pveum.1-synopsis.adoc

   1 *pveum* `<COMMAND> [ARGS] [OPTIONS]`
   2
   3 *pveum acl delete* `<path> --roles <string>` `[OPTIONS]`
   4
   5 Update Access Control List (add or remove permissions).
   6
   7 `<path>`: `<string>` ::
   8
   9 Access control path
  10
  11 `--groups` `<string>` ::
  12
  13 List of groups.
  14
  15 `--propagate` `<boolean>` ('default =' `1`)::
  16
  17 Allow to propagate (inherit) permissions.
  18
  19 `--roles` `<string>` ::
  20
  21 List of roles.
  22
  23 `--tokens` `<string>` ::
  24
  25 List of API tokens.
  26
  27 `--users` `<string>` ::
  28
  29 List of users.
  30
  31 *pveum acl list* `[FORMAT_OPTIONS]`
  32
  33 Get Access Control List (ACLs).
  34
  35 *pveum acl modify* `<path> --roles <string>` `[OPTIONS]`
  36
  37 Update Access Control List (add or remove permissions).
  38
  39 `<path>`: `<string>` ::
  40
  41 Access control path
  42
  43 `--groups` `<string>` ::
  44
  45 List of groups.
  46
  47 `--propagate` `<boolean>` ('default =' `1`)::
  48
  49 Allow to propagate (inherit) permissions.
  50
  51 `--roles` `<string>` ::
  52
  53 List of roles.
  54
  55 `--tokens` `<string>` ::
  56
  57 List of API tokens.
  58
  59 `--users` `<string>` ::
  60
  61 List of users.
  62
  63 *pveum acldel*
  64
  65 An alias for 'pveum acl delete'.
  66
  67 *pveum aclmod*
  68
  69 An alias for 'pveum acl modify'.
  70
  71 *pveum group add* `<groupid>` `[OPTIONS]`
  72
  73 Create new group.
  74
  75 `<groupid>`: `<string>` ::
  76
  77 no description available
  78
  79 `--comment` `<string>` ::
  80
  81 no description available
  82
  83 *pveum group delete* `<groupid>`
  84
  85 Delete group.
  86
  87 `<groupid>`: `<string>` ::
  88
  89 no description available
  90
  91 *pveum group list* `[FORMAT_OPTIONS]`
  92
  93 Group index.
  94
  95 *pveum group modify* `<groupid>` `[OPTIONS]`
  96
  97 Update group data.
  98
  99 `<groupid>`: `<string>` ::
 100
 101 no description available
 102
 103 `--comment` `<string>` ::
 104
 105 no description available
 106
 107 *pveum groupadd*
 108
 109 An alias for 'pveum group add'.
 110
 111 *pveum groupdel*
 112
 113 An alias for 'pveum group delete'.
 114
 115 *pveum groupmod*
 116
 117 An alias for 'pveum group modify'.
 118
 119 *pveum help* `[OPTIONS]`
 120
 121 Get help about specified command.
 122
 123 `--extra-args` `<array>` ::
 124
 125 Shows help for a specific command
 126
 127 `--verbose` `<boolean>` ::
 128
 129 Verbose output format.
 130
 131 *pveum passwd* `<userid>` `[OPTIONS]`
 132
 133 Change user password.
 134
 135 `<userid>`: `<string>` ::
 136
 137 Full User ID, in the `name@realm` format.
 138
 139 `--confirmation-password` `<string>` ::
 140
 141 The current password of the user performing the change.
 142
 143 *pveum pool add* `<poolid>` `[OPTIONS]`
 144
 145 Create new pool.
 146
 147 `<poolid>`: `<string>` ::
 148
 149 no description available
 150
 151 `--comment` `<string>` ::
 152
 153 no description available
 154
 155 *pveum pool delete* `<poolid>`
 156
 157 Delete pool.
 158
 159 `<poolid>`: `<string>` ::
 160
 161 no description available
 162
 163 *pveum pool list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 164
 165 List pools or get pool configuration.
 166
 167 `--poolid` `<string>` ::
 168
 169 no description available
 170
 171 `--type` `<lxc | qemu | storage>` ::
 172
 173 no description available
 174 +
 175 NOTE: Requires option(s): `poolid`
 176
 177 *pveum pool modify* `<poolid>` `[OPTIONS]`
 178
 179 Update pool.
 180
 181 `<poolid>`: `<string>` ::
 182
 183 no description available
 184
 185 `--allow-move` `<boolean>` ('default =' `0`)::
 186
 187 Allow adding a guest even if already in another pool. The guest will be removed from its current pool and added to this one.
 188
 189 `--comment` `<string>` ::
 190
 191 no description available
 192
 193 `--delete` `<boolean>` ('default =' `0`)::
 194
 195 Remove the passed VMIDs and/or storage IDs instead of adding them.
 196
 197 `--storage` `<string>` ::
 198
 199 List of storage IDs to add or remove from this pool.
 200
 201 `--vms` `<string>` ::
 202
 203 List of guest VMIDs to add or remove from this pool.
 204
 205 *pveum realm add* `<realm> --type <string>` `[OPTIONS]`
 206
 207 Add an authentication server.
 208
 209 `<realm>`: `<string>` ::
 210
 211 Authentication domain ID
 212
 213 `--acr-values` `^[^\x00-\x1F\x7F <>#"]*$` ::
 214
 215 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 216
 217 `--autocreate` `<boolean>` ('default =' `0`)::
 218
 219 Automatically create users if they do not exist.
 220
 221 `--base_dn` `<string>` ::
 222
 223 LDAP base domain name
 224
 225 `--bind_dn` `<string>` ::
 226
 227 LDAP bind domain name
 228
 229 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 230
 231 Path to the CA certificate store
 232
 233 `--case-sensitive` `<boolean>` ('default =' `1`)::
 234
 235 username is case-sensitive
 236
 237 `--cert` `<string>` ::
 238
 239 Path to the client certificate
 240
 241 `--certkey` `<string>` ::
 242
 243 Path to the client certificate key
 244
 245 `--check-connection` `<boolean>` ('default =' `0`)::
 246
 247 Check bind connection to the server.
 248
 249 `--client-id` `<string>` ::
 250
 251 OpenID Client ID
 252
 253 `--client-key` `<string>` ::
 254
 255 OpenID Client Key
 256
 257 `--comment` `<string>` ::
 258
 259 Description.
 260
 261 `--default` `<boolean>` ::
 262
 263 Use this as default realm
 264
 265 `--domain` `\S+` ::
 266
 267 AD domain name
 268
 269 `--filter` `<string>` ::
 270
 271 LDAP filter for user sync.
 272
 273 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 274
 275 The objectclasses for groups.
 276
 277 `--group_dn` `<string>` ::
 278
 279 LDAP base domain name for group sync. If not set, the base_dn will be used.
 280
 281 `--group_filter` `<string>` ::
 282
 283 LDAP filter for group sync.
 284
 285 `--group_name_attr` `<string>` ::
 286
 287 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 288
 289 `--issuer-url` `<string>` ::
 290
 291 OpenID Issuer Url
 292
 293 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 294
 295 LDAP protocol mode.
 296
 297 `--password` `<string>` ::
 298
 299 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 300
 301 `--port` `<integer> (1 - 65535)` ::
 302
 303 Server port.
 304
 305 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 306
 307 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 308
 309 `--scopes` `<string>` ('default =' `email profile`)::
 310
 311 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 312
 313 `--secure` `<boolean>` ::
 314
 315 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 316
 317 `--server1` `<string>` ::
 318
 319 Server IP address (or DNS name)
 320
 321 `--server2` `<string>` ::
 322
 323 Fallback Server IP address (or DNS name)
 324
 325 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 326
 327 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 328
 329 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=([acl];[properties];[entry])|none] [,scope=<users|groups|both>]` ::
 330
 331 The default options for behavior of synchronizations.
 332
 333 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 334
 335 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 336
 337 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 338
 339 Use Two-factor authentication.
 340
 341 `--type` `<ad | ldap | openid | pam | pve>` ::
 342
 343 Realm type.
 344
 345 `--user_attr` `\S{2,}` ::
 346
 347 LDAP user attribute name
 348
 349 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 350
 351 The objectclasses for users.
 352
 353 `--username-claim` `<string>` ::
 354
 355 OpenID claim used to generate the unique username.
 356
 357 `--verify` `<boolean>` ('default =' `0`)::
 358
 359 Verify the server's SSL certificate
 360
 361 *pveum realm delete* `<realm>`
 362
 363 Delete an authentication server.
 364
 365 `<realm>`: `<string>` ::
 366
 367 Authentication domain ID
 368
 369 *pveum realm list* `[FORMAT_OPTIONS]`
 370
 371 Authentication domain index.
 372
 373 *pveum realm modify* `<realm>` `[OPTIONS]`
 374
 375 Update authentication server settings.
 376
 377 `<realm>`: `<string>` ::
 378
 379 Authentication domain ID
 380
 381 `--acr-values` `^[^\x00-\x1F\x7F <>#"]*$` ::
 382
 383 Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
 384
 385 `--autocreate` `<boolean>` ('default =' `0`)::
 386
 387 Automatically create users if they do not exist.
 388
 389 `--base_dn` `<string>` ::
 390
 391 LDAP base domain name
 392
 393 `--bind_dn` `<string>` ::
 394
 395 LDAP bind domain name
 396
 397 `--capath` `<string>` ('default =' `/etc/ssl/certs`)::
 398
 399 Path to the CA certificate store
 400
 401 `--case-sensitive` `<boolean>` ('default =' `1`)::
 402
 403 username is case-sensitive
 404
 405 `--cert` `<string>` ::
 406
 407 Path to the client certificate
 408
 409 `--certkey` `<string>` ::
 410
 411 Path to the client certificate key
 412
 413 `--check-connection` `<boolean>` ('default =' `0`)::
 414
 415 Check bind connection to the server.
 416
 417 `--client-id` `<string>` ::
 418
 419 OpenID Client ID
 420
 421 `--client-key` `<string>` ::
 422
 423 OpenID Client Key
 424
 425 `--comment` `<string>` ::
 426
 427 Description.
 428
 429 `--default` `<boolean>` ::
 430
 431 Use this as default realm
 432
 433 `--delete` `<string>` ::
 434
 435 A list of settings you want to delete.
 436
 437 `--digest` `<string>` ::
 438
 439 Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications.
 440
 441 `--domain` `\S+` ::
 442
 443 AD domain name
 444
 445 `--filter` `<string>` ::
 446
 447 LDAP filter for user sync.
 448
 449 `--group_classes` `<string>` ('default =' `groupOfNames, group, univentionGroup, ipausergroup`)::
 450
 451 The objectclasses for groups.
 452
 453 `--group_dn` `<string>` ::
 454
 455 LDAP base domain name for group sync. If not set, the base_dn will be used.
 456
 457 `--group_filter` `<string>` ::
 458
 459 LDAP filter for group sync.
 460
 461 `--group_name_attr` `<string>` ::
 462
 463 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 464
 465 `--issuer-url` `<string>` ::
 466
 467 OpenID Issuer Url
 468
 469 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 470
 471 LDAP protocol mode.
 472
 473 `--password` `<string>` ::
 474
 475 LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 476
 477 `--port` `<integer> (1 - 65535)` ::
 478
 479 Server port.
 480
 481 `--prompt` `(?:none|login|consent|select_account|\S+)` ::
 482
 483 Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
 484
 485 `--scopes` `<string>` ('default =' `email profile`)::
 486
 487 Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
 488
 489 `--secure` `<boolean>` ::
 490
 491 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
 492
 493 `--server1` `<string>` ::
 494
 495 Server IP address (or DNS name)
 496
 497 `--server2` `<string>` ::
 498
 499 Fallback Server IP address (or DNS name)
 500
 501 `--sslversion` `<tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3>` ::
 502
 503 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 504
 505 `--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=([acl];[properties];[entry])|none] [,scope=<users|groups|both>]` ::
 506
 507 The default options for behavior of synchronizations.
 508
 509 `--sync_attributes` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 510
 511 Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write  'email=mail'. By default, each PVE user field is represented  by an LDAP attribute of the same name.
 512
 513 `--tfa` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
 514
 515 Use Two-factor authentication.
 516
 517 `--user_attr` `\S{2,}` ::
 518
 519 LDAP user attribute name
 520
 521 `--user_classes` `<string>` ('default =' `inetorgperson, posixaccount, person, user`)::
 522
 523 The objectclasses for users.
 524
 525 `--verify` `<boolean>` ('default =' `0`)::
 526
 527 Verify the server's SSL certificate
 528
 529 *pveum realm sync* `<realm>` `[OPTIONS]`
 530
 531 Syncs users and/or groups from the configured LDAP to user.cfg. NOTE:
 532 Synced groups will have the name 'name-$realm', so make sure those groups
 533 do not exist to prevent overwriting.
 534
 535 `<realm>`: `<string>` ::
 536
 537 Authentication domain ID
 538
 539 `--dry-run` `<boolean>` ('default =' `0`)::
 540
 541 If set, does not write anything.
 542
 543 `--enable-new` `<boolean>` ('default =' `1`)::
 544
 545 Enable newly synced users immediately.
 546
 547 `--full` `<boolean>` ::
 548
 549 DEPRECATED: use 'remove-vanished' instead. If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync and removing all locally modified properties of synced users. If not set, only syncs information which is present in the synced data, and does not delete or modify anything else.
 550
 551 `--purge` `<boolean>` ::
 552
 553 DEPRECATED: use 'remove-vanished' instead. Remove ACLs for users or groups which were removed from the config during a sync.
 554
 555 `--remove-vanished` `([acl];[properties];[entry])|none` ('default =' `none`)::
 556
 557 A semicolon-seperated list of things to remove when they or the user vanishes during a sync. The following values are possible: 'entry' removes the user/group when not returned from the sync. 'properties' removes the set properties on existing user/group that do not appear in the source (even custom ones). 'acl' removes acls when the user/group is not returned from the sync. Instead of a list it also can be 'none' (the default).
 558
 559 `--scope` `<both | groups | users>` ::
 560
 561 Select what to sync.
 562
 563 *pveum role add* `<roleid>` `[OPTIONS]`
 564
 565 Create new role.
 566
 567 `<roleid>`: `<string>` ::
 568
 569 no description available
 570
 571 `--privs` `<string>` ::
 572
 573 no description available
 574
 575 *pveum role delete* `<roleid>`
 576
 577 Delete role.
 578
 579 `<roleid>`: `<string>` ::
 580
 581 no description available
 582
 583 *pveum role list* `[FORMAT_OPTIONS]`
 584
 585 Role index.
 586
 587 *pveum role modify* `<roleid>` `[OPTIONS]`
 588
 589 Update an existing role.
 590
 591 `<roleid>`: `<string>` ::
 592
 593 no description available
 594
 595 `--append` `<boolean>` ::
 596
 597 no description available
 598 +
 599 NOTE: Requires option(s): `privs`
 600
 601 `--privs` `<string>` ::
 602
 603 no description available
 604
 605 *pveum roleadd*
 606
 607 An alias for 'pveum role add'.
 608
 609 *pveum roledel*
 610
 611 An alias for 'pveum role delete'.
 612
 613 *pveum rolemod*
 614
 615 An alias for 'pveum role modify'.
 616
 617 *pveum ticket* `<username>` `[OPTIONS]`
 618
 619 Create or verify authentication ticket.
 620
 621 `<username>`: `<string>` ::
 622
 623 User name
 624
 625 `--new-format` `<boolean>` ('default =' `1`)::
 626
 627 This parameter is now ignored and assumed to be 1.
 628
 629 `--otp` `<string>` ::
 630
 631 One-time password for Two-factor authentication.
 632
 633 `--path` `<string>` ::
 634
 635 Verify ticket, and check if user have access 'privs' on 'path'
 636 +
 637 NOTE: Requires option(s): `privs`
 638
 639 `--privs` `<string>` ::
 640
 641 Verify ticket, and check if user have access 'privs' on 'path'
 642 +
 643 NOTE: Requires option(s): `path`
 644
 645 `--realm` `<string>` ::
 646
 647 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 648
 649 `--tfa-challenge` `<string>` ::
 650
 651 The signed TFA challenge string the user wants to respond to.
 652
 653 *pveum user add* `<userid>` `[OPTIONS]`
 654
 655 Create new user.
 656
 657 `<userid>`: `<string>` ::
 658
 659 Full User ID, in the `name@realm` format.
 660
 661 `--comment` `<string>` ::
 662
 663 no description available
 664
 665 `--email` `<string>` ::
 666
 667 no description available
 668
 669 `--enable` `<boolean>` ('default =' `1`)::
 670
 671 Enable the account (default). You can set this to '0' to disable the account
 672
 673 `--expire` `<integer> (0 - N)` ::
 674
 675 Account expiration date (seconds since epoch). '0' means no expiration date.
 676
 677 `--firstname` `<string>` ::
 678
 679 no description available
 680
 681 `--groups` `<string>` ::
 682
 683 no description available
 684
 685 `--keys` `[0-9a-zA-Z!=]{0,4096}` ::
 686
 687 Keys for two factor auth (yubico).
 688
 689 `--lastname` `<string>` ::
 690
 691 no description available
 692
 693 `--password` `<string>` ::
 694
 695 Initial password.
 696
 697 *pveum user delete* `<userid>`
 698
 699 Delete user.
 700
 701 `<userid>`: `<string>` ::
 702
 703 Full User ID, in the `name@realm` format.
 704
 705 *pveum user list* `[OPTIONS]` `[FORMAT_OPTIONS]`
 706
 707 User index.
 708
 709 `--enabled` `<boolean>` ::
 710
 711 Optional filter for enable property.
 712
 713 `--full` `<boolean>` ('default =' `0`)::
 714
 715 Include group and token information.
 716
 717 *pveum user modify* `<userid>` `[OPTIONS]`
 718
 719 Update user configuration.
 720
 721 `<userid>`: `<string>` ::
 722
 723 Full User ID, in the `name@realm` format.
 724
 725 `--append` `<boolean>` ::
 726
 727 no description available
 728 +
 729 NOTE: Requires option(s): `groups`
 730
 731 `--comment` `<string>` ::
 732
 733 no description available
 734
 735 `--email` `<string>` ::
 736
 737 no description available
 738
 739 `--enable` `<boolean>` ('default =' `1`)::
 740
 741 Enable the account (default). You can set this to '0' to disable the account
 742
 743 `--expire` `<integer> (0 - N)` ::
 744
 745 Account expiration date (seconds since epoch). '0' means no expiration date.
 746
 747 `--firstname` `<string>` ::
 748
 749 no description available
 750
 751 `--groups` `<string>` ::
 752
 753 no description available
 754
 755 `--keys` `[0-9a-zA-Z!=]{0,4096}` ::
 756
 757 Keys for two factor auth (yubico).
 758
 759 `--lastname` `<string>` ::
 760
 761 no description available
 762
 763 *pveum user permissions* `[<userid>]` `[OPTIONS]` `[FORMAT_OPTIONS]`
 764
 765 Retrieve effective permissions of given user/token.
 766
 767 `<userid>`: `(?^:^(?^:[^\s:/]+)\@(?^:[A-Za-z][A-Za-z0-9\.\-_]+)(?:!(?^:[A-Za-z][A-Za-z0-9\.\-_]+))?$)` ::
 768
 769 User ID or full API token ID
 770
 771 `--path` `<string>` ::
 772
 773 Only dump this specific path, not the whole tree.
 774
 775 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 776
 777 Delete TFA entries from a user.
 778
 779 `<userid>`: `<string>` ::
 780
 781 Full User ID, in the `name@realm` format.
 782
 783 `--id` `<string>` ::
 784
 785 The TFA ID, if none provided, all TFA entries will be deleted.
 786
 787 *pveum user tfa list* `[<userid>]`
 788
 789 List TFA entries.
 790
 791 `<userid>`: `<string>` ::
 792
 793 Full User ID, in the `name@realm` format.
 794
 795 *pveum user tfa unlock* `<userid>`
 796
 797 Unlock a user's TFA authentication.
 798
 799 `<userid>`: `<string>` ::
 800
 801 Full User ID, in the `name@realm` format.
 802
 803 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 804
 805 Generate a new API token for a specific user. NOTE: returns API token
 806 value, which needs to be stored as it cannot be retrieved afterwards!
 807
 808 `<userid>`: `<string>` ::
 809
 810 Full User ID, in the `name@realm` format.
 811
 812 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 813
 814 User-specific token identifier.
 815
 816 `--comment` `<string>` ::
 817
 818 no description available
 819
 820 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 821
 822 API token expiration date (seconds since epoch). '0' means no expiration date.
 823
 824 `--privsep` `<boolean>` ('default =' `1`)::
 825
 826 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 827
 828 *pveum user token list* `<userid>` `[FORMAT_OPTIONS]`
 829
 830 Get user API tokens.
 831
 832 `<userid>`: `<string>` ::
 833
 834 Full User ID, in the `name@realm` format.
 835
 836 *pveum user token modify* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 837
 838 Update API token for a specific user.
 839
 840 `<userid>`: `<string>` ::
 841
 842 Full User ID, in the `name@realm` format.
 843
 844 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 845
 846 User-specific token identifier.
 847
 848 `--comment` `<string>` ::
 849
 850 no description available
 851
 852 `--expire` `<integer> (0 - N)` ('default =' `same as user`)::
 853
 854 API token expiration date (seconds since epoch). '0' means no expiration date.
 855
 856 `--privsep` `<boolean>` ('default =' `1`)::
 857
 858 Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.
 859
 860 *pveum user token permissions* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`
 861
 862 Retrieve effective permissions of given token.
 863
 864 `<userid>`: `<string>` ::
 865
 866 Full User ID, in the `name@realm` format.
 867
 868 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 869
 870 User-specific token identifier.
 871
 872 `--path` `<string>` ::
 873
 874 Only dump this specific path, not the whole tree.
 875
 876 *pveum user token remove* `<userid> <tokenid>` `[FORMAT_OPTIONS]`
 877
 878 Remove API token for a specific user.
 879
 880 `<userid>`: `<string>` ::
 881
 882 Full User ID, in the `name@realm` format.
 883
 884 `<tokenid>`: `(?^:[A-Za-z][A-Za-z0-9\.\-_]+)` ::
 885
 886 User-specific token identifier.
 887
 888 *pveum useradd*
 889
 890 An alias for 'pveum user add'.
 891
 892 *pveum userdel*
 893
 894 An alias for 'pveum user delete'.
 895
 896 *pveum usermod*
 897
 898 An alias for 'pveum user modify'.
 899
 900