Need (desperately) support for access control groups when using OpenID auth

[mikeely]

With Proxmox VE logins using OpenID include a group claim, the values of which can be added to permissions so that anyone authenticating with that same group claim will get the permissions indicated.

With Proxmox Backup Server, any user logging in using OpenID will have their username created and zero permissions, forcing someone with a higher privilege level to assign permissions for that user and that user only. Unless there's some method for assigning new OpenID accounts with a default set of permissions that I didn't see in the documentation, this missing feature leads to management headaches that should be avoided.

Please add the missing groups permissions model to PBS.

 

[comdude2]

This is badly needed for PBS. The OpenID features in VE are great now. But PBS is sorely lacking group claims features for OpenID (and groups in general) and if I'm not mistaken, there's not even any proper documentation for OpenID in PBS for version 4.2.3

 

[galmose]

This is badly needed for PBS. The OpenID features in VE are great now. But PBS is sorely lacking group claims features for OpenID (and groups in general) and if I'm not mistaken, there's not even any proper documentation for OpenID in PBS for version 4.2.3

I agree with you. Compared to Proxmox VE, OpenID support in PBS still feels quite limited, especially when it comes to group claims and group-based authorization. The documentation is also fairly sparse, which makes configuring OpenID Connect more difficult than it should be.
Hopefully this will receive more attention in future releases, as better group claim support would make PBS much easier to integrate with identity providers such as Keycloak, Authentik, or Microsoft Entra ID.