Issue:
1) We are configuring Active Directory authentication and group-based access control in Proxmox VE.
2) To limit synchronization to users who belong to a defined set of AD security groups, we are using multiple `memberOf` conditions in the LDAP realm filter. Each condition requires the complete distinguished name of the corresponding group.
3) With several groups configured, the resulting LDAP filter exceeds the 2048-character limit enforced by both the Proxmox API and the `pveum` CLI.
Questions:
1. Is the 2048-character limit for the LDAP realm filter configurable or extendable?
2. Is there a more compact LDAP filter syntax that avoids repeating the complete group distinguished name?
3. Does `pveum realm sync` support an append or merge mode for group memberships instead of replacing the existing synchronized membership?
4. What is the recommended Proxmox approach for environments that need to synchronize users from many AD security groups?
5. Would using a parent or umbrella AD group containing the required groups be a supported alternative?
Environment:
* Proxmox VE 9.x
* Microsoft Active Directory
* Terraform using the `bpg/proxmox` provider
Thank You
1) We are configuring Active Directory authentication and group-based access control in Proxmox VE.
2) To limit synchronization to users who belong to a defined set of AD security groups, we are using multiple `memberOf` conditions in the LDAP realm filter. Each condition requires the complete distinguished name of the corresponding group.
3) With several groups configured, the resulting LDAP filter exceeds the 2048-character limit enforced by both the Proxmox API and the `pveum` CLI.
Questions:
1. Is the 2048-character limit for the LDAP realm filter configurable or extendable?
2. Is there a more compact LDAP filter syntax that avoids repeating the complete group distinguished name?
3. Does `pveum realm sync` support an append or merge mode for group memberships instead of replacing the existing synchronized membership?
4. What is the recommended Proxmox approach for environments that need to synchronize users from many AD security groups?
5. Would using a parent or umbrella AD group containing the required groups be a supported alternative?
Environment:
* Proxmox VE 9.x
* Microsoft Active Directory
* Terraform using the `bpg/proxmox` provider
Thank You