Integration of AD and pve

dirks

Member
Feb 6, 2016
26
11
23
41
I am currently testing integration of AD with PVE including syncing and found the documentation and wiki somewhat incomplete. Especially there were two points
  • can I use bind_dn and similar with AD as well (yes)
  • how to filter a set of users and/or groups. Luckily there are options documented in man pveum.
This is what I came up with (I hate writing ldap queries):

Code:
pveum realm add EXAMPLE.COM \
  --type ad \
  --domain EXAMPLE.COM \
  --server1 example.com \
  --mode ldap+starttls \
  --bind_dn "cn=mybind.account,ou=FUsers,dc=example,dc=com" \
  --password changeme \
  --base_dn dc=example,dc=com \
  --filter '(&(|(objectClass=Person)(objectClass=orgPerson)(objectClass=inetOrgPerson))(memberof:1.2.840.113556.1.4.1941:=cn=proxmox,ou=FGroups,ou=dc=example,dc=com))' \
  --group_filter '(&(|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames))(memberof=cn=proxmox,ou=FGroups,dc=example,dc=com))'

Some explanations:
  • memberof:1.2.840.113556.1.4.1941:= is used for recursive lookup, e.g. you have userX in groupY which is again in proxmox group
  • I only gave one server because redundancy should be handled by the DCs already, i.e. you have DC1.example.com, DC2.example.com and either should answer if you resolve example.com
  • Obviously the above is redacted and therefore untested, which might have introduced errors.
  • pveum realm delete EXAMPLE.COM and pveum realm sync EXAMPLE.COM --dry-run --full=0 --purge=0 --scope=both are super helpful for testing
  • if you have multiple DCs be aware that it can take minutes to sync users, groups and other stuff, so do not expect instant success when running the tests and you made changes in your AD tree beforehand
  • Other parameters like --autocreate, --sync-defaults-options, --sync-attributes I still have to test
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!