cloud init: use expected disk number in example

[pve-docs.git] / pveum.1-synopsis.adoc

diff --git a/pveum.1-synopsis.adoc b/pveum.1-synopsis.adoc
index b70998c011bc9c91ab4f3030031114a3d16ae845..6c280432ef33ad1671dfb1221adc426d93117374 100644 (file)
--- a/pveum.1-synopsis.adoc
+++ b/pveum.1-synopsis.adoc
@@ -192,6 +192,10 @@ Add an authentication server.
 
 Authentication domain ID
 
+`--acr-values` `<string>` ::
+
+Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
+
 `--autocreate` `<boolean>` ('default =' `0`)::
 
 Automatically create users if they do not exist.
@@ -276,6 +280,14 @@ LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 
 Server port.
 
+`--prompt` `(?:none|login|consent|select_account|\S+)` ::
+
+Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
+
+`--scopes` `<string>` ('default =' `email profile`)::
+
+Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
+
 `--secure` `<boolean>` ::
 
 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
@@ -292,7 +304,7 @@ Fallback Server IP address (or DNS name)
 
 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 
-`--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
+`--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=[acl];[properties];[entry]] [,scope=<users|groups|both>]` ::
 
 The default options for behavior of synchronizations.
 
@@ -316,7 +328,7 @@ LDAP user attribute name
 
 The objectclasses for users.
 
-`--username-claim` `<email | subject | username>` ::
+`--username-claim` `<string>` ::
 
 OpenID claim used to generate the unique username.
 
@@ -344,6 +356,10 @@ Update authentication server settings.
 
 Authentication domain ID
 
+`--acr-values` `<string>` ::
+
+Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
+
 `--autocreate` `<boolean>` ('default =' `0`)::
 
 Automatically create users if they do not exist.
@@ -436,6 +452,14 @@ LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
 
 Server port.
 
+`--prompt` `(?:none|login|consent|select_account|\S+)` ::
+
+Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
+
+`--scopes` `<string>` ('default =' `email profile`)::
+
+Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'.
+
 `--secure` `<boolean>` ::
 
 Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
@@ -452,7 +476,7 @@ Fallback Server IP address (or DNS name)
 
 LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
 
-`--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,scope=<users|groups|both>]` ::
+`--sync-defaults-options` `[enable-new=<1|0>] [,full=<1|0>] [,purge=<1|0>] [,remove-vanished=[acl];[properties];[entry]] [,scope=<users|groups|both>]` ::
 
 The default options for behavior of synchronizations.
 
@@ -496,11 +520,15 @@ Enable newly synced users immediately.
 
 `--full` `<boolean>` ::
 
-If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync. Otherwise only syncs information which is not already present, and does not deletes or modifies anything else.
+DEPRECATED: use 'remove-vanished' instead. If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync and removing all locally modified properties of synced users. If not set, only syncs information which is present in the synced data, and does not delete or modify anything else.
 
 `--purge` `<boolean>` ::
 
-Remove ACLs for users or groups which were removed from the config during a sync.
+DEPRECATED: use 'remove-vanished' instead. Remove ACLs for users or groups which were removed from the config during a sync.
+
+`--remove-vanished` `[acl];[properties];[entry]` ::
+
+A semicolon-seperated list of things to remove when they or the user vanishes during a sync. The following values are possible: 'entry' removes the user/group when not returned from the sync. 'properties' removes the set properties on existing user/group that do not appear in the source (even custom ones). 'acl' removes acls when the user/group is not returned from the sync.
 
 `--scope` `<both | groups | users>` ::
 
@@ -568,6 +596,10 @@ Create or verify authentication ticket.
 
 User name
 
+`--new-format` `<boolean>` ('default =' `0`)::
+
+With webauthn the format of half-authenticated tickts changed. New clients should pass 1 here and not worry about the old format. The old format is deprecated and will be retired with PVE-8.0
+
 `--otp` `<string>` ::
 
 One-time password for Two-factor authentication.
@@ -588,6 +620,10 @@ NOTE: Requires option(s): `path`
 
 You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>@<relam>.
 
+`--tfa-challenge` `<string>` ::
+
+The signed TFA challenge string the user wants to respond to.
+
 *pveum user add* `<userid>` `[OPTIONS]`
 
 Create new user.
@@ -712,27 +748,15 @@ Only dump this specific path, not the whole tree.
 
 *pveum user tfa delete* `<userid>` `[OPTIONS]`
 
-Change user u2f authentication.
+Delete TFA entries from a user.
 
 `<userid>`: `<string>` ::
 
 User ID
 
-`--config` `type=<TFATYPE> [,digits=<COUNT>] [,id=<ID>] [,key=<KEY>] [,step=<SECONDS>] [,url=<URL>]` ::
-
-A TFA configuration. This must currently be of type TOTP of not set at all.
-
-`--key` `<string>` ::
-
-When adding TOTP, the shared secret value.
-
-`--password` `<string>` ::
-
-The current password.
-
-`--response` `<string>` ::
+`--id` `<string>` ::
 
-Either the the response to the current u2f registration challenge, or, when adding TOTP, the currently valid TOTP value.
+The TFA ID, if none provided, all TFA entries will be deleted.
 
 *pveum user token add* `<userid> <tokenid>` `[OPTIONS]` `[FORMAT_OPTIONS]`