[[chapter_user_management]]
+
+[[user_mgmt]]
+
ifdef::manvolnum[]
pveum(1)
========
protocol. It allows clients to verify the identity of the user, based on
authentication performed by an external authorization server.
+[[user-realms-pam]]
Linux PAM Standard Authentication
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
authentication realm.
+[[user-realms-pve]]
{pve} Authentication Server
~~~~~~~~~~~~~~~~~~~~~~~~~~~
required to set a password for this type of user upon creation.
+[[user-realms-ldap]]
LDAP
~~~~
be carried out automatically with <<pveum_ldap_sync, syncing>>.
+[[user-realms-ad]]
Microsoft Active Directory (AD)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
`/etc/pve/user.cfg`.
+Attributes to Properties
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+If the sync response includes user attributes, they will be synced into the
+matching user property in the `user.cfg`. For example: `firstname` or
+`lastname`.
+
+If the names of the attributes are not matching the {pve} properties, you can
+set a custom field-to-field map in the config by using the `sync_attributes`
+option.
+
+How such properties are handled if anything vanishes can be controlled via the
+sync options, see below.
+
Sync Configuration
^^^^^^^^^^^^^^^^^^
down the scope of a sync. Information on available LDAP filter types and their
usage can be found at https://ldap.com/ldap-filters/[ldap.com].
-
[[pveum_ldap_sync_options]]
Sync Options
^^^^^^^^^^^^
* `Enable new` (`enable-new`): If set, the newly synced users are enabled and
can log in. The default is `true`.
-* `Full` (`full`): If set, the sync uses the LDAP directory as a source of
- truth, overwriting information set manually in the `user.cfg` and deleting
- users and groups which are not present in the LDAP directory. If not set, only
- new data is written to the configuration, and no stale users are deleted.
+* `Remove Vanished` (`remove-vanished`): This is a list of options which, when
+ activated, determine if they are removed when they are not returned from
+ the sync response. The options are:
+
+ - `ACL` (`acl)`: Remove ACLs of users and groups which were not returned
+ returned in the sync response. This most often makes sense together with
+ `Entry`.
-* `Purge ACLs` (`purge`): If set, sync removes all corresponding ACLs when
- removing users and groups. This is only useful with the option `full`.
+ - `Entry` (`entry`): Removes entries (i.e. users and groups) when they are
+ not returned in the sync response.
+
+ - `Properties` (`properties`): Removes properties of entries where the user
+ in the sync response did not contain those attributes. This includes
+ all properties, even those never set by a sync. Exceptions are tokens
+ and the enable flag, these will be retained even with this option enabled.
* `Preview` (`dry-run`): No data is written to the config. This is useful if you
want to see which users and groups would get synced to the `user.cfg`.
+[[pveum_ldap_reserved_characters]]
+Reserved characters
+^^^^^^^^^^^^^^^^^^^
+
+Certain characters are reserved (see https://www.ietf.org/rfc/rfc2253.txt[RFC2253]) and cannot be
+easily used in attribute values in DNs without being escaped properly.
+
+Following characters need escaping:
+
+* Space ( )
+* Comma (`,`)
+* Plus sign (`+`)
+* Double quote (`"`)
+* Forward slashes (`/`)
+* Angle brackets (`<>`)
+* Semicolon (`;`)
+* Equals sign (`=`)
+
+To use such characters in DNs, surround the attribute value in double quotes.
+For example, to bind with a user with the CN (Common Name) `Example, User`, use
+`CN="Example, User",OU=people,DC=example,DC=com` as value for `bind_dn`.
+
+This applies to the `base_dn`, `bind_dn`, and `group_dn` attributes.
+
+NOTE: Users with colons and forward slashes cannot be synced since these are
+reserved characters in usernames.
[[pveum_openid]]
OpenID Connect
your information:
----
-pveum realm add myrealm2 --type openid --issuer-url https://your.server:8080/auth/realms/your-realm --client-id XXX --username-claim username
+pveum realm add myrealm2 --type openid --issuer-url https://your.server:8080/realms/your-realm --client-id XXX --username-claim username
----
Using `--username-claim username` enables simple usernames on the
This is done via `/etc/pve/datacenter.cfg`. For instance:
----
-webauthn:
-rp=mypve.example.com,origin=https://mypve.example.com:8006,id=mypve.example.com
+webauthn: rp=mypve.example.com,origin=https://mypve.example.com:8006,id=mypve.example.com
----
[[pveum_configure_u2f]]
* `Sys.Syslog`: view syslog
* `Sys.Audit`: view node status/config, Corosync cluster config, and HA config
* `Sys.Modify`: create/modify/remove node network parameters
+* `Sys.Incoming`: allow incoming data streams from other clusters (experimental)
* `Group.Allocate`: create/modify/remove groups
* `Pool.Allocate`: create/modify/remove a pool
* `Pool.Audit`: view a pool
* `VM.Config.Network`: add/modify/remove network devices
* `VM.Config.HWType`: modify emulated hardware types
* `VM.Config.Options`: modify any other VM configuration
+* `VM.Config.Cloudinit`: modify Cloud-init parameters
* `VM.Snapshot`: create/delete VM snapshots
Storage related privileges::
`Permissions.Modify` privilege or,
depending on the path, the following privileges as a possible substitute:
+
-* `/storage/...`: additionally requires 'Datastore.Allocate`
-* `/vms/...`: additionally requires 'VM.Allocate`
-* `/pool/...`: additionally requires 'Pool.Allocate`
+* `/storage/...`: requires 'Datastore.Allocate`
+* `/vms/...`: requires 'VM.Allocate`
+* `/pool/...`: requires 'Pool.Allocate`
+
If the path is empty, `Permission.Modify` on `/access` is required.
projects / pve-docs.git / blobdiff