Active Directory

[italian01]

Hello to all readers.

I neet to manage ProXmoX security enviroment by AD using Web Interface. Is it possible at present? If so, is there any manual or howto guide about?

Regards.

 

[tom]

See http://pve.proxmox.com/wiki/User_Management

 

[italian01]

Thank you,

but I already read this manual. I found it not ...so clear. For instance, I already added AD authentication by ProXmoX Web Interface on HOME\Datacenter\Authentication tab. So, and after this? What do I have to do, in example, to assign root-rights to an AD user?

Regards.

 

[tom]

you cannot assign system root-rights to an AD user - you can assign admin privileges to the Proxmox VE system.

the ADS connection is use to verify passwords only.

example:
- I have an ADS account 'tom' on ads.domain.com
- First, I configure ADS authentication for ads.domain.com
- Create a group on Proxmox VE, lets call it "ads-admin"
- add the needed permissions to this group, as path just enter /
- Create a user, call it tom and select ads.domain.com as realm, and make it member in the group "ads-admin"

so now you can login with tom and as he is member of ads-admin you will have the selected permissions.

 

[italian01]

- Create a user, call it tom and select ads.domain.com as realm, and make it member in the group "ads-admin"

On this step, my ProXmoX "Add: User" pop-up gives me a drop-down list for "Realm" filed. It constrains me to select only its values, and these are:

- Linux PAM standard authentication
- Proxmox VE authentication server

So, I cannot write my domain there. Where do I make mistake?

Regar

 

[tom]

On this step, my ProXmoX "Add: User" pop-up gives me a drop-down list for "Realm" filed. It constrains me to select only its values, and these are:

- Linux PAM standard authentication
- Proxmox VE authentication server

So, I cannot write my domain there. Where do I make mistake?

Regar

you need to configure the ADS authentication first, as I wrote. then you should have it here on the list as additional option.

also make sure you run the latest packages (run aptitude update && aptitude full-upgrade)

 

[italian01]

you need to configure the ADS authentication first, as I wrote.

Yes, Tom, you're right.

And I already done it. So, after I read your last post, I rechecked my configuration, and I noticed that "realm" drop-box fill its list by "comment" field of Authentication Realms, and not by "Realm" field (as I thought). So, given that I didn't fill "comment" field, this is the cause I didn't see it in the drop-box list.

Another brief question: when I add a new AD user in ProXmox, can be it an AD group? And if so, can any AD user of this AD group authenticate itself on ProXmoX?

Regards.

 

[tom]

Yes, Tom, you're right.

And I already done it. So, after I read your last post, I rechecked my configuration, and I noticed that "realm" drop-box fill its list by "comment" field of Authentication Realms, and not by "Realm" field (as I thought). So, given that I didn't fill "comment" field, this is the cause I didn't see it in the drop-box list....

this is an old, already fixed bug. https://bugzilla.proxmox.com/show_bug.cgi?id=125
look like it did not hit the public repo yet (we work on that).

 

[italian01]

Ok, Tom.

And what about my second brief question?

Regards.

 

[tom]

no, you can use only AD user, no AD groups.