AD - Filter users from group

[orionzrh]

Hi Community

I'm new in Proxmox and have installed a cluster with 3 servers.
Now I would like to add this Cluster to our AD server for having only our DevOps Team admin rights on the cluster. (Proxmox 8.2.4)
My ad connection works and I get all the data and groups. I also have managed to only filter for that particular DevOps group.
But I'm not able to only add the users from that group. (D-DEVOPS)



Does someone know how I have to filter as I get only those users in the particular group? Or do i need to Sync all users from the AD and Proxmox internally will add them to their groups?

Thanks for your help

 

[sw-omit]

There is this [1] Tutorial about setting up Proxmox with AD, and there they indeed sync-all and then filter / give permissions at the next step.
It is a bit older though, so some options MIGHT have changed, but at least it is one thing to test. Glancing over that tutorial too, it looks like your Bind User also might be in the wrong format, needing the full CN/DC path, which might also be what's needed for the Group Filter (Unsure because I haven't worked with it.)

[1] https://forum.proxmox.com/threads/h...cluster-to-an-active-directory-domain.100395/

 

[orionzrh]

There is this [1] Tutorial about setting up Proxmox with AD, and there they indeed sync-all and then filter / give permissions at the next step.
It is a bit older though, so some options MIGHT have changed, but at least it is one thing to test. Glancing over that tutorial too, it looks like your Bind User also might be in the wrong format, needing the full CN/DC path, which might also be what's needed for the Group Filter (Unsure because I haven't worked with it.)

[1] https://forum.proxmox.com/threads/h...cluster-to-an-active-directory-domain.100395/

Hi

Thanks for the hint.
The connection to the AD is working in both ways. The one from the link you added and also with the username and without all the additional AD CN's.
My problem is that I have ALL the users in my user list. But want only a particular group of users in the list. Or maybe I misunderstand that filter.

 

[!Lucky]

(|(memberOf:1.2.840.113556.1.4.1941:=CN=by01.pve.admins,OU=MYOU,DC=domain,DC=lan)(memberOf:1.2.840.113556.1.4.1941:=CN=by01.pve.operators,OU=MYOU,DC=domain,DC=lan))