What are the differences between managing Chef users in Chef Manage and in Chef Automate? - Progress Community

Loading

Skip to Main Content

What are the differences between managing Chef users in Chef Manage and in Chef Automate?

This article discusses the experience of managing users with Chef Manage and Chef Automate, with a focus on understanding the differences between the two particularly during migrations or restores.

Aug 25, 2025
Knowledge

Title

What are the differences between managing Chef users in Chef Manage and in Chef Automate?

URL Name

What-are-the-differences-between-managing-Chef-users-in-Chef-Manage-and-in-Chef-Automate

Article Number

000289091

Environment

Question/Problem Description

What are the differences between managing Chef users in Chef Manage and in Chef Automate?

Recently we have migrated from chef mange to chef automate. I can see the users via knife user list but not in automate. Is it possible to reimport the users without recreating private keys?

After restore of Chef Infra Server from backup to Chef Automate the users are not visible in Chef Automate. However, I can list the users using knife user list

Steps to Reproduce

Clarifying Information

This details about the differences from Chef manage to Chef Automate either being migrated or restored for backup.

Error Message

Defect Number

Enhancement Number

Cause

Resolution

Chef is a powerful configuration management tool that enables organizations to automate infrastructure provisioning and application deployment. While Chef Infra handles system configurations, managing user access and permissions is critical for ensuring security and collaboration across teams.

Within the Chef ecosystem, there are two distinct interfaces for user management: Chef Manage and Chef Automate. Though they share some overlapping capabilities, these tools differ significantly in architecture, functionality, and user experience.

Overview of the Tools

Chef Manage

Legacy web UI for managing Chef Infra Server.
Primarily used for user and node management, data bags, environments, and roles.
Considered deprecated by Chef and is no longer actively maintained.
Uses RSA key-based authentication.
Users are managed via knife user commands or through the GUI.
No granular role-based access control (RBAC).
Chef Manage has limited LDAP integration and no native support for modern identity protocols.

Chef Automate

A comprehensive enterprise platform that integrates Chef Infra, Habitat, and InSpec.
Provides workflow pipelines, compliance reporting, and advanced access control.
Actively developed and maintained.
Supports IAM policies, allowing fine-grained access control.
Users can be assigned to teams with specific permissions.
Offers session management and policy-based access.
Chef Automate integrates seamlessly with identity providers (Okta, Azure AD, etc.) for SSO, improving security and user lifecycle management.

Knife with Chef Manage

Chef Manage was the original web UI and user management tool for Chef Infra Server. Though it's deprecated, many legacy systems still use it.

In Chef Manage:

Users are directly managed within the Chef Infra Server.
Stored in the Chef Infra Server’s internal database
knife user commands can be used to create, delete, list, and edit users.

knife is a command-line tool that allows to:

Manage nodes, cookbooks, environments, roles, and data bags
Bootstrap new nodes
Interact with the Chef Infra Server
Manage users and organizations (in some setups)
The command knife user is used to manage Chef Infra Server users

Knife with Chef Automate

Chef Automate is the modern dashboard that integrates with multiple Chef tools (Infra, InSpec, Habitat). It introduces Role-Based Access Control (RBAC), teams, and SSO integration.

knife user does not manage Chef Automate users.
- Chef Automate users are not Infra Server users.
- Chef Automate uses its own identity store (can integrate with LDAP, SAML, or local users).
- knife only interacts with the Chef Infra Server, not Automate’s user system.

How to handle Automate Users

Users are managed via the Chef Automate web UI or Automate API.
Authentication can be done via tokens, SSO, or local logins.
Access is controlled using teams and roles.

While knife is powerful for managing Chef Infra Server, it plays a limited role in Chef Automate. The key difference lies in how users are defined and authenticated:

Chef Manage allows knife user commands to manage real users on the server.
Chef Automate uses a more modern system, where user management is decoupled from knife, and handled via web UI or API with better RBAC and SSO support.

Comparison Table

Feature	Chef Manage	Chef Automate
Tool for user management	knife user, Chef Manage UI	Automate UI, Automate API
User Storage	Chef Infra Server	Automate IAM
User type	Chef Infra Server users	Automate users (separate auth system)
Authentication	RSA key (.pem)	OAuth2, LDAP, SAML, local
Supports knife user	Yes	No
RBAC	Basic (Admin/Non-admin)	Advanced (teams, roles, projects)
Deprecation status	Deprecated (EOL)	Actively maintained
Single sign-on (SSO)	No	Yes
knife user list	Shows Users	Does not show users

Migration & Restore Considerations

If you're restoring a Chef Infra Server backup:

knife user list will show Infra Server users
Automate will not automatically display or recognize those users
You must recreate users in Automate manually using chef-automate iam user create
You do not need to regenerate private keys unless you're re-authenticating via CLI

References:-

Chef Infra users - https://docs.chef.io/server/server_users/

Chef Automate users - https://docs.chef.io/automate/users/

Chef Manage - https://docs.chef.io/manage/

Workaround

Notes

Keyword Phrase

Last Modified Date

8/25/2025 6:33 PM

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Loading

What are the differences between managing Chef users in Chef Manage and in Chef Automate? - Progress Community