Moab Web Services > Access Control > How-to > Setting up and Provisioning a Tenant Via the REST Interface or Provided Scripts

Setting Up and Provisioning a Tenant via the REST Interface or Provided Scripts

To provision tenants, you must meet the following prerequisites:

Follow the tenant setup instructions in Modeling Your Organization with Tenants.
Configure LDAP.
In LDAP, configure users, groups, and organizational units (OUs).

Creating subsections of nodes within a data center can have an impact on performance. The more tenants that are created, the greater the likelihood of impacting performance expectations.

To set up and provision a tenant

Create the required principal(s). You can create a principal through the REST interface (see Create Single Principal) or by running the mprincipal command line script shipped with MWS. See The mprincipal Provisioning Script for information about syntax, commands, and options associated with this script.
```
> mprincipal -c ResearchUsers -g "cn=ResearchDept,ou=departments,dc=com" -r User -U moab-admin -P thePassword -H https://acme-mws:8080
```
The preceding mprincipal example creates a principal called ResearchUsers that maps to the ResearchDept group in LDAP, as identified by the supplied DN, and has the role of User. The script connects to MWS with the username moab-admin, the password thePassword, and the host name https://acme-mws:8080.
Create the required tenant(s). You can create a tenant through the REST interface (see Create Single Tenant) or by running the mtenant command line script distributed with MWS. See The mtenant Provisioning Script for information about syntax, commands, and options associated with this script.
```
> mtenant -c Research -U moab-admin -P thePassword -H https://localhost:8080
```
The preceding mtenant example creates a tenant called Research. The script connects to MWS with the user name moab-admin, the password thePassword, and the host name https://localhost:8080.
Attach the appropriate principals to the tenants. You can attach the principal(s) to the tenant(s) through the REST interface or by running the included mtenant command line script shipped with MWS. See The mtenant Provisioning Script for information about syntax, commands, and options associated with this script.
```
> mtenant -p Research -U moab-admin -P thePassword -H http://localhost:8080 ResearchPowerUsers ResearchAdministrators
```
The preceding script adds the ResearchAdministrators principal to the Research tenant. The script connects to MWS with the user name moab-admin, the password thePassword, and the host name https://localhost:8080.
Assign the preferred node(s) to the tenant(s). You can assign the node(s) to the tenant(s) through the REST interface (see Modify Single Tenant) or by running the included mtenant command line script shipped with MWS. See The mtenant Provisioning Script for more information about syntax, commands, and options associated with the script.
```
> mtenant -n Research -U moab-tenant -P thePassword -H https://localhost:8080 n001 n002 n003
```
The script above attaches nodes n001, n002, and n003 to the Research tenant. The script connects to MWS with the user name moab-tenant, the password thePassword, and the host name https://localhost:8080.

To migrate a service to a tenant

If you want, you can migrate a service to the new tenant (if applicable). To migrate a service to the new tenant, change the service's tenant field to the new tenant and pass in the list of attached nodes (see Modify Single Tenant) through the REST interface. You can also migrate a service to the new tenant using the included msvc command line script shipped with MWS. See The msvc Provisioning Script for more information about syntax, commands, and options associated with the script.
```
> msvc -m Research -U moab-tenant -P thePassword -H https://localhost:8080 svc001 svc002 svc003
```
The script above migrates services svc001, svc002, and svc003 to the Research tenant. The script connects to MWS with the user name moab-tenant, the password thePassword, and the host name https://localhost:8080.

To copy service templates to a tenant

If you want, you can copy service templates (if applicable) to a new tenant by first retrieving the service template(s), updating their name(s) to ensure they are unique, and updating the tenant field to the new tenant (see Modify Service Template) through the REST interface. You can also copy service templates to a new tenant using the included msvctempl command line script shipped with MWS. See The msvctempl Provisioning Script for more information about syntax, commands, and options associated with the script.
```
> msvctempl -c Research -U moab-tenant -P thePassword -H https://localhost:8080 lamp2container hcstorage
```
The script above copies the specified service template to the Research tenant and automatically selects a name for the new copy by appending an ordinal to the original name; for example, lamp2container becomes lamp2container-1. The script connects to MWS with the user name moab-tenant, the password thePassword, and the host name https://localhost:8080.