Client operations commands¶
Common global behavior is documented in the CLI hub. The complete session-management command contracts follow.
gdsgate session list¶
Lists the live sessions you are permitted to terminate (filtered by the
Cedar killSession action), with the session id, principal, resource,
start time, and, under HOLDS, what the session was opened on: key
where the holder proved possession of one, cookie for a person who arrived
through the clientless browser entry.
The two read alike in every other column, and they are not the same thing to
whoever is deciding whether to end one: a browser session's whole credential
lives in the gateway, so ending it ends that person's access until they sign in
again, while a keystore session's holder still has their certificate afterwards.
gdsgate session kill [<id>] [--principal <p>] [--resource <r>]¶
Terminates live sessions and audits each one. Pass exactly one selector:
a single <id> from session list, or every session of a --principal,
or every session on a --resource. Only the sessions the policy permits
are ended.
SESSION_ID=5f3c1234 # replace with an id from `session list`
gdsgate --config client.toml session kill "$SESSION_ID"
gdsgate --config client.toml session kill --principal alice
gdsgate --config client.toml session kill --resource prod-db
| Argument | Default | Purpose |
|---|---|---|
<id> |
none | A single session id. Mutually exclusive with the selectors below. |
--principal <p> |
none | Every live session owned by this principal. |
--resource <r> |
none | Every live session on this backend resource. |
gdsgate session watch¶
Streams live-session opens and closes you may act on, as they happen, until interrupted.
list kill watch