X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=pveum.adoc;h=6c358333b0b1b4753fa438c0ab4359503b354276;hb=3cae5b16cba0d0eef547cb082c18c40ac9ae33a6;hp=9350be9c95900c7f1982f5ce6513ce8b60948a8f;hpb=404a158e1b79f205df7f5cf1827dde32ef9a8ea2;p=pve-docs.git

diff --git a/pveum.adoc b/pveum.adoc
index 9350be9..6c35833 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -1,7 +1,7 @@
+[[chapter_user_management]]
 ifdef::manvolnum[]
-PVE(1)
-======
-include::attributes.txt[]
+pveum(1)
+========
 :pve-toplevel:
 
 NAME
@@ -19,16 +19,11 @@ include::pveum.1-synopsis.adoc[]
 DESCRIPTION
 -----------
 endif::manvolnum[]
-
 ifndef::manvolnum[]
 User Management
 ===============
-include::attributes.txt[]
-endif::manvolnum[]
-
-ifdef::wiki[]
 :pve-toplevel:
-endif::wiki[]
+endif::manvolnum[]
 
 // Copied from pve wiki: Revision as of 16:10, 27 October 2015
 
@@ -40,12 +35,13 @@ By using the role based user- and permission management for all
 objects (VMs, storages, nodes, etc.) granular access can be defined.
 
 
+[[pveum_users]]
 Users
 -----
 
 {pve} stores user attributes in `/etc/pve/user.cfg`.
 Passwords are not stored here, users are instead associated with
-<<authentication-realms,authentication realms>> described below.
+<<pveum_authentication_realms,authentication realms>> described below.
 Therefore a user is internally often identified by its name and
 realm in the form `<userid>@<realm>`.
 
@@ -70,6 +66,7 @@ still be changed and system mails will be sent to the email address
 assigned to this user.
 
 
+[[pveum_groups]]
 Groups
 ~~~~~~
 
@@ -79,7 +76,7 @@ to groups instead of using individual users. That way you will get a
 much shorter access control list which is easier to handle.
 
 
-[[authentication-realms]]
+[[pveum_authentication_realms]]
 Authentication Realms
 ---------------------
 
@@ -188,6 +185,7 @@ https://developers.yubico.com/Software_Projects/YubiKey_OTP/YubiCloud_Validation
 host your own verification server].
 
 
+[[pveum_permission_management]]
 Permission Management
 ---------------------
 
@@ -203,6 +201,7 @@ role)', with the role containing a set of allowed actions, and the path
 representing the target of these actions.
 
 
+[[pveum_roles]]
 Roles
 ~~~~~
 
@@ -250,7 +249,7 @@ Node / System related privileges::
 * `Sys.PowerMgmt`: Node power management (start, stop, reset, shutdown, ...)
 * `Sys.Console`: console access to Node
 * `Sys.Syslog`: view Syslog
-* `Sys.Audit`: view node status/config
+* `Sys.Audit`: view node status/config, Corosync cluster config and HA config
 * `Sys.Modify`: create/remove/modify node network parameters
 * `Group.Allocate`: create/remove/modify groups
 * `Pool.Allocate`: create/remove/modify a pool
@@ -294,7 +293,7 @@ We use file system like paths to address these objects. These paths form a
 natural tree, and permissions of higher levels (shorter path) can
 optionally be propagated down within this hierarchy.
 
-[[templated-paths]]
+[[pveum_templated_paths]]
 Paths can be templated. When an API call requires permissions on a
 templated path, the path may contain references to parameters of the API
 call. These references are specified in curly braces. Some parameters are
@@ -309,7 +308,7 @@ Some examples are:
 * `/vms`: Covers all VMs
 * `/vms/{vmid}`: Access to specific VMs
 * `/storage/{storeid}`: Access to a storages
-* `/pool/{poolname}`: Access to VMs part of a <<resource-pools,pool>
+* `/pool/{poolname}`: Access to VMs part of a <<pveum_pools,pool>>
 * `/access/groups`: Group administration
 * `/access/realms/{realmid}`: Administrative access to realms
 
@@ -326,6 +325,7 @@ by default). We use the following inheritance rules:
 * Permissions replace the ones inherited from an upper level.
 
 
+[[pveum_pools]]
 Pools
 ~~~~~
 
@@ -348,8 +348,9 @@ tree of logic and access-check functions:
 Each(`and`) or any(`or`) further element in the current list has to be true.
 
 `["perm", <path>, [ <privileges>... ], <options>...]`::
-The `path` is a templated parameter (see <<templated-paths,Objects and
-Paths>>). All (or , if the `any` option is used, any) of the listed
+The `path` is a templated parameter (see
+<<pveum_templated_paths,Objects and Paths>>). All (or , if the `any`
+option is used, any) of the listed
 privileges must be allowed on the specified path. If a `require-param`
 option is specified, then its specified parameter is required even if the
 API call's schema otherwise lists it as being optional.
@@ -380,8 +381,9 @@ associated with a realm, since user IDs are passed in the form of
 `<username>@<realm>`.
 
 `["perm-modify", <path>]`::
-The `path` is a templated parameter (see <<templated-paths,Objects and
-Paths>>). The user needs either the `Permissions.Modify` privilege, or,
+The `path` is a templated parameter (see
+<<pveum_templated_paths,Objects and Paths>>). The user needs either the
+`Permissions.Modify` privilege, or,
 depending on the path, the following privileges as a possible substitute:
 +
 * `/storage/...`: additionally requires 'Datastore.Allocate`