From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id F193F1FF16B for ; Fri, 26 Sep 2025 11:18:40 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id A0F2FBD83; Fri, 26 Sep 2025 11:19:13 +0200 (CEST) Date: Fri, 26 Sep 2025 11:18:37 +0200 From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= To: Proxmox Datacenter Manager development discussion References: <20250924145137.407070-1-s.sterz@proxmox.com> <20250924145137.407070-9-s.sterz@proxmox.com> In-Reply-To: <20250924145137.407070-9-s.sterz@proxmox.com> MIME-Version: 1.0 User-Agent: astroid/0.17.0 (https://github.com/astroidmail/astroid) Message-Id: <1758878085.9rkx5o98e5.astroid@yuna.none> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1758878305367 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.049 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: Re: [pdm-devel] [PATCH datacenter-manager 3/3] server: clean up acl tree entries and api tokens when deleting users X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" On September 24, 2025 4:51 pm, Shannon Sterz wrote: > Signed-off-by: Shannon Sterz > --- > server/src/api/access/users.rs | 39 +++++++++++++++++++++++++++++----- > 1 file changed, 34 insertions(+), 5 deletions(-) > > diff --git a/server/src/api/access/users.rs b/server/src/api/access/users.rs > index da598d8..1d1accb 100644 > --- a/server/src/api/access/users.rs > +++ b/server/src/api/access/users.rs > @@ -334,20 +334,19 @@ pub fn update_user( > /// Remove a user from the configuration file. > pub fn delete_user(userid: Userid, digest: Option) -> Result<(), Error> { > let _lock = proxmox_access_control::user::lock_config()?; > + let _acl_lock = proxmox_access_control::acl::lock_config()?; > let _tfa_lock = crate::auth::tfa::write_lock()?; > > - let (mut config, config_digest) = proxmox_access_control::user::config()?; > + let (mut user_config, config_digest) = proxmox_access_control::user::config()?; > config_digest.detect_modification(digest.as_ref())?; > > - match config.sections.get(userid.as_str()) { > + match user_config.sections.get(userid.as_str()) { > Some(_) => { > - config.sections.remove(userid.as_str()); > + user_config.sections.remove(userid.as_str()); > } > None => bail!("user '{}' does not exist.", userid), > } > > - proxmox_access_control::user::save_config(&config)?; > - > let authenticator = crate::auth::lookup_authenticator(userid.realm())?; > match authenticator.remove_password(userid.name()) { > Ok(()) => {} > @@ -375,6 +374,36 @@ pub fn delete_user(userid: Userid, digest: Option) -> Result<(), E > } > } > > + let user_tokens: Vec = user_config > + .convert_to_typed_array::("token")? > + .into_iter() > + .filter(|token| token.tokenid.user().eq(&userid)) > + .collect(); do we have any consistency checks between ACLs and users/tokens? if not, then.. > + > + let (mut acl_config, _digest) = proxmox_access_control::acl::config()?; > + > + let auth_id = userid.clone().into(); > + acl_config.delete_authid(&auth_id); > + > + for token in user_tokens { > + if let Some(token_name) = token.tokenid.tokenname() { > + let tokenid = Authid::from((userid.clone(), Some(token_name.to_owned()))); > + let tokenid_string = tokenid.to_string(); > + if user_config.sections.remove(&tokenid_string).is_none() { > + bail!( > + "token '{}' of user '{userid}' does not exist.", > + token_name.as_str() > + ); > + } > + > + proxmox_access_control::token_shadow::delete_secret(&tokenid)?; > + acl_config.delete_authid(&tokenid); this is not enough to remove all ACLs, since removing a token via the token API currently does not clean up its ACL entries.. > + } > + } > + > + proxmox_access_control::user::save_config(&user_config)?; > + proxmox_access_control::acl::save_config(&acl_config)?; > + > Ok(()) > } > > -- > 2.47.3 > > > > _______________________________________________ > pdm-devel mailing list > pdm-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel > > > _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel