fix #3884: Add section for kernel samepage merging

[pve-docs.git] / pveum.1-synopsis.adoc

diff --git a/pveum.1-synopsis.adoc b/pveum.1-synopsis.adoc
index 8cef8338ea1edd607d201b9077dd02482d51ea83..3b38a9f5aede160a00c8df2964452942c86b7bb2 100644 (file)
--- a/pveum.1-synopsis.adoc
+++ b/pveum.1-synopsis.adoc
@@ -192,6 +192,14 @@ Add an authentication server.
 
 Authentication domain ID
 
+`--acr-values` `<string>` ::
+
+Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
+
+`--autocreate` `<boolean>` ('default =' `0`)::
+
+Automatically create users if they do not exist.
+
 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 
 LDAP base domain name
@@ -216,6 +224,14 @@ Path to the client certificate
 
 Path to the client certificate key
 
+`--client-id` `<string>` ::
+
+OpenID Client ID
+
+`--client-key` `<string>` ::
+
+OpenID Client Key
+
 `--comment` `<string>` ::
 
 Description.
@@ -248,6 +264,10 @@ LDAP filter for group sync.
 
 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 
+`--issuer-url` `<string>` ::
+
+OpenID Issuer Url
+
 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 
 LDAP protocol mode.
@@ -260,6 +280,14 @@ LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 
 Server port.
 
+`--prompt` `(?:none|login|consent|select_account|\S+)` ::
+
+Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
+
+`--scopes` `<string>` ('default =' `email profile`)::
+
+Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
+
 `--secure` `<boolean>` ::
 
 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
@@ -288,7 +316,7 @@ Comma separated list of key=value pairs for specifying which LDAP attributes map
 
 Use Two-factor authentication.
 
-`--type` `<ad | ldap | pam | pve>` ::
+`--type` `<ad | ldap | openid | pam | pve>` ::
 
 Realm type.
 
@@ -300,6 +328,10 @@ LDAP user attribute name
 
 The objectclasses for users.
 
+`--username-claim` `<string>` ::
+
+OpenID claim used to generate the unique username.
+
 `--verify` `<boolean>` ('default =' `0`)::
 
 Verify the server's SSL certificate
@@ -324,6 +356,14 @@ Update authentication server settings.
 
 Authentication domain ID
 
+`--acr-values` `<string>` ::
+
+Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
+
+`--autocreate` `<boolean>` ('default =' `0`)::
+
+Automatically create users if they do not exist.
+
 `--base_dn` `\w+=[^,]+(,\s*\w+=[^,]+)*` ::
 
 LDAP base domain name
@@ -348,6 +388,14 @@ Path to the client certificate
 
 Path to the client certificate key
 
+`--client-id` `<string>` ::
+
+OpenID Client ID
+
+`--client-key` `<string>` ::
+
+OpenID Client Key
+
 `--comment` `<string>` ::
 
 Description.
@@ -388,6 +436,10 @@ LDAP filter for group sync.
 
 LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name.
 
+`--issuer-url` `<string>` ::
+
+OpenID Issuer Url
+
 `--mode` `<ldap | ldap+starttls | ldaps>` ('default =' `ldap`)::
 
 LDAP protocol mode.
@@ -400,6 +452,14 @@ LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 
 Server port.
 
+`--prompt` `(?:none|login|consent|select_account|\S+)` ::
+
+Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
+
+`--scopes` `<string>` ('default =' `email profile`)::
+
+Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
+
 `--secure` `<boolean>` ::
 
 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
@@ -532,6 +592,10 @@ Create or verify authentication ticket.
 
 User name
 
+`--new-format` `<boolean>` ('default =' `0`)::
+
+With webauthn the format of half-authenticated tickts changed. New clients should pass 1 here and not worry about the old format. The old format is deprecated and will be retired with PVE-8.0
+
 `--otp` `<string>` ::
 
 One-time password for Two-factor authentication.
@@ -552,6 +616,10 @@ NOTE: Requires option(s): `path`
 
 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 
+`--tfa-challenge` `<string>` ::
+
+The signed TFA challenge string the user wants to respond to.
+
 *pveum user add* `<userid>` `[OPTIONS]`
 
 Create new user.
@@ -676,27 +744,15 @@ Only dump this specific path, not the whole tree.
 
 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 
-Change user u2f authentication.
+Delete TFA entries from a user.
 
 `<userid>`: `<string>` ::
 
 User ID
 
-`--config` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
-
-A TFA configuration. This must currently be of type TOTP of not set at all.
-
-`--key` `<string>` ::
-
-When adding TOTP, the shared secret value.
-
-`--password` `<string>` ::
-
-The current password.
-
-`--response` `<string>` ::
+`--id` `<string>` ::
 
-Either the the response to the current u2f registration challenge, or, when adding TOTP, the currently valid TOTP value.
+The TFA ID, if none provided, all TFA entries will be deleted.
 
 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`