )

+const (

+	addRoleToUserExample = `  # Add the 'view' role to user1 in the current project

+  $ %[1]s view user1

+

+  # Add the 'edit' role to serviceaccount1 in the current project

+  $ %[1]s edit -z serviceaccount1`

+)

+

 type RoleModificationOptions struct {

 	RoleNamespace       string

 	RoleName            string

@@ -67,9 +75,10 @@ func NewCmdAddRoleToUser(name, fullName string, f *clientcmd.Factory, out io.Wri

 	saNames := []string{}

 	cmd := &cobra.Command{

-		Use:   name + " ROLE USER [USER ...]",

-		Short: "Add users to a role in the current project",

-		Long:  `Add users to a role in the current project`,

+		Use:     name + " ROLE (USER | -z SERVICEACCOUNT) [USER ...]",

+		Short:   "Add users or serviceaccounts to a role in the current project",

+		Long:    `Add users or serviceaccounts to a role in the current project`,

+		Example: fmt.Sprintf(addRoleToUserExample, fullName),

 		Run: func(cmd *cobra.Command, args []string) {

 			if err := options.CompleteUserWithSA(f, args, saNames); err != nil {

 				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

@@ -226,8 +235,8 @@ func NewCmdRemoveClusterRoleFromUser(name, fullName string, f *clientcmd.Factory

 }

 func (o *RoleModificationOptions) CompleteUserWithSA(f *clientcmd.Factory, args []string, saNames []string) error {

-	if (len(args) < 2) && (len(saNames) == 0) {

-		return errors.New("you must specify at least two arguments: <role> <user> [user]...")

+	if len(args) < 1 {

+		return errors.New("you must specify a role")

 	}

 	o.RoleName = args[0]

@@ -235,6 +244,10 @@ func (o *RoleModificationOptions) CompleteUserWithSA(f *clientcmd.Factory, args

 		o.Users = append(o.Users, args[1:]...)

 	}

+	if (len(o.Users) == 0) && (len(saNames) == 0) {

+		return errors.New("you must specify at least one user or service account")

+	}

+

 	osClient, _, err := f.Clients()

 	if err != nil {

 		return err

@@ -2,6 +2,7 @@ package policy

 import (

 	"errors"

+	"fmt"

 	"io"

 	"github.com/spf13/cobra"

@@ -22,6 +23,14 @@ const (

 	RemoveSCCFromUserRecommendedName  = "remove-scc-from-user"

 )

+const (

+	addSCCToUserExample = `  # Add the 'restricted' security context contraint to user1 and user2

+  $ %[1]s restricted user1 user2

+

+  # Add the 'privileged' security context contraint to the service account serviceaccount1 in the current namespace

+  $ %[1]s privileged -z serviceaccount1`

+)

+

 type SCCModificationOptions struct {

 	SCCName      string

 	SCCInterface kclient.SecurityContextConstraintsInterface

@@ -56,9 +65,10 @@ func NewCmdAddSCCToUser(name, fullName string, f *clientcmd.Factory, out io.Writ

 	saNames := []string{}

 	cmd := &cobra.Command{

-		Use:   name + " SCC USER [USER ...]",

-		Short: "Add users to a security context constraint",

-		Long:  `Add users to a security context constraint`,

+		Use:     name + " SCC (USER | -z SERVICEACCOUNT) [USER ...]",

+		Short:   "Add users or serviceaccount to a security context constraint",

+		Long:    `Add users or serviceaccount to a security context constraint`,

+		Example: fmt.Sprintf(addSCCToUserExample, fullName),

 		Run: func(cmd *cobra.Command, args []string) {

 			if err := options.CompleteUsers(f, args, saNames); err != nil {

 				kcmdutil.CheckErr(kcmdutil.UsageError(cmd, err.Error()))

@@ -121,13 +131,17 @@ func NewCmdRemoveSCCFromUser(name, fullName string, f *clientcmd.Factory, out io

 }

 func (o *SCCModificationOptions) CompleteUsers(f *clientcmd.Factory, args []string, saNames []string) error {

-	if (len(args) < 2) && (len(saNames) == 0) {

-		return errors.New("you must specify at least two arguments (<scc> <user> [user]...) or a service account (<scc> -z <service account name>) ")

+	if len(args) < 1 {

+		return errors.New("you must specify a scc")

 	}

 	o.SCCName = args[0]

 	o.Subjects = authorizationapi.BuildSubjects(args[1:], []string{}, uservalidation.ValidateUserName, uservalidation.ValidateGroupName)

+	if (len(o.Subjects) == 0) && (len(saNames) == 0) {

+		return errors.New("you must specify at least one user or service account")

+	}

+

 	var err error

 	_, o.SCCInterface, err = f.Clients()

 	if err != nil {

@@ -11,6 +11,10 @@ os::log::install_errexit

 # This test validates user level policy

+os::cmd::expect_failure_and_text 'oc policy add-role-to-user' 'you must specify a role'

+os::cmd::expect_failure_and_text 'oc policy add-role-to-user -z NamespaceWithoutRole' 'you must specify a role'

+os::cmd::expect_failure_and_text 'oc policy add-role-to-user view' 'you must specify at least one user or service account'

+

 os::cmd::expect_success 'oc policy add-role-to-group cluster-admin system:unauthenticated'

 os::cmd::expect_success 'oc policy add-role-to-user cluster-admin system:no-user'

 os::cmd::expect_success 'oc get rolebinding/cluster-admin --no-headers'