pbs_realm_openid_create
Create an OpenID authentication realm for user login with configurable issuer, client ID, scopes, and optional autocreate. Supports dry-run preview and client secret redaction.
Instructions
MUTATION (MEDIUM): create an OpenID authentication realm. Dry-run by default.
CLIENT-KEY REDACTION: client_key (the OAuth client secret), when supplied, is
UNCONDITIONALLY redacted from the plan, detail, and audit ledger (only
{"client-key": "[redacted]"} is recorded). confirm=True executes and returns a dict;
synchronous, no UPID. NOTE: the browser-based auth-url/login handshake is out of scope for
this plane (token-auth-shaped tools only) — see module docstring. Needs PROXIMO_PBS_* config.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| realm | Yes | New OpenID realm name. | |
| prompt | No | OpenID prompt parameter. | |
| scopes | No | OpenID scope list, SPACE-separated (schema default: 'email profile'). | |
| comment | No | Optional free-text comment. | |
| confirm | No | False (default) returns a dry-run PLAN preview; True executes the mutation. | |
| default | No | True to make this the default realm preselected on login. | |
| audiences | No | OpenID audience list string, forwarded verbatim. | |
| client_id | Yes | OpenID client id. | |
| acr_values | No | OpenID ACR list string, forwarded verbatim. | |
| autocreate | No | Automatically create PBS users on first login if they don't exist. | |
| client_key | No | OpenID client secret; redacted from all plans/logs/ledger. | |
| issuer_url | Yes | OpenID issuer URL. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. | |
| username_claim | No | Claim to use as the unique username; the identity provider must guarantee uniqueness. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |