User permission and roles...

[diaolin]

When i add Permissions the system says:

Add group permission (for example)

it asks for "Path"

???

i don-t understand what that means

Tx, Diaolin

 

[coffe]

if you check the "tree" on the left side.. its the path .. so you can grant acess to just some parts.

 

[dietmar]

Please tell me what you want to achive. I can then tell you the correct path.

 

[diaolin]

Tx...

 

[diaolin]

For example i will create user that has administration privileges in a new group called Localadmins...

Tx. Diaolin

 

[tom]

if you want to grant access to all, just enter '/' as path.

 

[tdo]

Is it possible to change or add a role? I need a user, that has the same permissions/role like "PVEVMUser" + VM.Config.CDROM permission. How do I do that?

 

[bazzi]

And if I want to add a permission for a user so he can manage one VM?

 

[diaolin]

Thanks Tom, do you have a manpage or similar?

Tx

 

[tom]

we have already a wiki page (but still more or less empty ...)
http://pve.proxmox.com/wiki/User_Management

 

[bazzi]

Little tip so you don't have to know the path:
click on the left on the item that you want to "add" to a user/group.
Add the permissons in the permission tab. Then you don't need the path and the path will be generated.

 

[diaolin]

Seen but my question was about the Datacenter....

Tx, anyway

Diaolin

 

[diaolin]

Just for fun:

i created a user
and in the left pane clicked on a VM
added Administrator permission to that user for the VM
Logged on as user and removed the permission...

I think that this is correct but seeing this from a Unix perspective the
Administrator access to a particular server should be assigned from a superior
User and despite i assume that removing my privileges from my own VM should not be possible.
What do you think about this?

Many thanks, Diaolin

 

[dietmar]

I think that this is correct but seeing this from a Unix perspective the
Administrator access to a particular server should be assigned from a superior
User

You can only assign Administrator access if you have Permission.Modify privilege (else it is a bug)

and despite i assume that removing my privileges from my own VM should not be possible.
What do you think about this?

Not sure about that. I guess a user simply should not do that ;-)

 

[diaolin]

Too simple!
It-s like removing a file in a directory, if i don-t have write permission in the dir but
complete write permission on the file i cannot remove it.
But, as you say, a user should not do that!

Diaolin

 

[dietmar]

But, as you say, a user should not do that!

But your suggestion is interesting. I wonder if we can implement that by simply checking Permission.Modify on the parent object instead of the object itself - I need to think more about that.

 

[diaolin]

My opinion is only that if i am in a tree i have the property from the point assigned to me
but i cannot destroy that point because this is a property of the container and not of the
point itself.

But this is only my opinion.
Diaolin

 

[diaolin]

In any cases i find that this management will be very very interesting.
For now i test it in my Proxmox2.0 course...
Diaolin

 

[dietmar]

But this is only my opinion.

And that is quite reasonable. I just wonder how I can implement that ;-)

 

[dietmar]

Is it possible to change or add a role? I need a user, that has the same permissions/role like "PVEVMUser" + VM.Config.CDROM permission. How do I do that?

You can do that on the command line, for example:

# pveum roleadd PVEDatastorePowerUser -privs "Datastore.AllocateSpace Datastore.Audit Datastore.AllocateTemplate"

See 'man pveum' for details.