docs: ldap: break long lines/remove trailing whitespace
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
This commit is contained in:
parent
48f37f48d4
commit
3f44c29c1a
@ -572,12 +572,12 @@ Authentication Realms
|
|||||||
LDAP
|
LDAP
|
||||||
~~~~
|
~~~~
|
||||||
|
|
||||||
Proxmox Backup Server can utilize external LDAP servers for user authentication. To achieve this,
|
Proxmox Backup Server can utilize external LDAP servers for user authentication.
|
||||||
a realm of the type ``ldap`` has to be configured.
|
To achieve this, a realm of the type ``ldap`` has to be configured.
|
||||||
|
|
||||||
In LDAP, users are uniquely identified
|
In LDAP, users are uniquely identified by their domain (``dn``). For instance,
|
||||||
by their domain (``dn``). For instance, in the following LDIF dataset, the user ``user1`` has the
|
in the following LDIF dataset, the user ``user1`` has the unique domain
|
||||||
unique domain ``uid=user1,ou=People,dc=ldap-test,dc=com``:
|
``uid=user1,ou=People,dc=ldap-test,dc=com``:
|
||||||
|
|
||||||
|
|
||||||
.. code-block:: console
|
.. code-block:: console
|
||||||
@ -593,28 +593,39 @@ unique domain ``uid=user1,ou=People,dc=ldap-test,dc=com``:
|
|||||||
sn: Testers
|
sn: Testers
|
||||||
description: This is the first test user.
|
description: This is the first test user.
|
||||||
|
|
||||||
In in similar manner, Proxmox Backup Server uses user identifiers (``userid``) to uniquely identify users.
|
In in similar manner, Proxmox Backup Server uses user identifiers (``userid``)
|
||||||
Thus, it is necessary to establish a mapping between PBS's ``userid`` and LDAP's ``dn``.
|
to uniquely identify users. Thus, it is necessary to establish a mapping
|
||||||
This mapping is established by the ``user-attr`` configuration parameter - it contains the name of the
|
between PBS's ``userid`` and LDAP's ``dn``. This mapping is established by
|
||||||
LDAP attribute containing a valid PBS user identifier.
|
the ``user-attr`` configuration parameter - it contains the name of the LDAP
|
||||||
|
attribute containing a valid PBS user identifier.
|
||||||
|
|
||||||
For the example above, setting ``user-attr`` to ``uid`` will have the effect that the user ``user1@<realm-name>`` will be mapped to the LDAP entity
|
For the example above, setting ``user-attr`` to ``uid`` will have the effect
|
||||||
``uid=user1,ou=People,dc=ldap-test,dc=com``. On user login, PBS will perform a `subtree search` under the configured Base Domain (``base-dn``) to query
|
that the user ``user1@<realm-name>`` will be mapped to the LDAP entity
|
||||||
the user's ``dn``. Once the ``dn`` is known, an LDAP bind operation is performed to authenticate the user against the LDAP server.
|
``uid=user1,ou=People,dc=ldap-test,dc=com``. On user login, PBS will perform
|
||||||
|
a `subtree search` under the configured Base Domain (``base-dn``) to query
|
||||||
|
the user's ``dn``. Once the ``dn`` is known, an LDAP bind operation is performed
|
||||||
|
to authenticate the user against the LDAP server.
|
||||||
|
|
||||||
As not all LDAP servers allow `anonymous` search operations, it is possible to configure a bind domain (``bind-dn``) and a bind password (``password``).
|
As not all LDAP servers allow `anonymous` search operations, it is possible to
|
||||||
If set, PBS will bind to the LDAP server using these credentials before performing any search operations.
|
configure a bind domain (``bind-dn``) and a bind password (``password``).
|
||||||
|
If set, PBS will bind to the LDAP server using these credentials before
|
||||||
|
performing any search operations.
|
||||||
|
|
||||||
A full list of all configuration parameters can be found at :ref:`domains.cfg`.
|
A full list of all configuration parameters can be found at :ref:`domains.cfg`.
|
||||||
|
|
||||||
.. note:: In order to allow a particular user to authenticate using the LDAP server, you must also add them as a user of that realm in Proxmox Backup Server.
|
.. note:: In order to allow a particular user to authenticate using the LDAP
|
||||||
This can be carried out automatically with syncing.
|
server, you must also add them as a user of that realm in Proxmox Backup
|
||||||
|
Server. This can be carried out automatically with syncing.
|
||||||
|
|
||||||
User Synchronization in LDAP realms
|
User Synchronization in LDAP realms
|
||||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||||
|
|
||||||
It is possible to automatically sync users for LDAP-based realms, rather than having to add them to Proxmox VE manually.
|
It is possible to automatically sync users for LDAP-based realms, rather than
|
||||||
Synchronization options can be set in the LDAP realm configuration dialog window in the GUI and via the ``proxmox-backup-manager ldap create/update`` command.
|
having to add them to Proxmox VE manually. Synchronization options can be set
|
||||||
User synchronization can started in the GUI at Configuration > Access Control > Realms by selecting a realm and pressing the `Sync` button. In the sync dialog,
|
in the LDAP realm configuration dialog window in the GUI and via the
|
||||||
some of the default options set in the realm configuration can be overridden. Alternatively,
|
``proxmox-backup-manager ldap create/update`` command.
|
||||||
user synchronization can also be started via the ``proxmox-backup-manager ldap sync`` command.
|
User synchronization can started in the GUI at
|
||||||
|
Configuration > Access Control > Realms by selecting a realm and pressing the
|
||||||
|
`Sync` button. In the sync dialog, some of the default options set in the realm
|
||||||
|
configuration can be overridden. Alternatively, user synchronization can also
|
||||||
|
be started via the ``proxmox-backup-manager ldap sync`` command.
|
||||||
|
Loading…
Reference in New Issue
Block a user