Proxmox User Management Questions

[hand363]

Hello,

I have been going deep into proxmox’s custom user management (https://pve.proxmox.com/wiki/User_Management), along with an openID connect realms. And I have a few questions:

1. Proxmox’s wiki on user management says “Proxmox VE stores user attributes in /etc/pve/domains.cfg”, this file doesn’t exist (at least in a cluster environment). My first question is can I disable PAM and/or PVE realms? To enforce login through my openID connect realm.

2. I noticed the “Administrator role” (within PVE realms) cannot do everything root (within PAM realm) can do (Ceph things: erasing disks, .., cluster creation, ..) is their anyway to get a full root privileges from a none-PAM user? I have auditing requirements which get really picky about any admin tasks that need to done in root.

Thanks!

 

[aaron]

For certain actions you will have to use the root@pam user.

the `user.cfg` file will be created once needed.

If you define a Realm as "Default" it should be the default one in the login window.

 

[hand363]

For certain actions you will have to use the root@pam user.

the `user.cfg` file will be created once needed.

If you define a Realm as "Default" it should be the default one in the login window.

Hey Aaron,

Thanks for the reply! Thanks for confirming my suspionion about some actions requiring root@pam.

As for my second question, I want to remove the ability to login through PAM/PVE realms, not make openID the default. Is there anyway to do this?

 

[aaron]

I want to remove the ability to login through PAM/PVE realms, not make openID the default. Is there anyway to do this?

I am not aware of any way to disable them in the web UI. By making the OIDC one the default, it will at least be the one selected by default.