X-Git-Url: https://git.proxmox.com/?p=pve-docs.git;a=blobdiff_plain;f=pveum.adoc;h=db196b537389a2631113f11ac268987cf0e8ad2c;hp=c83945e2cd1e6bc20a4db14fcf8ec80e208a9c8a;hb=9d3ff4781355fc72bba568b43a4faf1afe0d4c13;hpb=5f09af76d7282a043be8fa5439349272f506cf02

diff --git a/pveum.adoc b/pveum.adoc
index c83945e..db196b5 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -1,8 +1,7 @@
+[[chapter_user_management]]
 ifdef::manvolnum[]
-PVE({manvolnum})
-================
-include::attributes.txt[]
-
+pveum(1)
+========
 :pve-toplevel:
 
 NAME
@@ -20,16 +19,11 @@ include::pveum.1-synopsis.adoc[]
 DESCRIPTION
 -----------
 endif::manvolnum[]
-
 ifndef::manvolnum[]
 User Management
 ===============
-include::attributes.txt[]
-endif::manvolnum[]
-
-ifdef::wiki[]
 :pve-toplevel:
-endif::wiki[]
+endif::manvolnum[]
 
 // Copied from pve wiki: Revision as of 16:10, 27 October 2015
 
@@ -41,12 +35,13 @@ By using the role based user- and permission management for all
 objects (VMs, storages, nodes, etc.) granular access can be defined.
 
 
+[[pveum_users]]
 Users
 -----
 
 {pve} stores user attributes in `/etc/pve/user.cfg`.
 Passwords are not stored here, users are instead associated with
-<<authentication-realms,authentication realms>> described below.
+<<pveum_authentication_realms,authentication realms>> described below.
 Therefore a user is internally often identified by its name and
 realm in the form `<userid>@<realm>`.
 
@@ -71,6 +66,7 @@ still be changed and system mails will be sent to the email address
 assigned to this user.
 
 
+[[pveum_groups]]
 Groups
 ~~~~~~
 
@@ -80,7 +76,7 @@ to groups instead of using individual users. That way you will get a
 much shorter access control list which is easier to handle.
 
 
-[[authentication-realms]]
+[[pveum_authentication_realms]]
 Authentication Realms
 ---------------------
 
@@ -189,6 +185,7 @@ https://developers.yubico.com/Software_Projects/YubiKey_OTP/YubiCloud_Validation
 host your own verification server].
 
 
+[[pveum_permission_management]]
 Permission Management
 ---------------------
 
@@ -204,6 +201,7 @@ role)', with the role containing a set of allowed actions, and the path
 representing the target of these actions.
 
 
+[[pveum_roles]]
 Roles
 ~~~~~
 
@@ -295,7 +293,7 @@ We use file system like paths to address these objects. These paths form a
 natural tree, and permissions of higher levels (shorter path) can
 optionally be propagated down within this hierarchy.
 
-[[templated-paths]]
+[[pveum_templated_paths]]
 Paths can be templated. When an API call requires permissions on a
 templated path, the path may contain references to parameters of the API
 call. These references are specified in curly braces. Some parameters are
@@ -310,7 +308,7 @@ Some examples are:
 * `/vms`: Covers all VMs
 * `/vms/{vmid}`: Access to specific VMs
 * `/storage/{storeid}`: Access to a storages
-* `/pool/{poolname}`: Access to VMs part of a <<resource-pools,pool>
+* `/pool/{poolname}`: Access to VMs part of a <<pveum_pools,pool>>
 * `/access/groups`: Group administration
 * `/access/realms/{realmid}`: Administrative access to realms
 
@@ -327,6 +325,7 @@ by default). We use the following inheritance rules:
 * Permissions replace the ones inherited from an upper level.
 
 
+[[pveum_pools]]
 Pools
 ~~~~~
 
@@ -349,8 +348,9 @@ tree of logic and access-check functions:
 Each(`and`) or any(`or`) further element in the current list has to be true.
 
 `["perm", <path>, [ <privileges>... ], <options>...]`::
-The `path` is a templated parameter (see <<templated-paths,Objects and
-Paths>>). All (or , if the `any` option is used, any) of the listed
+The `path` is a templated parameter (see
+<<pveum_templated_paths,Objects and Paths>>). All (or , if the `any`
+option is used, any) of the listed
 privileges must be allowed on the specified path. If a `require-param`
 option is specified, then its specified parameter is required even if the
 API call's schema otherwise lists it as being optional.
@@ -381,8 +381,9 @@ associated with a realm, since user IDs are passed in the form of
 `<username>@<realm>`.
 
 `["perm-modify", <path>]`::
-The `path` is a templated parameter (see <<templated-paths,Objects and
-Paths>>). The user needs either the `Permissions.Modify` privilege, or,
+The `path` is a templated parameter (see
+<<pveum_templated_paths,Objects and Paths>>). The user needs either the
+`Permissions.Modify` privilege, or,
 depending on the path, the following privileges as a possible substitute:
 +
 * `/storage/...`: additionally requires 'Datastore.Allocate`