access / domains

6 operations.

GET /access/domains

proxmox.access.domains.$get()

Authentication domain index.

Returns an array of object.

POST /access/domains

proxmox.access.domains.$post()

Add an authentication server.

Returns nothing.

Parameter	Type	Required	Notes
acr-values	string		Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
audiences	string		A list of audiences that the OpenID Issuer may include that are accepted in addition to 'client-id'.
autocreate	boolean		Automatically create users if they do not exist. — default 0
base_dn	string		LDAP base domain name — ≤ 256 chars
bind_dn	string		LDAP bind domain name — ≤ 256 chars
capath	string		Path to the CA certificate store — default "/etc/ssl/certs"
case-sensitive	boolean		username is case-sensitive — default 1
cert	string		Path to the client certificate
certkey	string		Path to the client certificate key
check-connection	boolean		Check bind connection to the server. — default 0
client-id	string		OpenID Client ID — ≤ 256 chars
client-key	string		OpenID Client Key — ≤ 256 chars
comment	string		Description. — ≤ 4096 chars
default	boolean		Use this as default realm
domain	string		AD domain name — ≤ 256 chars
filter	string		LDAP filter for user sync. — ≤ 2048 chars
group_classes	string		The objectclasses for groups. — format ldap-simple-attr-list, default "groupOfNames, group, univentionGroup, ipausergroup"
group_dn	string		LDAP base domain name for group sync. If not set, the base_dn will be used. — ≤ 256 chars
group_filter	string		LDAP filter for group sync. — ≤ 2048 chars
group_name_attr	string		LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name. — format ldap-simple-attr, ≤ 256 chars
groups-autocreate	boolean		Automatically create groups if they do not exist. — default 0
groups-claim	string		OpenID claim used to retrieve groups with. — ≤ 256 chars
groups-overwrite	boolean		All groups will be overwritten for the user on login. — default 0
issuer-url	string		OpenID Issuer Url — ≤ 256 chars
mode	ldap | ldaps | ldap+starttls		LDAP protocol mode. — default "ldap"
password	string		LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
port	number		Server port. — min 1, max 65535
prompt	string		Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
query-userinfo	boolean		Enables querying the userinfo endpoint for claims values. — default 1
realm	string	yes	Authentication domain ID — format pve-realm, ≤ 32 chars
scopes	string		Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'. — default "email profile"
secure	boolean		Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
server1	string		Server IP address (or DNS name) — format address, ≤ 256 chars
server2	string		Fallback Server IP address (or DNS name) — format address, ≤ 256 chars
sslversion	tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3		LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
sync-defaults-options	string		The default options for behavior of synchronizations. — format realm-sync-options
sync_attributes	string		Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write 'email=mail'. By default, each PVE user field is represented by an LDAP attribute of the same name.
tfa	string		Use Two-factor authentication. — format pve-tfa-config, ≤ 128 chars
type	ad | ldap | openid | pam | pve	yes	Realm type.
user_attr	string		LDAP user attribute name — ≤ 256 chars
user_classes	string		The objectclasses for users. — format ldap-simple-attr-list, default "inetorgperson, posixaccount, person, user"
username-claim	string		OpenID claim used to generate the unique username.
verify	boolean		Verify the server's SSL certificate — default 0

GET /access/domains/{realm}

proxmox.access.domains.$(realm).$get()

Get auth server configuration.

Returns any.

Parameter	Type	Required	Notes
realm	string	yes	Authentication domain ID — format pve-realm, ≤ 32 chars

PUT /access/domains/{realm}

proxmox.access.domains.$(realm).$put()

Update authentication server settings.

Returns nothing.

Parameter	Type	Required	Notes
acr-values	string		Specifies the Authentication Context Class Reference values that theAuthorization Server is being requested to use for the Auth Request.
audiences	string		A list of audiences that the OpenID Issuer may include that are accepted in addition to 'client-id'.
autocreate	boolean		Automatically create users if they do not exist. — default 0
base_dn	string		LDAP base domain name — ≤ 256 chars
bind_dn	string		LDAP bind domain name — ≤ 256 chars
capath	string		Path to the CA certificate store — default "/etc/ssl/certs"
case-sensitive	boolean		username is case-sensitive — default 1
cert	string		Path to the client certificate
certkey	string		Path to the client certificate key
check-connection	boolean		Check bind connection to the server. — default 0
client-id	string		OpenID Client ID — ≤ 256 chars
client-key	string		OpenID Client Key — ≤ 256 chars
comment	string		Description. — ≤ 4096 chars
default	boolean		Use this as default realm
delete	string		A list of settings you want to delete. — format pve-configid-list, ≤ 4096 chars
digest	string		Prevent changes if current configuration file has a different digest. This can be used to prevent concurrent modifications. — ≤ 64 chars
domain	string		AD domain name — ≤ 256 chars
filter	string		LDAP filter for user sync. — ≤ 2048 chars
group_classes	string		The objectclasses for groups. — format ldap-simple-attr-list, default "groupOfNames, group, univentionGroup, ipausergroup"
group_dn	string		LDAP base domain name for group sync. If not set, the base_dn will be used. — ≤ 256 chars
group_filter	string		LDAP filter for group sync. — ≤ 2048 chars
group_name_attr	string		LDAP attribute representing a groups name. If not set or found, the first value of the DN will be used as name. — format ldap-simple-attr, ≤ 256 chars
groups-autocreate	boolean		Automatically create groups if they do not exist. — default 0
groups-claim	string		OpenID claim used to retrieve groups with. — ≤ 256 chars
groups-overwrite	boolean		All groups will be overwritten for the user on login. — default 0
issuer-url	string		OpenID Issuer Url — ≤ 256 chars
mode	ldap | ldaps | ldap+starttls		LDAP protocol mode. — default "ldap"
password	string		LDAP bind password. Will be stored in '/etc/pve/priv/realm/<REALM>.pw'.
port	number		Server port. — min 1, max 65535
prompt	string		Specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
query-userinfo	boolean		Enables querying the userinfo endpoint for claims values. — default 1
realm	string	yes	Authentication domain ID — format pve-realm, ≤ 32 chars
scopes	string		Specifies the scopes (user details) that should be authorized and returned, for example 'email' or 'profile'. — default "email profile"
secure	boolean		Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.
server1	string		Server IP address (or DNS name) — format address, ≤ 256 chars
server2	string		Fallback Server IP address (or DNS name) — format address, ≤ 256 chars
sslversion	tlsv1 | tlsv1_1 | tlsv1_2 | tlsv1_3		LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!
sync-defaults-options	string		The default options for behavior of synchronizations. — format realm-sync-options
sync_attributes	string		Comma separated list of key=value pairs for specifying which LDAP attributes map to which PVE user field. For example, to map the LDAP attribute 'mail' to PVEs 'email', write 'email=mail'. By default, each PVE user field is represented by an LDAP attribute of the same name.
tfa	string		Use Two-factor authentication. — format pve-tfa-config, ≤ 128 chars
user_attr	string		LDAP user attribute name — ≤ 256 chars
user_classes	string		The objectclasses for users. — format ldap-simple-attr-list, default "inetorgperson, posixaccount, person, user"
verify	boolean		Verify the server's SSL certificate — default 0

DELETE /access/domains/{realm}

proxmox.access.domains.$(realm).$delete()

Delete an authentication server.

Returns nothing.

Parameter	Type	Required	Notes
realm	string	yes	Authentication domain ID — format pve-realm, ≤ 32 chars

POST /access/domains/{realm}/sync

proxmox.access.domains.$(realm).sync.$post()

Syncs users and/or groups from the configured LDAP to user.cfg. NOTE: Synced groups will have the name 'name-$realm', so make sure those groups do not exist to prevent overwriting.

Returns string.

Parameter	Type	Required	Notes
dry-run	boolean		If set, does not write anything. — default 0
enable-new	boolean		Enable newly synced users immediately. — default "1"
full	boolean		DEPRECATED: use 'remove-vanished' instead. If set, uses the LDAP Directory as source of truth, deleting users or groups not returned from the sync and removing all locally modified properties of synced users. If not set, only syncs information which is present in the synced data, and does not delete or modify anything else.
purge	boolean		DEPRECATED: use 'remove-vanished' instead. Remove ACLs for users or groups which were removed from the config during a sync.
realm	string	yes	Authentication domain ID — format pve-realm, ≤ 32 chars
remove-vanished	string		A semicolon-separated list of things to remove when they or the user vanishes during a sync. The following values are possible: 'entry' removes the user/group when not returned from the sync. 'properties' removes the set properties on existing user/group that do not appear in the source (even custom ones). 'acl' removes acls when the user/group is not returned from the sync. Instead of a list it also can be 'none' (the default). — default "none"
scope	users | groups | both		Select what to sync.