Get the schemas for all DNS providers we support for ACME DNS Challenge and the respective attributes required for connecting to them while validating a DNS Challenge

Create a DNS Authenticator

Create a specific DNS Authenticator containing required authentication details for the said provider to successfully connect with it

Create a DNS Authenticator for Route53

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "acme.dns.authenticator.create",
    "params": [{
        "name": "route53_authenticator",
        "authenticator": "route53",
        "attributes": {
            "access_key_id": "AQX13",
            "secret_access_key": "JKW90"
        }
    }]
}

Delete DNS Authenticator of id

Delete a DNS Authenticator of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "acme.dns.authenticator.delete",
    "params": [
        1
    ]
}

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Update DNS Authenticator of id

Update a DNS Authenticator of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "acme.dns.authenticator.update",
    "params": [
        1,
        {
            "name": "route53_authenticator",
            "attributes": {
                "access_key_id": "AQX13",
                "secret_access_key": "JKW90"
            }
        }
    ]
}

Returns the following information about the currently joined domain:

LDAP server IP address of current LDAP server to which TrueNAS is connected.

LDAP server name DNS name of LDAP server to which TrueNAS is connected

Realm Kerberos realm

LDAP port

Server time timestamp.

KDC server Kerberos KDC to which TrueNAS is connected

Server time offset current time offset from DC.

Last machine account password change. timestamp

Wrapper function for 'directoryservices.get_state'. Returns only the state of the Active Directory service.

Leave Active Directory domain. This will remove computer object from AD and clear relevant configuration data from the NAS. This requires credentials for appropriately-privileged user. Credentials are used to obtain a kerberos ticket, which is used to perform the actual removal from the domain.

Returns list of available LDAP schema choices.

Issue a no-effect command to our DC. This checks if our secure channel connection to our domain controller is still alive. It has much less impact than wbinfo -t. Default winbind request timeout is 60 seconds, and can be adjusted by the smb4.conf parameter 'winbind request timeout ='

Update active directory configuration. domainname full DNS domain name of the Active Directory domain.

bindname username used to perform the intial domain join.

bindpw password used to perform the initial domain join. User- provided credentials are used to obtain a kerberos ticket, which is used to perform the actual domain join.

verbose_logging increase logging during the domain join process.

use_default_domain controls whether domain users and groups have the pre-windows 2000 domain name prepended to the user account. When enabled, the user appears as "administrator" rather than "EXAMPLEdministrator"

allow_trusted_doms enable support for trusted domains. If this parameter is enabled, then separate idmap backends must be configured for each trusted domain, and the idmap cache should be cleared.

allow_dns_updates during the domain join process, automatically generate DNS entries in the AD domain for the NAS. If this is disabled, then a domain administrator must manually add appropriate DNS entries for the NAS. This parameter is recommended for TrueNAS HA servers.

disable_freenas_cache disables active caching of AD users and groups. When disabled, only users cached in winbind's internal cache are visible in GUI dropdowns. Disabling active caching is recommended in environments with a large amount of users.

site AD site of which the NAS is a member. This parameter is auto- detected during the domain join process. If no AD site is configured for the subnet in which the NAS is configured, then this parameter appears as 'Default-First-Site-Name'. Auto-detection is only performed during the initial domain join.

kerberos_realm in which the server is located. This parameter is automatically populated during the initial domain join. If the NAS has an AD site configured and that site has multiple kerberos servers, then the kerberos realm is automatically updated with a site-specific configuration to use those servers. Auto-detection is only performed during initial domain join.

kerberos_principal kerberos principal to use for AD-related operations outside of Samba. After intial domain join, this field is updated with the kerberos principal associated with the AD machine account for the NAS.

nss_info controls how Winbind retrieves Name Service Information to construct a user's home directory and login shell. This parameter is only effective if the Active Directory Domain Controller supports the Microsoft Services for Unix (SFU) LDAP schema.

timeout timeout value for winbind-related operations. This value may need to be increased in environments with high latencies for communications with domain controllers or a large number of domain controllers. Lowering the value may cause status checks to fail.

dns_timeout timeout value for DNS queries during the initial domain join. This value is also set as the NETWORK_TIMEOUT in the ldap config file.

createcomputer Active Directory Organizational Unit in which new computer accounts are created.

The OU string is read from top to bottom without RDNs. Slashes ("/") are used as delimiters, like Computers/Servers/NAS. The backslash ("\") is used to escape characters but not as a separator. Backslashes are interpreted at multiple levels and might require doubling or even quadrupling to take effect.

When this field is blank, new computer accounts are created in the Active Directory default OU.

The Active Directory service is started after a configuration update if the service was initially disabled, and the updated configuration sets enable to True. The Active Directory service is stopped if enable is changed to False. If the configuration is updated, but the initial enable state is True, and remains unchanged, then the samba server is only restarted.

During the domain join, a kerberos keytab for the newly-created AD machine account is generated. It is used for all future LDAP / AD interaction and the user-provided credentials are removed.

Dismiss id alert.

List all types of alerts including active/dismissed currently in the system.

List all types of alerts which the system can issue.

List all alert policies which indicate the frequency of the alerts.

Restore id alert which had been dismissed.

Update default Alert settings.

Create an Alert Service of specified type.

If enabled, it sends alerts to the configured type of Alert Service.

Create an Alert Service of Mail type

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "alertservice.create",
    "params": [{
        "name": "Test Email Alert",
        "enabled": true,
        "type": "Mail",
        "attributes": {
            "email": "dev@ixsystems.com"
        },
        "settings": {
            "VolumeVersion": "HOURLY"
        }
    }]
}

Delete Alert Service of id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

List all types of supported Alert services which can be configured with the system.

Send a test alert using type of Alert Service.

Send a test alert using Alert Service of Mail type.

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "alertservice.test",
    "params": [{
        "name": "Test Email Alert",
        "enabled": true,
        "type": "Mail",
        "attributes": {
            "email": "dev@ixsystems.com"
        },
        "settings": {}
    }]
}

Update Alert Service of id.

Creates API Key.

name is a user-readable name for key.

Delete API Key id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Update API Key id.

Specify reset: true to reset this API Key.

Retrieve all available applications from all configured catalogs.

Retrieve list of valid categories which have associated applications.

Retrieve latest updated apps.

Retrieve applications which are similar to app_name.

Download the audit report with the specified name from the server. Note that users will only be able to download reports that they personally generated.

Generate an audit report based on the specified query-filters and query-options for the specified services in the specified export_format.

Supported export_formats are CSV, JSON, and YAML. The endpoint returns a local filesystem path where the resulting audit report is located.

Query contents of audit databases specified by services.

If the query-option force_sql_filters is true, then the query will be converted into a more efficient form for better performance. This will not be possible if filters use keys within svc_data and event_data.

Each audit entry contains the following keys:

audit_id - GUID uniquely identifying this specific audit event.

message_timestamp - Unix timestamp for when the audit event was written to the auditing database.

timestamp - converted ISO-8601 timestamp from application recording when event occurred.

address - IP address of client performing action that generated the audit message.

username - Username used by client performing action.

session - GUID uniquely identifying the client session.

services - Name of the service that generated the message. This will be one of the names specified in services.

service_data - JSON object containing variable data depending on the particular service. See TrueNAS auditing documentation for the service in question.

event - Name of the event type that generated the audit record. Each service has its own unique event identifiers.

event_data - JSON object containing variable data depending on the particular event type. See TrueNAS auditing documentation for the service in question.

success - boolean value indicating whether the action generating the event message succeeded.

Update default audit settings.

The following fields may be modified:

retention - number of days to retain local audit messages.

reservation - size in GiB of refreservation to set on ZFS dataset where the audit databases are stored. The refreservation specifies the minimum amount of space guaranteed to the dataset, and counts against the space available for other datasets in the zpool where the audit dataset is located.

quota - size in GiB of the maximum amount of space that may be consumed by the dataset where the audit dabases are stored.

quota_fill_warning - percentage used of dataset quota at which to generate a warning alert.

quota_fill_critical - percentage used of dataset quota at which to generate a critical alert.

The following fields contain read-only data and are returned in calls to audit.config and audit.update:

space - ZFS dataset properties relating space used and available for the dataset where the audit databases are written.

remote_logging_enabled - Boolean indicating whether logging to a remote syslog server is enabled on TrueNAS and if audit logs are included in what is sent remotely.

enabled_services - JSON object with key denoting service, and value containing a JSON array of what aspects of this service are being audited. In the case of the SMB audit, the list contains share names of shares for which auditing is enabled.

Verify username and password

Verify username and password

Generate a token to be used for authentication.

ttl stands for Time To Live, in seconds. The token will be invalidated if the connection has been inactive for a time greater than this.

attrs is a general purpose object/dictionary to hold information about the token.

match_origin will only allow using this token from the same IP address or with the same user UID.

Authenticate session using username and password. otp_token must be specified if two factor authentication is enabled.

Authenticate session using API Key.

Authenticate session using token generated with auth.generate_token.

Deauthenticates an app and if a token exists, removes that from the session.

Returns currently logged-in user.

Returns list of active auth sessions.

Example of return value:

[ { "id": "NyhB1J5vjPjIV82yZ6caU12HLA1boDJcZNWuVQM4hQWuiyUWMGZTz2ElDp7Yk87d", "origin": "192.168.0.3:40392", "credentials": "LOGIN_PASSWORD", "credentials_data": {"username": "root"}, "current": True, "internal": False, "created_at": {"$date": 1545842426070} } ]

credentials can be UNIX_SOCKET, ROOT_TCP_SOCKET, LOGIN_PASSWORD, API_KEY or TOKEN, depending on what authentication method was used. For UNIX_SOCKET and LOGIN_PASSWORD logged-in username field will be provided in credentials_data. For API_KEY corresponding api_key will be provided in credentials_data. For TOKEN its parent credential will be provided in credentials_data.

If you want to exclude all internal connections from the list, call this method with following arguments:

[ [ ["internal", "=", True] ] ]

Set current user's attributes dictionary key to value.

e.g. Setting key="foo" value="var" will result in {"attributes": {"foo": "bar"}}

Terminates all other sessions (except the current one).

Terminates session id.

Returns true if two-factor authorization is required for authorizing user's login.

window extends the validity to window many counter ticks before and after the current one.

Update Two-Factor Authentication Service Configuration.

Attach a disk to the boot pool, turning a stripe into a mirror.

expand option will determine whether the new disk partition will be the maximum available or the same size as the current disk.

Detach given dev from boot pool.

Returns disks of the boot pool.

Get Automatic Scrub Interval value in days.

Returns the current state of the boot pool, including all vdevs, properties and datasets.

Replace device label on boot pool with dev.

Scrub on boot pool.

Set Automatic Scrub Interval value in days.

Activates boot environment id.

Create a new boot environment using name.

If a new boot environment is desired which is a clone of another boot environment, source can be passed. Then, a new boot environment of name is created using boot environment source by cloning it.

Ensure that name and source are valid boot environment names.

Delete id boot environment. This removes the clone from the system.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Query all Boot Environments with query-filters and query-options.

Sets attributes boot environment id.

Currently only keep attribute is allowed.

Update id boot environment name with a new provided valid name.

catalog_create.preferred_trains specifies trains which will be displayed in the UI directly for a user.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Retrieve information of item_name item_version_details.catalog catalog item.

Retrieve item details for label catalog.

options.cache is a boolean which when set will try to get items details for label catalog from cache if available.

options.cache_only is a boolean which when set will force usage of cache only for retrieving catalog information. If the content for the catalog in question is not cached, no content would be returned. If options.cache is unset, this attribute has no effect.

options.retrieve_all_trains is a boolean value which when set will retrieve information for all the trains present in the catalog ( it is set by default ).

options.trains is a list of train name(s) which will allow selective filtering to retrieve only information of desired trains in a catalog. If options.retrieve_all_trains is set, it has precedence over options.train.

Sync label catalog to retrieve latest changes from upstream.

Refresh all available catalogs from upstream.

Validates label catalog format which includes validating trains and applications with their versions.

This does not test if an app version is valid in terms of kubernetes resources but instead ensures it has the correct format and files necessary for TrueNAS to use it.

Dictionary of popular ACME Servers with their directory URI endpoints which we display automatically in UI

Returns a dictionary of predefined options for specific use cases i.e openvpn client/server configurations which can be used for creating certificate signing requests.

Returns country choices for creating a certificate/csr.

Create a new Certificate

Certificates are classified under following types and the necessary keywords to be passed for create_type attribute to create the respective type of certificate

1) Internal Certificate - CERTIFICATE_CREATE_INTERNAL

2) Imported Certificate - CERTIFICATE_CREATE_IMPORTED

3) Certificate Signing Request - CERTIFICATE_CREATE_CSR

4) Imported Certificate Signing Request - CERTIFICATE_CREATE_IMPORTED_CSR

5) ACME Certificate - CERTIFICATE_CREATE_ACME

By default, created certs use RSA keys. If an Elliptic Curve Key is desired, it can be specified with the key_type attribute. If the ec_curve attribute is not specified for the Elliptic Curve Key, then default to using "SECP384R1" curve.

A type is selected by the Certificate Service based on create_type. The rest of the values in data are validated accordingly and finally a certificate is made based on the selected type.

cert_extensions can be specified to set X509v3 extensions.

Create an ACME based certificate

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.create",
    "params": [{
        "tos": true,
        "csr_id": 1,
        "acme_directory_uri": "https://acme-staging-v02.api.letsencrypt.org/directory",
        "name": "acme_certificate",
        "dns_mapping": {
            "domain1.com": "1"
        },
        "create_type": "CERTIFICATE_CREATE_ACME"
    }]
}

Create an Imported Certificate Signing Request

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.create",
    "params": [{
        "name": "csr",
        "CSR": "CSR string",
        "privatekey": "Private key string",
        "create_type": "CERTIFICATE_CREATE_IMPORTED_CSR"
    }]
}

Create an Internal Certificate

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.create",
    "params": [{
        "name": "internal_cert",
        "key_length": 2048,
        "lifetime": 3600,
        "city": "Nashville",
        "common": "domain1.com",
        "country": "US",
        "email": "dev@ixsystems.com",
        "organization": "iXsystems",
        "state": "Tennessee",
        "digest_algorithm": "SHA256",
        "signedby": 4,
        "create_type": "CERTIFICATE_CREATE_INTERNAL"
    }]
}

Delete certificate of id.

If the certificate is an ACME based certificate, certificate service will try to revoke the certificate by updating it's status with the ACME server, if it fails an exception is raised and the certificate is not deleted from the system. However, if force is set to True, certificate is deleted from the system even if some error occurred while revoking the certificate with the ACME Server

Delete certificate of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.delete",
    "params": [
        1,
        true
    ]
}

Dictionary of supported EC curves.

Dictionary of choices for ExtendedKeyUsage extension which can be passed over to usages attribute.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Dictionary of supported key types for certificates.

Returns a dictionary of predefined options for specific use cases i.e openvpn client/server configurations which can be used for creating certificates.

Update certificate of id

Only name and revoked attribute can be updated.

When revoked is enabled, the specified cert id is revoked and if it belongs to a CA chain which exists on this system, its serial number is added to the CA's certificate revocation list.

Update a certificate of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificate.update",
    "params": [
        1,
        {
            "name": "updated_name"
        }
    ]
}

Sign CSR by Certificate Authority of ca_id

Sign CSR's and generate a certificate from it. ca_id provides which CA is to be used for signing a CSR of csr_cert_id which exists in the system

cert_extensions can be specified if specific extensions are to be set in the newly signed certificate.

Sign CSR of csr_cert_id by Certificate Authority of ca_id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.ca_sign_csr",
    "params": [{
        "ca_id": 1,
        "csr_cert_id": 1,
        "name": "signed_cert"
    }]
}

Create a new Certificate Authority

Certificate Authorities are classified under following types with the necessary keywords to be passed for create_type attribute to create the respective type of certificate authority

1) Internal Certificate Authority - CA_CREATE_INTERNAL

2) Imported Certificate Authority - CA_CREATE_IMPORTED

3) Intermediate Certificate Authority - CA_CREATE_INTERMEDIATE

Created certificate authorities use RSA keys by default. If an Elliptic Curve Key is desired, then it can be specified with the key_type attribute. If the ec_curve attribute is not specified for the Elliptic Curve Key, default to using "SECP384R1" curve.

A type is selected by the Certificate Authority Service based on create_type. The rest of the values are validated accordingly and finally a certificate is made based on the selected type.

cert_extensions can be specified to set X509v3 extensions.

Create an Internal Certificate Authority

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.create",
    "params": [{
        "name": "internal_ca",
        "key_length": 2048,
        "lifetime": 3600,
        "city": "Nashville",
        "common": "domain1.com",
        "country": "US",
        "email": "dev@ixsystems.com",
        "organization": "iXsystems",
        "state": "Tennessee",
        "digest_algorithm": "SHA256"
        "create_type": "CA_CREATE_INTERNAL"
    }]
}

Create an Imported Certificate Authority

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.create",
    "params": [{
        "name": "imported_ca",
        "certificate": "Certificate string",
        "privatekey": "Private key string",
        "create_type": "CA_CREATE_IMPORTED"
    }]
}

Delete a Certificate Authority of id

Delete a Certificate Authority of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.delete",
    "params": [
        1
    ]
}

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Returns a dictionary of predefined options for specific use cases i.e OpenVPN certificate authority configurations which can be used for creating certificate authorities.

Update Certificate Authority of id

Only name and revoked attribute can be updated.

If revoked is enabled, the CA and its complete chain is marked as revoked and added to the CA's certificate revocation list.

Update a Certificate Authority of id

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "certificateauthority.update",
    "params": [
        1,
        {
            "name": "updated_ca_name"
        }
    ]
}

Returns certificate authorities which can be used by applications.

Returns certificates which can be used by applications.

Create a chart release for a catalog item.

release_name is the name which will be used to identify the created chart release.

catalog is a valid catalog id where system will look for catalog item details.

train is which train to look for under catalog i.e stable / testing etc.

version specifies the catalog item version.

values is configuration specified for the catalog item version in question which will be used to create the chart release.

Delete existing chart release.

This will delete the chart release from the kubernetes cluster and also remove any associated volumes / data. To clarify, host path volumes will not be deleted which live outside the chart release dataset.

Returns kubernetes events for release_name Chart Release.

Retrieve chart releases which are consuming any images in use by chart_release_name.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Available choices for NIC which can be added to a pod in a chart release.

Returns choices for console access to a chart release.

Output is a dictionary with names of pods as keys and containing names of containers which the pod comprises of.

Export logs of options.container_name container in options.pod_name pod in release_name chart release.

options.tail_lines is an option to select how many lines of logs to retrieve for the said container. It defaults to 500. If set to null, it will retrieve complete logs of the container.

options.limit_bytes is an option to select how many bytes to retrieve from the tail lines selected. If set to null ( which is the default ), it will not limit the bytes returned. To clarify, options.tail_lines is applied first and the required number of lines are retrieved and then options.limit_bytes is applied.

Please refer to websocket documentation for downloading the file.

Returns choices for accessing logs of any container in any pod in a chart release.

Retrieve available/desired pods status for a chart release and it's current state.

Update container images being used by release_name chart release.

redeploy when set will redeploy pods which will result in chart release using newer updated versions of the container images.

Query available chart releases.

query-options.extra.retrieve_resources is a boolean when set will retrieve existing kubernetes resources in the chart namespace.

query-options.extra.history is a boolean when set will retrieve all chart version upgrades for a chart release.

query-options.extra.include_chart_schema is a boolean when set will retrieve the schema being used by the chart release in question.

query-options.extra.resource_events is a boolean when set will retrieve individual events of each resource. This only has effect if query-options.extra.retrieve_resources is set.

Redeploy will initiate a new rollout of the Helm chart according to upgrade strategy defined by the chart release workloads. A good example for redeploying is updating kubernetes pods with an updated container image.

Remove volume_name ix_volume from release_name chart release.

Rollback a chart release to a previous chart version.

item_version is version which we want to rollback a chart release to.

rollback_snapshot is a boolean value which when set will rollback snapshots of any PVC's or ix volumes being consumed by the chart release.

force_rollback is a boolean which when set will force rollback operation to move forward even if no snapshots are found. This is only useful when rollback_snapshot is set.

recreate_resources is a boolean which will delete and then create the kubernetes resources on rollback of chart release. This should be used with caution as if chart release is consuming immutable objects like a PVC, the rollback operation can't be performed and will fail as helm tries to do a 3 way patch for rollback.

Rollback is functional for the actual configuration of the release at the item_version specified and any associated ix_volumes with any PVC's which were consuming chart release storage class.

Scale a release_name chart release to scale_options.replica_count specified.

This will scale deployments/statefulset to replica count specified.

Scale workloads in a chart release to specified replica_count.

Returns choices for types of workloads which can be scaled up/down.

Update an existing chart release.

values is configuration specified for the catalog item version in question which will be used to create the chart release.

Upgrade release_name chart release.

upgrade_options.item_version specifies to which item version chart release should be upgraded to.

System will update container images being used by release_name chart release as a chart release upgrade is not considered complete until the images in use have also been updated to latest versions.

During upgrade, upgrade_options.values can be specified to apply configuration changes for configuration changes for the chart release in question.

When chart version is upgraded, system will automatically take a snapshot of ix_volumes in question which can be used to rollback later on.

Retrieve upgrade summary for release_name which will include which container images will be updated and changelog for options.item_version chart version specified if applicable. If only container images need to be updated, changelog will be null.

If chart release release_name does not require an upgrade, an error will be raised.

Returns ports in use by applications.

Aborts cloud backup task.

Deletes cloud backup entry id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Initializes the repository for the cloud backup job id.

Run the cloud backup job id.

Updates the cloud backup entry id with data.

Aborts cloud sync task.

Creates a new cloud_sync entry.

Create a new cloud_sync using amazon s3 attributes, which is supposed to run every hour.

{
  "id": "6841f242-840a-11e6-a437-00e04d680384",
  "msg": "method",
  "method": "cloudsync.create",
  "params": [{
    "description": "s3 sync",
    "path": "/mnt/tank",
    "credentials": 1,
    "minute": "00",
    "hour": "*",
    "daymonth": "*",
    "month": "*",
    "attributes": {
      "bucket": "mybucket",
      "folder": ""
    },
    "enabled": true
  }]
}

Creates a new bucket name using credentials_id.

Deletes cloud_sync entry id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

List contents of a remote bucket / directory.

If remote supports buckets, path is constructed by two keys "bucket"/"folder" in attributes. If remote does not support buckets, path is constructed using "folder" key only in attributes. "folder" is directory name and "bucket" is bucket name for remote.

Path examples:

S3 Service bucketname/directory/name

Dropbox Service directory/name

credentials is a valid id of a Cloud Sync Credential which will be used to connect to the provider.

Returns a list of dictionaries of supported providers for Cloud Sync Tasks.

credentials_schema is JSON schema for credentials attributes.

task_schema is JSON schema for task attributes.

buckets is a boolean value which is set to "true" if provider supports buckets.

Example of a single provider:

[ { "name": "AMAZON_CLOUD_DRIVE", "title": "Amazon Cloud Drive", "credentials_schema": [ { "property": "client_id", "schema": { "title": "Amazon Application Client ID", "required": true, "type": "string" } }, { "property": "client_secret", "schema": { "title": "Application Key", "required": true, "type": "string" } } ], "credentials_oauth": null, "buckets": false, "bucket_title": "Bucket", "task_schema": [] } ]

Create the opposite of cloud sync task id (PULL if it was PUSH and vice versa).

Run the cloud_sync job id, syncing the local data to remote.

Run cloud sync task without creating it.

Updates the cloud_sync entry id with data.

Create Cloud Sync Credentials.

attributes is a dictionary of valid values which will be used to authorize with the provider.

Delete Cloud Sync Credentials of id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Update Cloud Sync Credentials of id.

Verify if attributes provided for provider are authorized by the provider.

Reset database to configuration defaults.

If reboot is true this job will reboot the system after its completed with a delay of 10 seconds.

Create a tar file of security-sensitive information. These options select which information is included in the tar file:

secretseed bool: When true, include password secret seed. pool_keys bool: IGNORED and DEPRECATED as it does not apply on SCALE systems. root_authorized_keys bool: When true, include "/root/.ssh/authorized_keys" file for the root user.

If none of these options are set, the tar file is not generated and the database file is returned.

Accepts a configuration file via job pipe.

Prune unused images/containers. This will by default remove any dangling images.

prune_options.remove_unused_images when set will remove any container image which is not being used by any container.

When enable_image_updates is set, system will check if existing container images need to be updated. System will basically check if we have an updated image hash available for the same tag available and if we do, user is alerted to update the image. A use case for unsetting this variable can be rate limits for docker registries, as each time we check if a single image needs update, we consume the rate limit and eventually it can hinder operations if the number of images to be checked is a lot.

options.force should be used to force delete an image even if it's in use by a stopped container.

Returns the current rate limit information for Docker Hub registry.

Please refer to https://docs.docker.com/docker-hub/download-rate-limit/ for more information.

Retrieve chart releases consuming image_tag image.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

from_image is the name of the image to pull. Format for the name is "registry/repo/image" where registry may be omitted and it will default to docker registry in this case.

tag specifies tag of the image and defaults to null. In case of null it will retrieve all the tags of the image.

authentication should be specified if image to be retrieved is under a private repository.

Retrieve container images present in the system.

query-options.extra.parse_tags is a boolean which when set will have normalized tags to be retrieved for container images.

Will sequentially call method with arguments from the params list. For example, running

call("core.bulk", "zfs.snapshot.delete", [["tank@snap-1", true], ["tank@snap-2", false]])

will call

call("zfs.snapshot.delete", "tank@snap-1", true)
call("zfs.snapshot.delete", "tank@snap-2", false)

If the first call fails and the seconds succeeds (returning true), the result of the overall call will be:

[
    {"result": null, "error": "Error deleting snapshot"},
    {"result": true, "error": null}
]

Important note: the execution status of core.bulk will always be a SUCCESS (unless an unlikely internal error occurs). Caller must check for individual call results to ensure the absence of any call errors.

description contains format string for job progress (e.g. "Deleting snapshot {0[dataset]}@{0[name]}")

Setup middlewared for remote debugging.

engine currently used: - REMOTE_PDB: Remote vanilla PDB (over TCP sockets)

options: - bind_address: local ip address to bind the remote debug session to - bind_port: local port to listen on - threaded: run debugger in a new thread instead of the main event loop

Core helper to call a job marked for download.

Non-buffered downloads will allow job to write to pipe as soon as download URL is requested, job will stay blocked meanwhile. buffered downloads must wait for job to complete before requesting download URL, job's pipe output will be buffered to ramfs.

Returns the job id and the URL for download.

Returns metadata for every possible event emitted from websocket server.

Get information about long-running jobs. If authenticated session does not have the FULL_ADMIN role, only jobs owned by the current authenticated session will be returned.

Download logs of the job id.

Please see core.download method documentation for explanation on filename and buffered arguments, and return value.

Utility method which just returns "pong". Can be used to keep connection/authtoken alive instead of using "ping" protocol message.

Method that will send an ICMP echo request to "hostname" and will wait up to "timeout" for a reply.

Resize terminal session (/websocket/shell) to cols x rows

Get currently open websocket sessions.

Set debug_mode for middleware.

Create a new cron job.

stderr and stdout are boolean values which if true, represent that we would like to suppress standard error / standard output respectively.

Create a cron job which executes touch /tmp/testfile after every 5 minutes.

{
    "id": "6841f242-840a-11e6-a437-00e04d680384",
    "msg": "method",
    "method": "cronjob.create",
    "params": [{
        "enabled": true,
        "schedule": {
            "minute": "5",
            "hour": "*",
            "dom": "*",
            "month": "*",
            "dow": "*"
        },
        "command": "touch /tmp/testfile",
        "description": "Test command",
        "user": "root",
        "stderr": true,
        "stdout": true
    }]
}

Delete cronjob of id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Job to run cronjob task of id.

Update cronjob of id.

Get info for SERIAL/DISK/GPU device types.

Retrieve choices for GPU PCI ids located in the system.

This method refreshes the directory services cache for users and groups that is used as a backing for user.query and group.query methods. The first cache fill in an Active Directory domain may take a significant amount of time to complete and so it is performed as within a job. The most likely situation in which a user may desire to refresh the directory services cache is after new users or groups to a remote directory server with the intention to have said users or groups appear in the results of the aforementioned account-related methods.

A cache refresh is not required in order to use newly-added users and groups for in permissions and ACL related methods. Likewise, a cache refresh will not resolve issues with users being unable to authenticate to shares.

DISABLED Directory Service is disabled.

FAULTED Directory Service is enabled, but not HEALTHY. Review logs and generated alert messages to debug the issue causing the service to be in a FAULTED state.

LEAVING Directory Service is in process of stopping.

JOINING Directory Service is in process of starting.

HEALTHY Directory Service is enabled, and last status check has passed.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Return disks that are not in use by any zpool that is currently imported. It will also return disks that are in use by any zpool that is exported.

join_partitions: Bool, when True will return all partitions currently written to disk NOTE: this is an expensive operation

Query disks.

The following extra options are supported:

 include_expired: true - will also include expired disks (default: false)
 passwords: true - will not hide KMIP password for the disks (default: false)
 supports_smart: true - will query if disks support S.M.A.R.T. Only supported if resulting disks count is
                        not larger than one; otherwise, raises an error.
 pools: true - will join pool name for each disk (default: false)

Takes a list of disks. Each list entry is a dict that requires a key, value pair. name: string (the name of the disk (i.e. sda)) size: integer (given in gigabytes) sync: boolean, when true (default) will synchronize the new size of the disk(s) with the database cache. raise_error: boolean when true, will raise a CallError if any failures occur when false, will will log the errors if any failures occur

NOTE: if size is given, the disk with name will be resized to size (overprovision). if size is not given, the disk with name will be resized to it's original size (unoverprovision).

Returns S.M.A.R.T. attributes values for specified disk name.

Returns temperature for device name using specified S.M.A.R.T. powermode. If cache is not null then the last cached within cache seconds value is used.

Returns min/max/avg temperature for names disks for the last days days

Returns existing temperature alerts for specified disk names.

Returns temperatures for a list of devices (runs in parallel). See disk.temperature documentation for more details. If only_cached is specified then this method only returns disk temperatures that exist in cache.

Update disk of id.

If extra options need to be passed to SMART which we don't already support, they can be passed by smartoptions.

critical, informational and difference are integer values on which alerts for SMART are configured if the disk temperature crosses the assigned threshold for each respective attribute. If they are set to null, then SMARTD config values are used as defaults.

Email of log level LOG_CRIT is issued when disk temperature crosses critical.

Email of log level LOG_INFO is issued when disk temperature crosses informational.

If temperature of a disk changes by difference degree Celsius since the last report, SMART reports this.

Performs a wipe of a disk dev. It can be of the following modes: - QUICK: clean the first and last 32 megabytes on dev - FULL: write whole disk with zero's - FULL_RANDOM: write whole disk with random bytes

Query Name Servers with query-filters and query-options.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

This method is only called manually by the end-user so we fully expect that they know what they're doing. Furthermore, this method will only run if failover has NOT been administratively disabled. The reason why we only allow this in that scenario is because the failover logic (on the other node) will ignore any failover "event" that comes in if failover has been administratively disabled. This immediately causes the HA system to go into a "faulted" state because the other node will get the VIPs but it will not import the zpool and it will not start fenced. Only way out of that situation is to manually fix things (import zpool, migrate VIPs, start fenced, etc).

NOTE: The only "safe" way to "become passive" is to use the STCNITH method (similar to STONITH). (i.e. Shoot The Current Node In The Head)

This ensures that the current node gets out of the way completely so there is no chance of the zpool being imported at the same time on both nodes (which can ultimately end in data corruption).

Call a method on the other node.

method name of the method to be called args list of arguments to be passed to method options dictionary with following keys timeout: time to wait for method to return NOTE: This parameter ONLY applies if the remote client is connected to the other node. job: whether or not the method being called is a job job_return: if true, will return immediately and not wait for the job to complete, otherwise will wait for the job to complete callback: a function that will be called as a callback on completion/failure of method. NOTE: Only applies if method is a job connect_timeout: Maximum amount of time in seconds to wait for remote connection to become available. raise_connect_error: If false, will not raise an exception if a connection error to the other node happens, or connection/call timeout happens, or method does not exist on the remote node.

Force this controller to become MASTER, if it's not already.

Get a list of IPs for which the webUI can be accessed.

Returns the hardware type for an HA system. ECHOSTREAM (z-series) ECHOWARP (m-series) LAJOLLA2 (f-series) SUBLIGHT (h-series) PUMA (x-series) BHYVE (HA VMs for CI) IXKVM (HA VMs (on KVM) for CI) MANUAL (everything else)

Returns True if there is an ongoing failover event.

Checks whether this instance is licensed as a HA unit

Returns the slot position in the chassis that the controller is located. A - First node B - Seconde Node MANUAL - slot position in chassis could not be determined

Get the current HA status.

Returns: MASTER BACKUP ELECTING IMPORTING ERROR SINGLE

Sync database and files from the other controller.

Sync database and files to the other controller.

reboot as true will reboot the other controller after syncing.

Unlock datasets in HA, syncing passphrase between controllers and forcing this controller to be MASTER importing the pools.

Update failover state.

disabled When true indicates that HA will be disabled. master Marks the particular node in the chassis as the master node. The standby node will have the opposite value.

timeout is the time to WAIT until a failover occurs when a network event occurs on an interface that is marked critical for failover AND HA is enabled and working appropriately.

The default time to wait is 2 seconds.
**NOTE**
    This setting does NOT effect the `disabled` or `master` parameters.

Upgrades both controllers.

Files will be downloaded to the Active Controller and then transferred to the Standby Controller.

Upgrade process will start concurrently on both nodes.

Once both upgrades are applied, the Standby Controller will reboot. This job will wait for that job to complete before finalizing.

resume should be set to true if a previous call to this method returned a CallError with errno=EAGAIN meaning that an upgrade can be performed with a warning and that warning is accepted. In that case, you also have to set resume_manual to true if a previous call to this method was performed using update file upload.

Perform the last stage of an HA upgrade.

This will activate the new boot environment on the Standby Controller and reboot it.

Verify if HA upgrade is pending.

upgrade_finish needs to be called to finish the HA upgrade process if this method returns true.

Returns a list of reasons why failover is not enabled/functional. See DisabledReasonsEnum for the reasons and their explanation.

Returns True if the ACL can be fully expressed as a file mode without losing any access rules.

Check if username is able to access path with specific permissions. At least one of read/write/execute permission must be specified for checking with each of these defaulting to null. null for read/write/execute represents that the permission should not be checked.

Change owner or group of file at path.

uid and gid specify new owner of the file. If either key is absent or None, then existing value on the file is not changed.

recursive performs action recursively, but does not traverse filesystem mount points.

If traverse and recursive are specified, then the chown operation will traverse filesystem mount points.

DEPRECATED Returns list of names of ACL templates. Wrapper around filesystem.acltemplate.query.

Job to get contents of path.

DEPRECATED Returns a default ACL depending on the usage specified by acl_type. If an admin group is defined, then an entry granting it full control will be placed at the top of the ACL. Optionally may pass share_type to argument to get share-specific template ACL.

Return ACL of a given path. This may return a POSIX1e ACL or a NFSv4 ACL. The acl type is indicated by the acltype key.

simplified - effect of this depends on ACL type on underlying filesystem. In the case of NFSv4 ACLs simplified permissions and flags are returned for ACL entries where applicable. NFSv4 errata below. In the case of POSIX1E ACls, this setting has no impact on returned ACL.

resolve_ids - adds additional who key to each ACL entry, that converts the numeric id to a user name or group name. In the case of owner@ and group@ (NFSv4) or USER_OBJ and GROUP_OBJ (POSIX1E), st_uid or st_gid will be converted from stat() return for file. In the case of MASK (POSIX1E), OTHER (POSIX1E), everyone@ (NFSv4), key who will be included, but set to null. In case of failure to resolve the id to a name, who will be set to null. This option should only be used if resolving ids to names is required.

Errata about ACLType NFSv4:

simplified returns a shortened form of the ACL permset and flags where applicable. If permissions have been simplified, then the perms object will contain only a single BASIC key with a string describing the underlying permissions set.

TRAVERSE sufficient rights to traverse a directory, but not read contents.

READ sufficient rights to traverse a directory, and read file contents.

MODIFIY sufficient rights to traverse, read, write, and modify a file.

FULL_CONTROL all permissions.

If the permisssions do not fit within one of the pre-defined simplified permissions types, then the full ACL entry will be returned.

Retrieves boolean which is set when immutable flag is set on path.

Get the contents of a directory.

Each entry of the list consists of: name(str): name of the file path(str): absolute path of the entry realpath(str): absolute real path of the entry (if SYMLINK) type(str): DIRECTORY | FILE | SYMLINK | OTHER size(int): size of the entry mode(int): file mode/permission uid(int): user id of entry owner gid(int): group id of entry onwer acl(bool): extended ACL is present on file is_mountpoint(bool): path is a mountpoint is_ctldir(bool): path is within special .zfs directory attributes(list): list of statx file attributes that apply to the file. See statx(2) manpage for more details.

Create a directory at the specified path.

The following options are supported:

mode - specify the permissions to set on the new directory (0o755 is default). raise_chmod_error - choose whether to raise an exception if the attempt to set mode fails. In this case, the newly created directory will be removed to prevent use with unintended permissions.

NOTE: if chmod error is skipped, the resulting mode key in mkdir response will indicate the current permissions on the directory and not the permissions specified in the mkdir payload

Job to put contents to path.

Set/Unset immutable flag at path.

set_flag when set will set immutable flag and when unset will unset immutable flag at path.

Set ACL of a given path. Takes the following parameters: path full path to directory or file.

dacl ACL entries. Formatting depends on the underlying acltype. NFS4ACL requires NFSv4 entries. POSIX1e requires POSIX1e entries.

uid the desired UID of the file user. If set to None (the default), then user is not changed.

gid the desired GID of the file group. If set to None (the default), then group is not changed.

recursive apply the ACL recursively

traverse traverse filestem boundaries (ZFS datasets)

strip convert ACL to trivial. ACL is trivial if it can be expressed as a file mode without losing any access rules.

canonicalize reorder ACL entries so that they are in concanical form as described in the Microsoft documentation MS-DTYP 2.4.5 (ACL). This only applies to NFSv4 ACLs.

For case of NFSv4 ACLs USER_OBJ, GROUP_OBJ, and EVERYONE with owner@, group@, everyone@ for consistency with getfacl and setfacl. If one of aforementioned special tags is used, 'id' must be set to None.

An inheriting empty everyone@ ACE is appended to non-trivial ACLs in order to enforce Windows expectations regarding permissions inheritance. This entry is removed from NT ACL returned to SMB clients when 'ixnas' samba VFS module is enabled.

Set unix permissions on given path.

If mode is specified then the mode will be applied to the path and files and subdirectories depending on which options are selected. Mode should be formatted as string representation of octal permissions bits.

uid the desired UID of the file user. If set to None (the default), then user is not changed.

gid the desired GID of the file group. If set to None (the default), then group is not changed.

stripacl setperm will fail if an extended ACL is present on path, unless stripacl is set to True.

recursive remove ACLs recursively, but do not traverse dataset boundaries.

traverse remove ACLs from child datasets.

If no mode is set, and stripacl is True, then non-trivial ACLs will be converted to trivial ACLs. An ACL is trivial if it can be expressed as a file mode without losing any access rules.

Return the filesystem stat(2) for a given path.

Return stats from the filesystem of a given path.

Raises: CallError(ENOENT) - Path not found

Retrieve list of available ACL templates for a given path.

Supports query-filters and query-options. format-options gives additional options to alter the results of the template query:

canonicalize - place ACL entries for NFSv4 ACLs in Microsoft canonical order. ensure_builtins - ensure all results contain entries for builtin_users and builtin_administrators groups. resolve_names - convert ids in ACL entries into names.

Create a new filesystem ACL template.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

update filesystem ACL template with id.

Update ftp service configuration.

clients is an integer value which sets the maximum number of simultaneous clients allowed. It defaults to 32.

ipconnections is an integer value which shows the maximum number of connections per IP address. It defaults to 0 which equals to unlimited.

timeout is the maximum number of seconds that proftpd will allow clients to stay connected without receiving any data on either the control or data connection.

timeout_notransfer is the maximum number of seconds a client is allowed to spend connected, after authentication, without issuing a command which results in creating an active or passive data connection (i.e. sending/receiving a file, or receiving a directory listing).

rootlogin is a boolean value which when configured to true enables login as root. This is generally discouraged because of the security risks.

onlyanonymous allows anonymous FTP logins with access to the directory specified by anonpath.

banner is a message displayed to local login users after they successfully authenticate. It is not displayed to anonymous login users.

filemask sets the default permissions for newly created files which by default are 077.

dirmask sets the default permissions for newly created directories which by default are 077.

resume if set allows FTP clients to resume interrupted transfers.

fxp if set to true indicates that File eXchange Protocol is enabled. Generally it is discouraged as it makes the server vulnerable to FTP bounce attacks.

defaultroot when set ensures that for local users, home directory access is only granted if the user is a member of group wheel.

ident is a boolean value which when set to true indicates that IDENT authentication is required. If identd is not running on the client, this can result in timeouts.

masqaddress is the public IP address or hostname which is set if FTP clients cannot connect through a NAT device.

localuserbw is a positive integer value which indicates maximum upload bandwidth in KB/s for local user. Default of zero indicates unlimited upload bandwidth ( from the FTP server configuration ).

localuserdlbw is a positive integer value which indicates maximum download bandwidth in KB/s for local user. Default of zero indicates unlimited download bandwidth ( from the FTP server configuration ).

anonuserbw is a positive integer value which indicates maximum upload bandwidth in KB/s for anonymous user. Default of zero indicates unlimited upload bandwidth ( from the FTP server configuration ).

anonuserdlbw is a positive integer value which indicates maximum download bandwidth in KB/s for anonymous user. Default of zero indicates unlimited download bandwidth ( from the FTP server configuration ).

tls is a boolean value which when set indicates that encrypted connections are enabled. This requires a certificate to be configured first with the certificate service and the id of certificate is passed on in ssltls_certificate.

tls_policy defines whether the control channel, data channel, both channels, or neither channel of an FTP session must occur over SSL/TLS.

tls_opt_enable_diags is a boolean value when set, logs verbosely. This is helpful when troubleshooting a connection.

options is a string used to add proftpd(8) parameters not covered by ftp service.

Create a new group.

If gid is not provided it is automatically filled with the next one available.

allow_duplicate_gid allows distinct group names to share the same gid.

users is a list of user ids (id attribute from user.query).

smb specifies whether the group should be mapped into an NT group.

Delete group id.

The delete_users option deletes all users that have this group as their primary group.

Returns dictionary containing information from struct grp for the group specified by either the groupname or gid. Bypasses group cache.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Get the next available/free gid.

Checks whether at least one local user with a password is a member of any of the group_ids.

Query groups with query-filters and query-options. As a performance optimization, only local groups will be queried by default.

Expanded information may be requested by specifying the extra option "extra": {"additional_information": []}.

The following additional_information options are supported: SMB - include Windows SID and NT Name for group. If this option is not specified, then these keys will have null value. DS - include groups from Directory Service (LDAP or Active Directory) in results

"extra": {"search_dscache": true} is a legacy method of querying for directory services groups.

Update attributes of an existing group.

Return available cpu governors

Returns currently set cpu governor

Set the cpu governor to governor on all cpus

Returns array of valid idmap backend choices per directory service.

This returns full information about idmap backend options. Not all options are valid for every backend.

Stop samba, remove the winbindd_cache.tdb file, start samba, flush samba's cache. This should be performed after finalizing idmap changes.

Create a new IDMAP domain. These domains must be unique. This table will be automatically populated after joining an Active Directory domain if "allow trusted domains" is set to True in the AD service configuration. There are three default system domains: DS_TYPE_ACTIVEDIRECTORY, DS_TYPE_LDAP, DS_TYPE_DEFAULT_DOMAIN. The system domains correspond with the idmap settings under Active Directory, LDAP, and SMB respectively.

name the pre-windows 2000 domain name.

DNS_domain_name DNS name of the domain.

idmap_backend provides a plugin interface for Winbind to use varying backends to store SID/uid/gid mapping tables. The correct setting depends on the environment in which the NAS is deployed.

range_low and range_high specify the UID and GID range for which this backend is authoritative.

certificate_id references the certificate ID of the SSL certificate to use for certificate-based authentication to a remote LDAP server. This parameter is not supported for all idmap backends as some backends will generate SID to ID mappings algorithmically without causing network traffic.

options are additional parameters that are backend-dependent:

AD idmap backend options: unix_primary_group If True, the primary group membership is fetched from the LDAP attributes (gidNumber). If False, the primary group membership is calculated via the "primaryGroupID" LDAP attribute.

unix_nss_info if True winbind will retrieve the login shell and home directory from the LDAP attributes. If False or if the AD LDAP entry lacks the SFU attributes the smb4.conf parameters template shell and template homedir are used.

schema_mode Defines the schema that idmap_ad should use when querying Active Directory regarding user and group information. This can be either the RFC2307 schema support included in Windows 2003 R2 or the Service for Unix (SFU) schema. For SFU 3.0 or 3.5 please choose "SFU", for SFU 2.0 please choose "SFU20". The behavior of primary group membership is controlled by the unix_primary_group option.

AUTORID idmap backend options: readonly sets the module to read-only mode. No new ranges will be allocated and new mappings will not be created in the idmap pool.

ignore_builtin ignores mapping requests for the BUILTIN domain.

LDAP idmap backend options: ldap_base_dn defines the directory base suffix to use for SID/uid/gid mapping entries.

ldap_user_dn defines the user DN to be used for authentication.

ldap_url specifies the LDAP server to use for SID/uid/gid map entries.

ssl specifies whether to encrypt the LDAP transport for the idmap backend.

NSS idmap backend options: linked_service specifies the auxiliary directory service ID provider.

RFC2307 idmap backend options: domain specifies the domain for which the idmap backend is being created. Numeric id, short-form domain name, or long-form DNS domain name of the domain may be specified. Entry must be entered as it appears in idmap.domain.

range_low and range_high specify the UID and GID range for which this backend is authoritative.

ldap_server defines the type of LDAP server to use. This can either be an LDAP server provided by the Active Directory Domain (ad) or a stand-alone LDAP server.

bind_path_user specfies the search base where user objects can be found in the LDAP server.

bind_path_group specifies the search base where group objects can be found in the LDAP server.

user_cn query cn attribute instead of uid attribute for the user name in LDAP.

realm append @realm to cn for groups (and users if user_cn is set) in LDAP queries.

ldmap_domain when using the LDAP server in the Active Directory server, this allows one to specify the domain where to access the Active Directory server. This allows using trust relationships while keeping all RFC 2307 records in one place. This parameter is optional, the default is to access the AD server in the current domain to query LDAP records.

ldap_url when using a stand-alone LDAP server, this parameter specifies the LDAP URL for accessing the LDAP server.

ldap_user_dn defines the user DN to be used for authentication.

ldap_user_dn_password is the password to be used for LDAP authentication.

realm defines the realm to use in the user and group names. This is only required when using cn_realm together with a stand-alone ldap server.

RID backend options: sssd_compat generate idmap low range based on same algorithm that SSSD uses by default.

Delete a domain by id. Deletion of default system domains is not permitted.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Returns a list of supported keys for the specified idmap backend.

Update a domain by id.

Create an initshutdown script task.

type indicates if a command or script should be executed at when.

There are three choices for when:

1) PREINIT - This is early in the boot process before all the services have started 2) POSTINIT - This is late in the boot process when most of the services have started 3) SHUTDOWN - This is on shutdown

timeout is an integer value which indicates time in seconds which the system should wait for the execution of script/command. It should be noted that a hard limit for a timeout is configured by the base OS, so when a script/command is set to execute on SHUTDOWN, the hard limit configured by the base OS is changed adding the timeout specified by script/command so it can be ensured that it executes as desired and is not interrupted by the base OS's limit.

Delete init/shutdown task of id.

Returns instance matching id. If id is not found, Validation error is raised.

Please see query method documentation for options.

Update initshutdown script task of id.

Return available interface choices that can be added to a br (bridge) interface.

id is name of existing bridge interface on the system that will have its member interfaces included.

If this method is called after interface changes have been committed and within the checkin timeout, then the task that automatically rollsback any interface changes is cancelled and the in-memory snapshot of database tables for the various interface tables will NOT be cleared.

If this method is called after interface changes have been committed and within the checkin timeout, then the task that automatically rollsback any interface changes is cancelled and the in-memory snapshot of database tables for the various interface tables will be cleared. The idea is that the end-user has verified the changes work as intended and need to be committed permanently.