create user failed: You cannot create user in the PAM realm (500)

N

Nolfik

New Member
Jun 16, 2025
3
0
1
Hi everyone,
I'm encountering a problem with Proxmox Mail Gateway (PMG) related to adding PAM users via the WebGUI. Here are the two cases I’ve tested:

Case 1: Local system user​

I created a regular Linux user directly on the PMG server:
useradd testlocal

The user works correctly on the system (id testlocal, home directory exists, login works), but when I try to add this user to the PMG WebGUI (Configuration → User Management→ Add → Realm: Linux PAM), I get this error:
create user failed: You cannot create user in the PAM realm (500)

Case 2: FreeIPA user​

I joined the PMG server to our FreeIPA domain via ipa-client-install, synced users via SSSD, and verified that getent passwd user works for FreeIPA users.
However, when I try to add a FreeIPA user in the same way via the WebGUI (Realm: Linux PAM), I get the same error:
create user failed: You cannot create user in the PAM realm (500)

Is this expected behavior?
What is the correct way to enable PAM or FreeIPA users for PMG WebUI access?

Thanks!
 
And in the logs I see the same error for two cases
pmgdaemon[132349]: authentication failure; rhost=::ffff:127.0.0.1 user= testlocal@pam msg=403 Permission check failed (user ' testlocal@pam' is disabled)
 
Hi,

are you sure the user you're logged in with has enough permissions to create users?
 
ah yes, sorry. I forgot that PMG does not allow using pam users at all (except for root@pam). That this is available in the UI is a bug introduced by the recent addition of OIDC realms.
(i created https://bugzilla.proxmox.com/show_bug.cgi?id=6488 for it)

would adding the realm as OIDC with something like keycload that connects to your ldap/freeipa enough ?

otherwise would having an ldap realm be enough?

we could enable creating pam users for the pmg admin console, but there was no real need for that yet, that couldn't be also done with e.g. OIDC
 
You must log in or register to reply here.
Top Bottom