[PATCH manager/docs 0/2] fix #7649: active directory realm: expose and document user attribute name

[PATCH manager/docs 0/2] fix #7649: active directory realm: expose and document user attribute name

[Michal Fox]

AD realms support the 'user_attr' option, which is needed to let users
log in with their user principal name, but it can neither be set in
the UI nor is it documented for AD realms.

1/2 adds a field for it to the AD realm edit window, 2/2 documents it.
Both can be applied independently.


manager:

Michal Fox (1):
  fix #7649: ui: active directory realm: expose user attribute name option

 www/manager6/dc/AuthEditAD.js | 7 +++++++
 1 file changed, 7 insertions(+)


docs:

Michal Fox (1):
  pveum: active directory: document user attribute name option

 pveum.adoc | 5 +++++
 1 file changed, 5 insertions(+)

-- 
2.43.0

[PATCH manager 1/2] fix #7649: ui: active directory realm: expose user attribute name option

[Michal Fox]

AD realms support the 'user_attr' option, which sets the attribute used
as username when syncing users, but it can only be set via the CLI. It
is needed for logging in with the user principal name, if that does not
end with the AD domain: with 'userPrincipalName' as attribute, the users
are synced with their full user principal name, which is then used as
is to bind to the server on login.

Add a field for it, like the LDAP realm has, with the 'sAMAccountName'
default as empty text.

Signed-off-by: Michal Fox <me@dualfroz.com>
---
Tested in the browser with the realm edit window and mocked API calls:
on create, the new field is only sent if set; on edit, a 'user_attr'
set via the CLI is shown, kept when saving, and deleted when the field
is cleared. Without the patch, there is no field, and the value can
only be changed via the CLI.

That the attribute is only used by the sync and the login binds with
the given name as is, if it contains an '@', is from reading
PVE::Auth::AD; the reporter confirmed that UPN logins work with it.

 www/manager6/dc/AuthEditAD.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/www/manager6/dc/AuthEditAD.js b/www/manager6/dc/AuthEditAD.js
index ec5e7808..530b1a67 100644
--- a/www/manager6/dc/AuthEditAD.js
+++ b/www/manager6/dc/AuthEditAD.js
@@ -17,6 +17,13 @@ Ext.define('PVE.panel.ADInputPanel', {
                 emptyText: 'company.net',
                 allowBlank: false,
             },
+            {
+                xtype: 'proxmoxtextfield',
+                name: 'user_attr',
+                fieldLabel: gettext('User Attribute Name'),
+                emptyText: Proxmox.Utils.defaultText + ' (sAMAccountName)',
+                deleteEmpty: !me.isCreate,
+            },
             {
                 xtype: 'proxmoxcheckbox',
                 fieldLabel: gettext('Case-Sensitive'),
-- 
2.43.0

[PATCH docs 2/2] pveum: active directory: document user attribute name option

[Michal Fox]

AD realms support the 'user_attr' option like LDAP realms, but it is
only documented for the latter. Describe it with its default and the
use case of logging in with the user principal name.

Signed-off-by: Michal Fox <me@dualfroz.com>
---
Rendered the HTML of pveum.adoc with and without the patch, no new
asciidoc warnings.

 pveum.adoc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pveum.adoc b/pveum.adoc
index d089cb6..cc0d527 100644
--- a/pveum.adoc
+++ b/pveum.adoc
@@ -288,6 +288,11 @@ The main configuration settings for Microsoft Active Directory are:
 
 * `Domain` (`domain`): The AD domain of the server
 
+* `User Attribute Name` (`user_attr`): The AD attribute containing the
+  username that users will log in with, `sAMAccountName` by default. Set it to
+  `userPrincipalName` to let users log in with their user principal name, for
+  example `user@example.com`.
+
 * `Server` (`server1`): The FQDN or IP address of the server
 
 * `Fallback Server` (`server2`): An optional fallback server address, in case
-- 
2.43.0