tsarevvv/proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: ldap: break long lines/remove trailing whitespace

Browse Source 
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
This commit is contained in:
Lukas Wagner 2023-02-13 15:24:21 +01:00 committed by Wolfgang Bumiller
parent 48f37f48d4
commit 3f44c29c1a
1 changed files with 32 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
docs/user-management.rst
View File

@ -572,12 +572,12 @@ Authentication Realms
LDAP
~~~~
Proxmox Backup Server can utilize external LDAP servers for user authentication. To achieve this,
a realm of the type ``ldap`` has to be configured.
Proxmox Backup Server can utilize external LDAP servers for user authentication.
To achieve this, a realm of the type ``ldap`` has to be configured.
In LDAP, users are uniquely identified
by their domain (``dn``). For instance, in the following LDIF dataset, the user ``user1`` has the
unique domain ``uid=user1,ou=People,dc=ldap-test,dc=com``:
In LDAP, users are uniquely identified by their domain (``dn``). For instance,
in the following LDIF dataset, the user ``user1`` has the unique domain
``uid=user1,ou=People,dc=ldap-test,dc=com``:
.. code-block:: console
@ -593,28 +593,39 @@ unique domain ``uid=user1,ou=People,dc=ldap-test,dc=com``:
sn: Testers
description: This is the first test user.
In in similar manner, Proxmox Backup Server uses user identifiers (``userid``) to uniquely identify users.
Thus, it is necessary to establish a mapping between PBS's ``userid`` and LDAP's ``dn``.
This mapping is established by the ``user-attr`` configuration parameter - it contains the name of the
LDAP attribute containing a valid PBS user identifier.
In in similar manner, Proxmox Backup Server uses user identifiers (``userid``)
to uniquely identify users. Thus, it is necessary to establish a mapping
between PBS's ``userid`` and LDAP's ``dn``. This mapping is established by
the ``user-attr`` configuration parameter - it contains the name of the LDAP
attribute containing a valid PBS user identifier.
For the example above, setting ``user-attr`` to ``uid`` will have the effect that the user ``user1@<realm-name>`` will be mapped to the LDAP entity
``uid=user1,ou=People,dc=ldap-test,dc=com``. On user login, PBS will perform a `subtree search` under the configured Base Domain (``base-dn``) to query
the user's ``dn``. Once the ``dn`` is known, an LDAP bind operation is performed to authenticate the user against the LDAP server.
For the example above, setting ``user-attr`` to ``uid`` will have the effect
that the user ``user1@<realm-name>`` will be mapped to the LDAP entity
``uid=user1,ou=People,dc=ldap-test,dc=com``. On user login, PBS will perform
a `subtree search` under the configured Base Domain (``base-dn``) to query
the user's ``dn``. Once the ``dn`` is known, an LDAP bind operation is performed
to authenticate the user against the LDAP server.
As not all LDAP servers allow `anonymous` search operations, it is possible to configure a bind domain (``bind-dn``) and a bind password (``password``).
If set, PBS will bind to the LDAP server using these credentials before performing any search operations.
As not all LDAP servers allow `anonymous` search operations, it is possible to
configure a bind domain (``bind-dn``) and a bind password (``password``).
If set, PBS will bind to the LDAP server using these credentials before
performing any search operations.
A full list of all configuration parameters can be found at :ref:`domains.cfg`.
.. note:: In order to allow a particular user to authenticate using the LDAP server, you must also add them as a user of that realm in Proxmox Backup Server.
This can be carried out automatically with syncing.
.. note:: In order to allow a particular user to authenticate using the LDAP
server, you must also add them as a user of that realm in Proxmox Backup
Server. This can be carried out automatically with syncing.
User Synchronization in LDAP realms
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is possible to automatically sync users for LDAP-based realms, rather than having to add them to Proxmox VE manually.
Synchronization options can be set in the LDAP realm configuration dialog window in the GUI and via the ``proxmox-backup-manager ldap create/update`` command.
User synchronization can started in the GUI at Configuration > Access Control > Realms by selecting a realm and pressing the `Sync` button. In the sync dialog,
some of the default options set in the realm configuration can be overridden. Alternatively,
user synchronization can also be started via the ``proxmox-backup-manager ldap sync`` command.
It is possible to automatically sync users for LDAP-based realms, rather than
having to add them to Proxmox VE manually. Synchronization options can be set
in the LDAP realm configuration dialog window in the GUI and via the
``proxmox-backup-manager ldap create/update`` command.
User synchronization can started in the GUI at
Configuration > Access Control > Realms by selecting a realm and pressing the
`Sync` button. In the sync dialog, some of the default options set in the realm
configuration can be overridden. Alternatively, user synchronization can also
be started via the ``proxmox-backup-manager ldap sync`` command.