pveum.1-synopsis.adoc

   1 *pveum* `<COMMAND> [ARGS] [OPTIONS]`
   2
   3 *pveum acl delete* `<path> --roles <string>` `[OPTIONS]`
   4
   5 Update Access Control List (add or remove permissions).
   6
   7 `<path>`: `<string>` ::
   8
   9 Access control path
  10
  11 `--groups` `<string>` ::
  12
  13 List of groups.
  14
  15 `--propagate` `<boolean>` ('default =' `1`)::
  16
  17 Allow to propagate (inherit) permissions.
  18
  19 `--roles` `<string>` ::
  20
  21 List of roles.
  22
  23 `--tokens` `<string>` ::
  24
  25 List of API tokens.
  26
  27 `--users` `<string>` ::
  28
  29 List of users.
  30
  31 *pveum acl list* `[FORMAT_OPTIONS]`
  32
  33 Get Access Control List (ACLs).
  34
  35 *pveum acl modify* `<path> --roles <string>` `[OPTIONS]`
  36
  37 Update Access Control List (add or remove permissions).
  38
  39 `<path>`: `<string>` ::
  40
  41 Access control path
  42
  43 `--groups` `<string>` ::
  44
  45 List of groups.
  46
  47 `--propagate` `<boolean>` ('default =' `1`)::
  48
  49 Allow to propagate (inherit) permissions.
  50
  51 `--roles` `<string>` ::
  52
  53 List of roles.
  54
  55 `--tokens` `<string>` ::
  56
  57 List of API tokens.
  58
  59 `--users` `<string>` ::
  60
  61 List of users.
  62
  63 *pveum acldel*
  64
  65 An alias for 'pveum acl delete'.
  66
  67 *pveum aclmod*
  68
  69 An alias for 'pveum acl modify'.
  70
  71 *pveum group add* `<groupid>` `[OPTIONS]`
  72
  73 Create new group.
  74
  75 `<groupid>`: `<string>` ::
  76
  77 no description available
  78
  79 `--comment` `<string>` ::
  80
  81 no description available
  82
  83 *pveum group delete* `<groupid>`
  84
  85 Delete group.
  86
  87 `<groupid>`: `<string>` ::
  88
  89 no description available
  90
  91 *pveum group list* `[FORMAT_OPTIONS]`
  92
  93 Group index.
  94
  95 *pveum group modify* `<groupid>` `[OPTIONS]`
  96
  97 Update group data.
  98
  99 `<groupid>`: `<string>` ::
 100
 101 no description available
 102
 103 `--comment` `<string>` ::
 104
 105 no description available
 106
 107 *pveum groupadd*
 108
 109 An alias for 'pveum group add'.
 110
 111 *pveum groupdel*
 112
 113 An alias for 'pveum group delete'.
 114
 115 *pveum groupmod*
 116
 117 An alias for 'pveum group modify'.
 118
 119 *pveum help* `[OPTIONS]`
 120
 121 Get help about specified command.
 122
 123 `--extra-args` `<array>` ::
 124
 125 Shows help for a specific command
 126
 127 `--verbose` `<boolean>` ::
 128
 129 Verbose output format.
 130
 131 *pveum passwd* `<userid>`
 132
 133 Change user password.
 134
 135 `<userid>`: `<string>` ::
 136
 137 Full User ID, in the `name@realm` format.
 138
 139 *pveum pool add* `<poolid>` `[OPTIONS]`
 140
 141 Create new pool.
 142
 143 `<poolid>`: `<string>` ::
 144
 145 no description available
 146
 147 `--comment` `<string>` ::
 148
 149 no description available
 150
 151 *pveum pool delete* `<poolid>`
 152
 153 Delete pool.
 154
 155 `<poolid>`: `<string>` ::
 156
 157 no description available
 158
 159 *pveum pool list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 160
 161 List pools or get pool configuration.
 162
 163 `--poolid` `<string>` ::
 164
 165 no description available
 166
 167 `--type` `<lxc | qemu | storage>` ::
 168
 169 no description available
 170 +
 171 NOTE: Requires option(s): `poolid`
 172
 173 *pveum pool modify* `<poolid>` `[OPTIONS]`
 174
 175 Update pool.
 176
 177 `<poolid>`: `<string>` ::
 178
 179 no description available
 180
 181 `--allow-move` `<boolean>` ('default =' `0`)::
 182
 183 Allow adding a guest even if already in another pool. The guest will be removed from its current pool and added to this one.
 184
 185 `--comment` `<string>` ::
 186
 187 no description available
 188
 189 `--delete` `<boolean>` ('default =' `0`)::
 190
 191 Remove the passed VMIDs and/or storage IDs instead of adding them.
 192
 193 `--storage` `<string>` ::
 194
 195 List of storage IDs to add or remove from this pool.
 196
 197 `--vms` `<string>` ::
 198
 199 List of guest VMIDs to add or remove from this pool.
 200
 201 *pveum realm add* `<realm> --type <string>` `[OPTIONS]`
 202
 203 Add an authentication server.
 204
 205 `<realm>`: `<string>` ::
 206
 207 Authentication domain ID
 208
 209 `--acr-values` `<string>` ::
 210
 211 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 212
 213 `--autocreate` `<boolean>` ('default =' `0`)::
 214
 215 Automatically create users if they do not exist.
 216
 217 `--base_dn` `<string>` ::
 218
 219 LDAP base domain name
 220
 221 `--bind_dn` `<string>` ::
 222
 223 LDAP bind domain name
 224
 225 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 226
 227 Path to the CA certificate store
 228
 229 `--case-sensitive` `<boolean>` ('default =' `1`)::
 230
 231 username is case-sensitive
 232
 233 `--cert` `<string>` ::
 234
 235 Path to the client certificate
 236
 237 `--certkey` `<string>` ::
 238
 239 Path to the client certificate key
 240
 241 `--check-connection` `<boolean>` ('default =' `0`)::
 242
 243 Check bind connection to the server.
 244
 245 `--client-id` `<string>` ::
 246
 247 OpenID Client ID
 248
 249 `--client-key` `<string>` ::
 250
 251 OpenID Client Key
 252
 253 `--comment` `<string>` ::
 254
 255 Description.
 256
 257 `--default` `<boolean>` ::
 258
 259 Use this as default realm
 260
 261 `--domain` `\S+` ::
 262
 263 AD domain name
 264
 265 `--filter` `<string>` ::
 266
 267 LDAP filter for user sync.
 268
 269 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 270
 271 The objectclasses for groups.
 272
 273 `--group_dn` `<string>` ::
 274
 275 LDAP base domain name for group sync. If not set, the base_dn will be used.
 276
 277 `--group_filter` `<string>` ::
 278
 279 LDAP filter for group sync.
 280
 281 `--group_name_attr` `<string>` ::
 282
 283 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 284
 285 `--issuer-url` `<string>` ::
 286
 287 OpenID Issuer Url
 288
 289 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 290
 291 LDAP protocol mode.
 292
 293 `--password` `<string>` ::
 294
 295 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 296
 297 `--port` `<integer> (1 - 65535)` ::
 298
 299 Server port.
 300
 301 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 302
 303 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 304
 305 `--scopes` `<string>` ('default =' `email profile`)::
 306
 307 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 308
 309 `--secure` `<boolean>` ::
 310
 311 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 312
 313 `--server1` `<string>` ::
 314
 315 Server IP address (or DNS name)
 316
 317 `--server2` `<string>` ::
 318
 319 Fallback Server IP address (or DNS name)
 320
 321 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 322
 323 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 324
 325 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=([acl];[properties];[entry])|none] [,scope=<users|groups|both>]` ::
 326
 327 The default options for behavior of synchronizations.
 328
 329 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 330
 331 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 332
 333 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 334
 335 Use Two-factor authentication.
 336
 337 `--type` `<ad | ldap | openid | pam | pve>` ::
 338
 339 Realm type.
 340
 341 `--user_attr` `\S{2,}` ::
 342
 343 LDAP user attribute name
 344
 345 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 346
 347 The objectclasses for users.
 348
 349 `--username-claim` `<string>` ::
 350
 351 OpenID claim used to generate the unique username.
 352
 353 `--verify` `<boolean>` ('default =' `0`)::
 354
 355 Verify the server's SSL certificate
 356
 357 *pveum realm delete* `<realm>`
 358
 359 Delete an authentication server.
 360
 361 `<realm>`: `<string>` ::
 362
 363 Authentication domain ID
 364
 365 *pveum realm list* `[FORMAT_OPTIONS]`
 366
 367 Authentication domain index.
 368
 369 *pveum realm modify* `<realm>` `[OPTIONS]`
 370
 371 Update authentication server settings.
 372
 373 `<realm>`: `<string>` ::
 374
 375 Authentication domain ID
 376
 377 `--acr-values` `<string>` ::
 378
 379 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 380
 381 `--autocreate` `<boolean>` ('default =' `0`)::
 382
 383 Automatically create users if they do not exist.
 384
 385 `--base_dn` `<string>` ::
 386
 387 LDAP base domain name
 388
 389 `--bind_dn` `<string>` ::
 390
 391 LDAP bind domain name
 392
 393 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 394
 395 Path to the CA certificate store
 396
 397 `--case-sensitive` `<boolean>` ('default =' `1`)::
 398
 399 username is case-sensitive
 400
 401 `--cert` `<string>` ::
 402
 403 Path to the client certificate
 404
 405 `--certkey` `<string>` ::
 406
 407 Path to the client certificate key
 408
 409 `--check-connection` `<boolean>` ('default =' `0`)::
 410
 411 Check bind connection to the server.
 412
 413 `--client-id` `<string>` ::
 414
 415 OpenID Client ID
 416
 417 `--client-key` `<string>` ::
 418
 419 OpenID Client Key
 420
 421 `--comment` `<string>` ::
 422
 423 Description.
 424
 425 `--default` `<boolean>` ::
 426
 427 Use this as default realm
 428
 429 `--delete` `<string>` ::
 430
 431 A list of settings you want to delete.
 432
 433 `--digest` `<string>` ::
 434
 435 Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications.
 436
 437 `--domain` `\S+` ::
 438
 439 AD domain name
 440
 441 `--filter` `<string>` ::
 442
 443 LDAP filter for user sync.
 444
 445 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 446
 447 The objectclasses for groups.
 448
 449 `--group_dn` `<string>` ::
 450
 451 LDAP base domain name for group sync. If not set, the base_dn will be used.
 452
 453 `--group_filter` `<string>` ::
 454
 455 LDAP filter for group sync.
 456
 457 `--group_name_attr` `<string>` ::
 458
 459 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 460
 461 `--issuer-url` `<string>` ::
 462
 463 OpenID Issuer Url
 464
 465 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 466
 467 LDAP protocol mode.
 468
 469 `--password` `<string>` ::
 470
 471 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 472
 473 `--port` `<integer> (1 - 65535)` ::
 474
 475 Server port.
 476
 477 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 478
 479 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 480
 481 `--scopes` `<string>` ('default =' `email profile`)::
 482
 483 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 484
 485 `--secure` `<boolean>` ::
 486
 487 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 488
 489 `--server1` `<string>` ::
 490
 491 Server IP address (or DNS name)
 492
 493 `--server2` `<string>` ::
 494
 495 Fallback Server IP address (or DNS name)
 496
 497 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 498
 499 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 500
 501 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=([acl];[properties];[entry])|none] [,scope=<users|groups|both>]` ::
 502
 503 The default options for behavior of synchronizations.
 504
 505 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 506
 507 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 508
 509 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 510
 511 Use Two-factor authentication.
 512
 513 `--user_attr` `\S{2,}` ::
 514
 515 LDAP user attribute name
 516
 517 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 518
 519 The objectclasses for users.
 520
 521 `--verify` `<boolean>` ('default =' `0`)::
 522
 523 Verify the server's SSL certificate
 524
 525 *pveum realm sync* `<realm>` `[OPTIONS]`
 526
 527 Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
 528 Synced groups will have the name 'name-$realm', so make sure those groups
 529 do not exist to prevent overwriting.
 530
 531 `<realm>`: `<string>` ::
 532
 533 Authentication domain ID
 534
 535 `--dry-run` `<boolean>` ('default =' `0`)::
 536
 537 If set, does not write anything.
 538
 539 `--enable-new` `<boolean>` ('default =' `1`)::
 540
 541 Enable newly synced users immediately.
 542
 543 `--full` `<boolean>` ::
 544
 545 DEPRECATED: use 'remove-vanished' instead. If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync and removing all locally modified properties of synced users. If not set, only syncs information which is present in the synced data, and does not delete or modify anything else.
 546
 547 `--purge` `<boolean>` ::
 548
 549 DEPRECATED: use 'remove-vanished' instead. Remove ACLs for users or groups which were removed from the config during a sync.
 550
 551 `--remove-vanished` `([acl];[properties];[entry])|none` ('default =' `none`)::
 552
 553 A semicolon-seperated list of things to remove when they or the user vanishes during a sync. The following values are possible: 'entry' removes the user/group when not returned from the sync. 'properties' removes the set properties on existing user/group that do not appear in the source (even custom ones). 'acl' removes acls when the user/group is not returned from the sync. Instead of a list it also can be 'none' (the default).
 554
 555 `--scope` `<both | groups | users>` ::
 556
 557 Select what to sync.
 558
 559 *pveum role add* `<roleid>` `[OPTIONS]`
 560
 561 Create new role.
 562
 563 `<roleid>`: `<string>` ::
 564
 565 no description available
 566
 567 `--privs` `<string>` ::
 568
 569 no description available
 570
 571 *pveum role delete* `<roleid>`
 572
 573 Delete role.
 574
 575 `<roleid>`: `<string>` ::
 576
 577 no description available
 578
 579 *pveum role list* `[FORMAT_OPTIONS]`
 580
 581 Role index.
 582
 583 *pveum role modify* `<roleid>` `[OPTIONS]`
 584
 585 Update an existing role.
 586
 587 `<roleid>`: `<string>` ::
 588
 589 no description available
 590
 591 `--append` `<boolean>` ::
 592
 593 no description available
 594 +
 595 NOTE: Requires option(s): `privs`
 596
 597 `--privs` `<string>` ::
 598
 599 no description available
 600
 601 *pveum roleadd*
 602
 603 An alias for 'pveum role add'.
 604
 605 *pveum roledel*
 606
 607 An alias for 'pveum role delete'.
 608
 609 *pveum rolemod*
 610
 611 An alias for 'pveum role modify'.
 612
 613 *pveum ticket* `<username>` `[OPTIONS]`
 614
 615 Create or verify authentication ticket.
 616
 617 `<username>`: `<string>` ::
 618
 619 User name
 620
 621 `--new-format` `<boolean>` ('default =' `1`)::
 622
 623 This parameter is now ignored and assumed to be 1.
 624
 625 `--otp` `<string>` ::
 626
 627 One-time password for Two-factor authentication.
 628
 629 `--path` `<string>` ::
 630
 631 Verify ticket, and check if user have access 'privs' on 'path'
 632 +
 633 NOTE: Requires option(s): `privs`
 634
 635 `--privs` `<string>` ::
 636
 637 Verify ticket, and check if user have access 'privs' on 'path'
 638 +
 639 NOTE: Requires option(s): `path`
 640
 641 `--realm` `<string>` ::
 642
 643 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 644
 645 `--tfa-challenge` `<string>` ::
 646
 647 The signed TFA challenge string the user wants to respond to.
 648
 649 *pveum user add* `<userid>` `[OPTIONS]`
 650
 651 Create new user.
 652
 653 `<userid>`: `<string>` ::
 654
 655 Full User ID, in the `name@realm` format.
 656
 657 `--comment` `<string>` ::
 658
 659 no description available
 660
 661 `--email` `<string>` ::
 662
 663 no description available
 664
 665 `--enable` `<boolean>` ('default =' `1`)::
 666
 667 Enable the account (default). You can set this to '0' to disable the account
 668
 669 `--expire` `<integer> (0 - N)` ::
 670
 671 Account expiration date (seconds since epoch). '0' means no expiration date.
 672
 673 `--firstname` `<string>` ::
 674
 675 no description available
 676
 677 `--groups` `<string>` ::
 678
 679 no description available
 680
 681 `--keys` `<string>` ::
 682
 683 Keys for two factor auth (yubico).
 684
 685 `--lastname` `<string>` ::
 686
 687 no description available
 688
 689 `--password` `<string>` ::
 690
 691 Initial password.
 692
 693 *pveum user delete* `<userid>`
 694
 695 Delete user.
 696
 697 `<userid>`: `<string>` ::
 698
 699 Full User ID, in the `name@realm` format.
 700
 701 *pveum user list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 702
 703 User index.
 704
 705 `--enabled` `<boolean>` ::
 706
 707 Optional filter for enable property.
 708
 709 `--full` `<boolean>` ('default =' `0`)::
 710
 711 Include group and token information.
 712
 713 *pveum user modify* `<userid>` `[OPTIONS]`
 714
 715 Update user configuration.
 716
 717 `<userid>`: `<string>` ::
 718
 719 Full User ID, in the `name@realm` format.
 720
 721 `--append` `<boolean>` ::
 722
 723 no description available
 724 +
 725 NOTE: Requires option(s): `groups`
 726
 727 `--comment` `<string>` ::
 728
 729 no description available
 730
 731 `--email` `<string>` ::
 732
 733 no description available
 734
 735 `--enable` `<boolean>` ('default =' `1`)::
 736
 737 Enable the account (default). You can set this to '0' to disable the account
 738
 739 `--expire` `<integer> (0 - N)` ::
 740
 741 Account expiration date (seconds since epoch). '0' means no expiration date.
 742
 743 `--firstname` `<string>` ::
 744
 745 no description available
 746
 747 `--groups` `<string>` ::
 748
 749 no description available
 750
 751 `--keys` `<string>` ::
 752
 753 Keys for two factor auth (yubico).
 754
 755 `--lastname` `<string>` ::
 756
 757 no description available
 758
 759 *pveum user permissions* `[<userid>]` `[OPTIONS]` `[FORMAT_OPTIONS]`
 760
 761 Retrieve effective permissions of given user/token.
 762
 763 `<userid>`: `(?^:^(?^:[^\s:/]+)\@(?^:[A-Za-z][A-Za-z0-9\.\-_]+)(?:!(?^:[A-Za-z][A-Za-z0-9\.\-_]+))?$)` ::
 764
 765 User ID or full API token ID
 766
 767 `--path` `<string>` ::
 768
 769 Only dump this specific path, not the whole tree.
 770
 771 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 772
 773 Delete TFA entries from a user.
 774
 775 `<userid>`: `<string>` ::
 776
 777 Full User ID, in the `name@realm` format.
 778
 779 `--id` `<string>` ::
 780
 781 The TFA ID, if none provided, all TFA entries will be deleted.
 782
 783 *pveum user tfa list* `[<userid>]`
 784
 785 List TFA entries.
 786
 787 `<userid>`: `<string>` ::
 788
 789 Full User ID, in the `name@realm` format.
 790
 791 *pveum user tfa unlock* `<userid>`
 792
 793 Unlock a user's TFA authentication.
 794
 795 `<userid>`: `<string>` ::
 796
 797 Full User ID, in the `name@realm` format.
 798
 799 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 800
 801 Generate a new API token for a specific user. NOTE: returns API token
 802 value, which needs to be stored as it cannot be retrieved afterwards!
 803
 804 `<userid>`: `<string>` ::
 805
 806 Full User ID, in the `name@realm` format.
 807
 808 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 809
 810 User-specific token identifier.
 811
 812 `--comment` `<string>` ::
 813
 814 no description available
 815
 816 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 817
 818 API token expiration date (seconds since epoch). '0' means no expiration date.
 819
 820 `--privsep` `<boolean>` ('default =' `1`)::
 821
 822 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 823
 824 *pveum user token list* `<userid>` `[FORMAT_OPTIONS]`
 825
 826 Get user API tokens.
 827
 828 `<userid>`: `<string>` ::
 829
 830 Full User ID, in the `name@realm` format.
 831
 832 *pveum user token modify* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 833
 834 Update API token for a specific user.
 835
 836 `<userid>`: `<string>` ::
 837
 838 Full User ID, in the `name@realm` format.
 839
 840 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 841
 842 User-specific token identifier.
 843
 844 `--comment` `<string>` ::
 845
 846 no description available
 847
 848 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 849
 850 API token expiration date (seconds since epoch). '0' means no expiration date.
 851
 852 `--privsep` `<boolean>` ('default =' `1`)::
 853
 854 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 855
 856 *pveum user token permissions* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 857
 858 Retrieve effective permissions of given token.
 859
 860 `<userid>`: `<string>` ::
 861
 862 Full User ID, in the `name@realm` format.
 863
 864 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 865
 866 User-specific token identifier.
 867
 868 `--path` `<string>` ::
 869
 870 Only dump this specific path, not the whole tree.
 871
 872 *pveum user token remove* `<userid> <tokenid>` `[FORMAT_OPTIONS]`
 873
 874 Remove API token for a specific user.
 875
 876 `<userid>`: `<string>` ::
 877
 878 Full User ID, in the `name@realm` format.
 879
 880 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 881
 882 User-specific token identifier.
 883
 884 *pveum useradd*
 885
 886 An alias for 'pveum user add'.
 887
 888 *pveum userdel*
 889
 890 An alias for 'pveum user delete'.
 891
 892 *pveum usermod*
 893
 894 An alias for 'pveum user modify'.
 895
 896