Proxmox

Tested Versions

• Authelia
  • v4.39.19
• Proxmox Virtual Environment
  • v8.4.1
• Proxmox Backup Server
  • v3.4.2

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

• Application Root URL: https://proxmox.{{< sitevar name="domain" nojs="example.com" >}}/
• Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
• Client ID: proxmox
• Client Secret: insecure_secret
• Realm authelia

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Configuration

Authelia

The following YAML configuration is an example Authelia client configuration for use with Proxmox Virtual Environment which will operate with the application example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'proxmox'
        client_name: 'Proxmox'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://proxmox.{{< sitevar name="domain" nojs="example.com" >}}'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

Application

To configure Proxmox Virtual Environment there is one method, using the Web GUI.

Web GUI

To configure Proxmox Virtual Environment to utilize Authelia as an OpenID Connect 1.0 Provider, use the following instructions:

1. Visit Datacenter.
2. Visit Permission.
3. Visit Realms.
4. Add an OpenID Connect Server.
5. Configure the following options:
   • Issuer URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}
   • Realm: authelia
   • Client ID: proxmox
   • Client Key: insecure_secret
   • Username Claim: Default (subject)
   • Scopes: openid email profile groups
   • Autocreate Users: Enable if you want users to automatically be created in [Proxmox].
   • Autocreate Groups: Enable if you want groups to automatically be created in [Proxmox].
   • Groups Claim: Set to groups to add users to existing proxmox groups.

{{< figure src="proxmox.png" alt="Proxmox" sizes="600px" >}}

See Also

• Proxmox User Management Documentation