Hi, do not mind the last question. We figured it out. I will attach an example how it works because this was impossible for me alone to figure out.
First, you have to now how it works. Synchronization to Active Directory works with ease when it comes only to authentication.
If you want also to add groups from AD, which to sync and also sync the users within, read on:
A few remarks:
1) All was performed using the interface
2) Groups permission of course you have to assign within the proxmox interface itself
3) You will have to sync manually each time you want or create some automated job for it.
I. Steps for setting up the Active Directory itself:
Authentication - Add - Active Directory Server
Realm - chose some name that speaks to you
Base Domain Name= dc=company,dc=local
User Attribute Name: sAMAccountName
Default - does not really matter
Server - input the IP or the host name of Domain Controller, whatever works in your setup
Port: I have it running on 636
SSL - is clicked for me
require TFA: none
This alone will enable the authentication to the AD itself, however, if you do not go on and sync the groups and their members from the AD, create manually the users as users in the freshly created Realm and assign a group to them with the proper permissions
II. Syncing the groups
You are going into sync options
First create in your AD a service user (normal AD user), which can browse the structure . Normal user is just fine. For instance proxmox
Create a few groups in the AD, which will handle your proxmox access - for instance proxSupers, proxAdmins, proxUsers, proxReadOnly
Assign members to the groups
Now back in Prox
Bind user: CN=proxmox,OU=serviceAccounts,OU=company_users,DC=company,DC=local
Pass: from your AD user proxmox
e-Mail attribute: email
groupname attr: sAMAccountName
User classes: user
Group classes: group
The next part is the most important one!
Please take a look here if you want - the standard syntax for filtering LDAP structures:
https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html
User Filter (this is to filter only the users, that will be imported, not the entire AD): (|(memberOf=CN=proxAdmins,OU=PROXMOX,OU=COMPANY_GROUPS,DC=company,DC=local)(memberOf=CN=proxSupers,OU=PROXMOX,OU=COMPANY_GROUPS,DC=company,DC=local)(memberOf=CN=proxReadOnly,OU=PROXMOX,OU=COMPANY_GROUPS,DC=company,DC=local))
Group Filter (to filter, which groups to import): (|(sAMAccountName=prox*))
Select Users&Groups, Full, Enable New, Purge if you want to add automatically new users, purge the ones that are not in AD and etc.
Now go into the interface with root account!!!!
And synchronize the groups and users.
All groups should import just fine and users will be in the groups
After that assign permissions to the imported groups.
And you are ready.
Sync the groups and users when there is a change and you are ready.
