[chef] "knife user" vs "knife client"

[Maciej Pasternacki < >]

Hi,

I'm bootstrapping a Chef server 11 for the first time, and I'm a bit confused by the distinction of "knife user" vs "knife client".

I don't want to use Chef server's web UI (at least for now), and I don't want the users to have any passwords at all (API is authenticated by keys; all web panels are protected by SSO). All the setup instructions use Web UI, and `knife client create` requires me to provide a password.

As far as I understand, for API access `knife client create --admin` is sufficient. Am I right, or is there something I'm missing?

Are users created with `knife user create` relevant anywhere else than web UI and chef-vault?

Is it possible to create a user without a valid password, so that it's not possible to authenticate using password?

The existing documentation doesn't really specify what a 'user' actually is, it seems to be just a dump of `knife user --help`.

Thanks,

-- Maciej