Domain-based Admin Role

[Robbus]

Hello all,

I'm working on a project with my MSP to switch to ProxMox as our mail gateway.

So far it has been impressive, and I've been able to hacky in some tweaks and customizations.

Before they'll sign off on purchasing licenses (cluster), one major feature is missing: being able to set designated users as "organization admin".

We have many clients, some of whom are competitors, so we can't give, for example, andrew@alphaarchitects.com limited admin rights, if he can also see stuff from brian@bravoarchitects.com. We need to lock his limited access to @alphaarchitects.com only.

I saw in a post from 2019 where a staff member said "this is not possible". I'm hoping that means, "not built in", or at least something has changed since then.

To provide additional context, we also have clients in co-managed scenarios, where we don't just designate management from a client, but they also have their own helpdesk IT that works in collaboration with our IT, and again, we cannot allow them to be able to see ALL data.

Is this something that can maybe be edited manually, even if not fully supported? Or is it something that is baked in as compiled binaries?

 

[Stoiko Ivanov]

I saw in a post from 2019 where a staff member said "this is not possible". I'm hoping that means, "not built in", or at least something has changed since then.

The permission system of PMG is not tailored for multi-tenancy or per-domain access
For the time being it is also not on our priority list to change that.

Depending on context you can:
* setup multiple PMG instances for each separate domain
* do your own filtering and then only allow certain requests to the REST-API: https://pmg.proxmox.com/pmg-docs/api-viewer/index.html
(but that would more or less mean providing your own GUI)

I hope this explains it!