basic user management issue

[BloodyIron]

So I'm finally setting up my system to go production, but I'm snagged on user management.

I've created a group "Administrators"

I then went to permissions and added /administrators pointing to the group @Administrators with the role "Administrator" and propagate to true

I then created a PVE user and added them to the Administrator group

All of this is through the web GUI

I then log in and the user appears to have almost no permissions. I cannot create VMs, Almost all the tabs and sections are not available to me. I'm not sure what level of access I'm at, but it's certainly not Administrator.

Unfortunately the User Management wiki page primarily focuses on CLI methods ( http://pve.proxmox.com/wiki/User_Management#Real_World_Examples ) so that's less than helpful in my case.

What am I missing here? D:

 

[tom]

post the output of:

cat /etc/pve/user.cfg

 

[BloodyIron]

Edited for privacy

user:tmarl@pve:1:0:FIRSTNAME:LASTNAME:MYEMAIL:Systems Administrator:user:root@pam:1:0:::MYEMAIL::


group:Administrators:tmarl@pveeople with full access:


pool:COMPANY:COMPANYSITE:::




acl:1:/administratorsAdministrators:Administrator:

ugh I wish I didn't have to edit for privacy, but it seems prudent, sorry about that

 

[tom]

seems you used a wrong path on the permissions. remove your permissions via gui and add it according to this attached screenshot.

 

[BloodyIron]

Pretty sure that did the trick. I couldn't quite find the appropriate wiki page on this. Could you point me to the correct documentation on how paths work? I'm still confused by them in regards to permissions. I'd like to understand why this change solved it.

Thanks!

seems you used a wrong path on the permissions. remove your permissions via gui and add it according to this attached screenshot.
View attachment 1528

 

[tom]

See http://pve.proxmox.com/wiki/User_Management

Of course, users, groups, roles- and permission management is a bit complex by design. I also suggest you navigate through path using our pve shell (pvesh).
reading forum posts from other users will also help.

 

[Raymond Burns]

What is the real life scenario where Users are useful? not downplaying it, just wondering when it should be used, and why I haven't used it yet!

 

[BloodyIron]

So for my case I am creating a "local" admin user for myself so I can use my own password and then set the root account to a password that is stored in our password/key storage tool. This way if something happens to me the business can retrieve the necessary access to the system. Eventually I will have it authenticate against Active Directory, but part of the larger project I'm working on is building a new AD domain with SAMBA4 to replace our existing ultra junky AD2k3 domain. The new AD servers will existing in VMs on the very host I'm working on now, as such I cannot authenticate against a non-existent domain just yet.

It also offers me a couple fall-back users to use in case of catastrophic failure.

What is the real life scenario where Users are useful? not downplaying it, just wondering when it should be used, and why I haven't used it yet!

 

[BloodyIron]

I was afraid you would reference that one.

I've read through that wiki article and I still don't understand how the pathing structure works. Since I now have an account on the wiki I can re-write it myself, but I'll have to get a better understanding before I can do that.

Is "Paths" a recent feature for Proxmox?

I'll try to see if I can dig up some relevant forum posts indeed. I try to scour the forums as best as possible typically.

See http://pve.proxmox.com/wiki/User_Management

Of course, users, groups, roles- and permission management is a bit complex by design. I also suggest you navigate through path using our pve shell (pvesh).
reading forum posts from other users will also help.