* [pdm-devel] [PATCH yew-comp v2 2/5] login_panel/realm_selector: add support for openid realm logins
2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 1/5] login_panel/realm_selector: use default realm provided by api Shannon Sterz
@ 2025-10-17 13:57 ` Shannon Sterz
2025-10-22 17:03 ` [pdm-devel] applied: " Thomas Lamprecht
2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 3/5] auth view: add openid icon to openid menu option Shannon Sterz
` (5 subsequent siblings)
7 siblings, 1 reply; 17+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:57 UTC (permalink / raw)
To: pdm-devel
this commit adds support for the openid login flow. it also modifies
the realm selector so that the currently selected realm can be
communicated to the login panel, which can then only render the fields
necessary for an openid realm.
the future handling the openid login request is intentionally spawned
with `wasm_bindgen_futures::spawn_local` so that it does not get
aborted when the view is re-rendered by the CatalogueLoader. it is
also wrapped in a OnceLock to avoid making the call several times.
Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
src/login_panel.rs | 328 +++++++++++++++++++++++++++++++++---------
src/realm_selector.rs | 26 +++-
2 files changed, 285 insertions(+), 69 deletions(-)
diff --git a/src/login_panel.rs b/src/login_panel.rs
index e182a5d..9d1d5d6 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -1,5 +1,9 @@
+use std::collections::HashMap;
use std::rc::Rc;
+use std::sync::OnceLock;
+use proxmox_login::api::CreateTicketResponse;
+use pwt::css::ColorScheme;
use pwt::props::PwtSpace;
use pwt::state::PersistentState;
use pwt::touch::{SnackBar, SnackBarContextExt};
@@ -11,12 +15,15 @@ use pwt::widget::form::{Checkbox, Field, Form, FormContext, InputType, ResetButt
use pwt::widget::{Column, FieldLabel, InputPanel, LanguageSelector, Mask, Row};
use pwt::{prelude::*, AsyncPool};
-use proxmox_login::{Authentication, SecondFactorChallenge, TicketResult};
+use proxmox_login::{Authentication, SecondFactorChallenge, Ticket, TicketResult};
+use crate::common_api_types::BasicRealmInfo;
use crate::{tfa::TfaDialog, RealmSelector};
use pwt_macros::builder;
+static OPENID_LOGIN: OnceLock<()> = OnceLock::new();
+
/// Proxmox login panel
///
/// Should support all proxmox product and TFA.
@@ -73,6 +80,9 @@ pub enum Msg {
Yubico(String),
RecoveryKey(String),
WebAuthn(String),
+ UpdateRealm(BasicRealmInfo),
+ OpenIDLogin,
+ OpenIDAuthorization(HashMap<String, String>),
}
pub struct ProxmoxLoginPanel {
@@ -83,6 +93,7 @@ pub struct ProxmoxLoginPanel {
save_username: PersistentState<bool>,
last_username: PersistentState<String>,
async_pool: AsyncPool,
+ selected_realm: Option<BasicRealmInfo>,
}
impl ProxmoxLoginPanel {
@@ -125,6 +136,121 @@ impl ProxmoxLoginPanel {
});
}
+ fn openid_redirect(&self, ctx: &Context<Self>) {
+ let link = ctx.link().clone();
+ let Some(realm) = self.selected_realm.as_ref() else {
+ return;
+ };
+ let Ok(location) = gloo_utils::window().location().origin() else {
+ return;
+ };
+
+ let data = serde_json::json!({
+ "realm": realm.realm,
+ "redirect-url": location,
+ });
+
+ self.async_pool.spawn(async move {
+ match crate::http_post::<String>("/access/openid/auth-url", Some(data)).await {
+ Ok(data) => {
+ let _ = gloo_utils::window().location().assign(&data);
+ }
+ Err(err) => {
+ link.send_message(Msg::LoginError(err.to_string()));
+ }
+ }
+ });
+ }
+
+ fn openid_redirection_authorization(ctx: &Context<Self>) {
+ let Ok(query_string) = gloo_utils::window().location().search() else {
+ return;
+ };
+
+ let mut auth = HashMap::new();
+ let query_parameters = query_string.split('&');
+
+ for param in query_parameters {
+ let mut key_value = param.split('=');
+
+ match (key_value.next(), key_value.next()) {
+ (Some("?code") | Some("code"), Some(value)) => {
+ auth.insert("code".to_string(), value.to_string());
+ }
+ (Some("?state") | Some("state"), Some(value)) => {
+ if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
+ auth.insert("state".to_string(), decoded.to_string());
+ }
+ }
+ _ => continue,
+ };
+ }
+
+ if auth.contains_key("code") && auth.contains_key("state") {
+ ctx.link().send_message(Msg::OpenIDAuthorization(auth));
+ }
+ }
+
+ fn openid_login(&self, ctx: &Context<Self>, mut auth: HashMap<String, String>) {
+ let link = ctx.link().clone();
+ let save_username = ctx.props().mobile || *self.save_username;
+ let Ok(origin) = gloo_utils::window().location().origin() else {
+ return;
+ };
+
+ auth.insert("redirect-url".into(), origin.clone());
+
+ let Ok(auth) = serde_json::to_value(auth) else {
+ return;
+ };
+
+ // run this only once, an openid state is only valid for one round trip. so resending it
+ // here will just fail. also use an unabortable future here for the same reason. otherwise
+ // we could be interrupted by, for example, the catalog loader needing to re-render the
+ // app.
+ OPENID_LOGIN.get_or_init(|| {
+ wasm_bindgen_futures::spawn_local(async move {
+ match crate::http_post::<CreateTicketResponse>("/access/openid/login", Some(auth))
+ .await
+ {
+ Ok(creds) => {
+ let Some(ticket) = creds
+ .ticket
+ .or(creds.ticket_info)
+ .and_then(|t| t.parse::<Ticket>().ok())
+ else {
+ log::error!("neither ticket nor ticket-info in openid login response!");
+ return;
+ };
+
+ let Some(csrfprevention_token) = creds.csrfprevention_token else {
+ log::error!("no CSRF prevention token in the openid login response!");
+ return;
+ };
+
+ let auth = Authentication {
+ api_url: "".to_string(),
+ userid: creds.username,
+ ticket,
+ clustername: None,
+ csrfprevention_token,
+ };
+
+ // update the authentication, set the realm and user for the next login and
+ // reload without the query parameters.
+ crate::http_set_auth(auth.clone());
+ if save_username {
+ PersistentState::<String>::new("ProxmoxLoginPanelUsername")
+ .update(auth.userid.clone());
+ }
+ let _ = gloo_utils::window().location().assign(&origin);
+ }
+ Err(err) => link.send_message(Msg::LoginError(err.to_string())),
+ }
+ });
+ });
+ }
+
fn get_defaults(&self, props: &LoginPanel) -> (String, Option<AttrValue>) {
let mut default_username = String::from("root");
let mut default_realm = props.default_realm.clone();
@@ -161,36 +287,64 @@ impl ProxmoxLoginPanel {
.on_webauthn(ctx.link().callback(Msg::WebAuthn))
});
- let form_panel = Column::new()
+ let mut form_panel = Column::new()
.class(pwt::css::FlexFit)
.padding(2)
- .with_flex_spacer()
- .with_child(
- FieldLabel::new(tr!("User name"))
- .id(username_label_id.clone())
- .padding_bottom(PwtSpace::Em(0.25)),
- )
- .with_child(
- Field::new()
- .name("username")
- .label_id(username_label_id)
- .default(default_username)
- .required(true)
- .autofocus(true),
- )
- .with_child(
- FieldLabel::new(tr!("Password"))
- .id(password_label_id.clone())
- .padding_top(1)
- .padding_bottom(PwtSpace::Em(0.25)),
- )
- .with_child(
- Field::new()
- .name("password")
- .label_id(password_label_id)
- .required(true)
- .input_type(InputType::Password),
- )
+ .with_flex_spacer();
+
+ if self
+ .selected_realm
+ .as_ref()
+ .map(|r| r.ty != "openid")
+ .unwrap_or(true)
+ {
+ form_panel = form_panel
+ .with_child(
+ FieldLabel::new(tr!("User name"))
+ .id(username_label_id.clone())
+ .padding_bottom(PwtSpace::Em(0.25)),
+ )
+ .with_child(
+ Field::new()
+ .name("username")
+ .label_id(username_label_id)
+ .default(default_username)
+ .required(true)
+ .autofocus(true),
+ )
+ .with_child(
+ FieldLabel::new(tr!("Password"))
+ .id(password_label_id.clone())
+ .padding_top(1)
+ .padding_bottom(PwtSpace::Em(0.25)),
+ )
+ .with_child(
+ Field::new()
+ .name("password")
+ .label_id(password_label_id)
+ .input_type(InputType::Password),
+ );
+ }
+
+ let submit_button = SubmitButton::new().class(ColorScheme::Primary).margin_y(4);
+
+ let submit_button = if self
+ .selected_realm
+ .as_ref()
+ .map(|r| r.ty == "openid")
+ .unwrap_or_default()
+ {
+ submit_button
+ .text(tr!("Login (OpenID redirect)"))
+ .check_dirty(false)
+ .on_submit(link.callback(move |_| Msg::OpenIDLogin))
+ } else {
+ submit_button
+ .text(tr!("Login"))
+ .on_submit(link.callback(move |_| Msg::Submit))
+ };
+
+ let form_panel = form_panel
.with_child(
FieldLabel::new(tr!("Realm"))
.id(realm_label_id.clone())
@@ -202,15 +356,13 @@ impl ProxmoxLoginPanel {
.name("realm")
.label_id(realm_label_id)
.path(props.domain_path.clone())
+ .on_change({
+ let link = link.clone();
+ move |r: BasicRealmInfo| link.send_message(Msg::UpdateRealm(r))
+ })
.default(default_realm),
)
- .with_child(
- SubmitButton::new()
- .class("pwt-scheme-primary")
- .margin_y(4)
- .text(tr!("Login"))
- .on_submit(link.callback(move |_| Msg::Submit)),
- )
+ .with_child(submit_button)
.with_optional_child(self.login_error.as_ref().map(|msg| {
let icon_class = classes!("fa-lg", "fa", "fa-align-center", "fa-exclamation-triangle");
let text = tr!("Login failed. Please try again ({0})", msg);
@@ -244,32 +396,46 @@ impl ProxmoxLoginPanel {
let (default_username, default_realm) = self.get_defaults(props);
- let input_panel = InputPanel::new()
+ let mut input_panel = InputPanel::new()
.class(pwt::css::Overflow::Auto)
.width("initial") // don't try to minimize size
- .padding(4)
- .with_field(
- tr!("User name"),
- Field::new()
- .name("username")
- .default(default_username)
- .required(true)
- .autofocus(true),
- )
- .with_field(
- tr!("Password"),
- Field::new()
- .name("password")
- .required(true)
- .input_type(InputType::Password),
- )
- .with_field(
- tr!("Realm"),
- RealmSelector::new()
- .name("realm")
- .path(props.domain_path.clone())
- .default(default_realm),
- );
+ .padding(4);
+
+ if self
+ .selected_realm
+ .as_ref()
+ .map(|r| r.ty != "openid")
+ .unwrap_or(true)
+ {
+ input_panel = input_panel
+ .with_field(
+ tr!("User name"),
+ Field::new()
+ .name("username")
+ .default(default_username)
+ .required(true)
+ .autofocus(true),
+ )
+ .with_field(
+ tr!("Password"),
+ Field::new()
+ .name("password")
+ .required(true)
+ .input_type(InputType::Password),
+ );
+ }
+
+ let input_panel = input_panel.with_field(
+ tr!("Realm"),
+ RealmSelector::new()
+ .name("realm")
+ .path(props.domain_path.clone())
+ .on_change({
+ let link = link.clone();
+ move |r: BasicRealmInfo| link.send_message(Msg::UpdateRealm(r))
+ })
+ .default(default_realm),
+ );
let tfa_dialog = self.challenge.as_ref().map(|challenge| {
TfaDialog::new(challenge.clone())
@@ -292,6 +458,24 @@ impl ProxmoxLoginPanel {
.with_child(html! {<label id={save_username_label_id} style="user-select:none;">{tr!("Save User name")}</label>})
.with_child(save_username_field);
+ let submit_button = SubmitButton::new().class(ColorScheme::Primary);
+
+ let submit_button = if self
+ .selected_realm
+ .as_ref()
+ .map(|r| r.ty == "openid")
+ .unwrap_or_default()
+ {
+ submit_button
+ .text(tr!("Login (OpenID redirect)"))
+ .check_dirty(false)
+ .on_submit(link.callback(move |_| Msg::OpenIDLogin))
+ } else {
+ submit_button
+ .text(tr!("Login"))
+ .on_submit(link.callback(move |_| Msg::Submit))
+ };
+
let toolbar = Row::new()
.padding(2)
.gap(2)
@@ -301,12 +485,7 @@ impl ProxmoxLoginPanel {
.with_flex_spacer()
.with_child(save_username)
.with_child(ResetButton::new())
- .with_child(
- SubmitButton::new()
- .class("pwt-scheme-primary")
- .text(tr!("Login"))
- .on_submit(link.callback(move |_| Msg::Submit)),
- );
+ .with_child(submit_button);
let form_panel = Column::new()
.class(pwt::css::FlexFit)
@@ -342,6 +521,8 @@ impl Component for ProxmoxLoginPanel {
let save_username = PersistentState::<bool>::new("ProxmoxLoginPanelSaveUsername");
let last_username = PersistentState::<String>::new("ProxmoxLoginPanelUsername");
+ Self::openid_redirection_authorization(ctx);
+
Self {
form_ctx,
loading: false,
@@ -350,6 +531,7 @@ impl Component for ProxmoxLoginPanel {
save_username,
last_username,
async_pool: AsyncPool::new(),
+ selected_realm: None,
}
}
@@ -483,6 +665,20 @@ impl Component for ProxmoxLoginPanel {
}
true
}
+ Msg::UpdateRealm(realm) => {
+ self.selected_realm = Some(realm);
+ true
+ }
+ Msg::OpenIDLogin => {
+ self.loading = true;
+ self.openid_redirect(ctx);
+ false
+ }
+ Msg::OpenIDAuthorization(auth) => {
+ self.loading = true;
+ self.openid_login(ctx, auth);
+ false
+ }
}
}
diff --git a/src/realm_selector.rs b/src/realm_selector.rs
index a882e39..305e544 100644
--- a/src/realm_selector.rs
+++ b/src/realm_selector.rs
@@ -1,4 +1,5 @@
use anyhow::{format_err, Error};
+use html::IntoEventCallback;
use std::rc::Rc;
use yew::html::IntoPropValue;
@@ -47,6 +48,11 @@ pub struct RealmSelector {
#[builder(IntoPropValue, into_prop_value)]
#[prop_or("/access/domains".into())]
pub path: AttrValue,
+
+ /// Change callback
+ #[builder_cb(IntoEventCallback, into_event_callback, BasicRealmInfo)]
+ #[prop_or_default]
+ pub on_change: Option<Callback<BasicRealmInfo>>,
}
impl Default for RealmSelector {
@@ -131,10 +137,15 @@ impl Component for ProxmoxRealmSelector {
.as_ref()
.and_then(|d| data.iter().find(|r| &r.realm == d))
.or_else(|| data.iter().find(|r| r.default.unwrap_or_default()))
- .or_else(|| data.iter().find(|r| r.ty == "pam"))
- .map(|r| AttrValue::from(r.realm.clone()));
+ .or_else(|| data.iter().find(|r| r.ty == "pam"));
- self.loaded_default_realm = realm;
+ if let Some(cb) = ctx.props().on_change.as_ref() {
+ if let Some(realm) = realm {
+ cb.emit(realm.clone());
+ }
+ }
+
+ self.loaded_default_realm = realm.map(|r| AttrValue::from(r.realm.clone()));
self.store.set_data(data);
true
}
@@ -153,12 +164,21 @@ impl Component for ProxmoxRealmSelector {
.or_else(|| self.loaded_default_realm.clone())
.unwrap_or(AttrValue::from("pam"));
+ let on_change = props.on_change.clone().map(|c| {
+ Callback::from(move |k| {
+ if let Some(realm) = store.read().lookup_record(&k) {
+ c.emit(realm.clone());
+ }
+ })
+ });
+
Selector::new(self.store.clone(), self.picker.clone())
.with_std_props(&props.std_props)
.with_input_props(&props.input_props)
.required(true)
.default(&default)
.validate(self.validate.clone())
+ .on_change(on_change)
// force re-render of the selector after load; returning `true` in update does not
// re-render the selector by itself
.key(format!("realm-selector-{default}"))
--
2.47.3
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 17+ messages in thread* [pdm-devel] [PATCH datacenter-manager v2 2/3] server: api: add support for adding openid realms and openid logins
2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
` (5 preceding siblings ...)
2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] api-types: add default field to openid realm config Shannon Sterz
@ 2025-10-17 13:58 ` Shannon Sterz
2025-10-22 17:22 ` [pdm-devel] applied: " Thomas Lamprecht
2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] ui: enable openid realms in realm panel Shannon Sterz
7 siblings, 1 reply; 17+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:58 UTC (permalink / raw)
To: pdm-devel
only supports the new HttpOnly authentication flow, as PDM does not
support non-HttpOnly authentication at the moment.
Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
Cargo.toml | 2 +-
server/Cargo.toml | 1 +
server/src/api/access/mod.rs | 2 +
server/src/api/access/openid.rs | 284 ++++++++++++++++++++++++
server/src/api/config/access/mod.rs | 2 +
server/src/api/config/access/openid.rs | 289 +++++++++++++++++++++++++
server/src/auth/mod.rs | 6 +-
7 files changed, 584 insertions(+), 2 deletions(-)
create mode 100644 server/src/api/access/openid.rs
create mode 100644 server/src/api/config/access/openid.rs
diff --git a/Cargo.toml b/Cargo.toml
index f820409..39a0b23 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ proxmox-uuid = "1"
# other proxmox crates
proxmox-acme = "0.5"
-proxmox-openid = "0.10"
+proxmox-openid = "1.0.2"
# api implementation creates
proxmox-config-digest = "1"
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 0dfcb6c..94420b4 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -44,6 +44,7 @@ proxmox-lang.workspace = true
proxmox-ldap.workspace = true
proxmox-log.workspace = true
proxmox-login.workspace = true
+proxmox-openid.workspace = true
proxmox-rest-server = { workspace = true, features = [ "templates" ] }
proxmox-router = { workspace = true, features = [ "cli", "server"] }
proxmox-rrd.workspace = true
diff --git a/server/src/api/access/mod.rs b/server/src/api/access/mod.rs
index 345b22f..a6874a5 100644
--- a/server/src/api/access/mod.rs
+++ b/server/src/api/access/mod.rs
@@ -14,6 +14,7 @@ use proxmox_sortable_macro::sortable;
use pdm_api_types::{Authid, ACL_PATH_SCHEMA, PRIVILEGES, PRIV_ACCESS_AUDIT};
mod domains;
+mod openid;
mod tfa;
mod users;
@@ -33,6 +34,7 @@ const SUBDIRS: SubdirMap = &sorted!([
.post(&proxmox_auth_api::api::API_METHOD_CREATE_TICKET_HTTP_ONLY)
.delete(&proxmox_auth_api::api::API_METHOD_LOGOUT),
),
+ ("openid", &openid::ROUTER),
("users", &users::ROUTER),
]);
diff --git a/server/src/api/access/openid.rs b/server/src/api/access/openid.rs
new file mode 100644
index 0000000..1dccb29
--- /dev/null
+++ b/server/src/api/access/openid.rs
@@ -0,0 +1,284 @@
+//! OpenID redirect/login API
+use anyhow::{bail, format_err, Error};
+use hyper::http::request::Parts;
+use hyper::Response;
+use serde_json::{json, Value};
+
+use proxmox_access_control::types::{User, EMAIL_SCHEMA, FIRST_NAME_SCHEMA, LAST_NAME_SCHEMA};
+use proxmox_access_control::CachedUserInfo;
+use proxmox_auth_api::api::{assemble_csrf_prevention_token, ApiTicket, AuthContext};
+use proxmox_auth_api::ticket::Ticket;
+use proxmox_auth_api::types::{CreateTicketResponse, Userid};
+use proxmox_lang::try_block;
+use proxmox_openid::{OpenIdAuthenticator, OpenIdConfig};
+use proxmox_router::{
+ http_err, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
+ Router, RpcEnvironment, SubdirMap,
+};
+use proxmox_schema::{api, ApiType, ObjectSchema, ParameterSchema, StringSchema};
+use proxmox_sortable_macro::sortable;
+
+use pdm_api_types::{
+ OpenIdRealmConfig, HTTP_URL_SCHEMA, OPENID_DEFAULT_SCOPE_LIST, REALM_ID_SCHEMA,
+};
+use pdm_buildcfg::PDM_RUN_DIR_M;
+
+use crate::auth;
+
+fn openid_authenticator(
+ realm_config: &OpenIdRealmConfig,
+ redirect_url: &str,
+) -> Result<OpenIdAuthenticator, Error> {
+ let scopes: Vec<String> = realm_config
+ .scopes
+ .as_deref()
+ .unwrap_or(OPENID_DEFAULT_SCOPE_LIST)
+ .split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+ .filter(|s| !s.is_empty())
+ .map(String::from)
+ .collect();
+
+ let mut acr_values = None;
+ if let Some(ref list) = realm_config.acr_values {
+ acr_values = Some(
+ list.split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+ .filter(|s| !s.is_empty())
+ .map(String::from)
+ .collect(),
+ );
+ }
+
+ let config = OpenIdConfig {
+ issuer_url: realm_config.issuer_url.clone(),
+ client_id: realm_config.client_id.clone(),
+ client_key: realm_config.client_key.clone(),
+ prompt: realm_config.prompt.clone(),
+ scopes: Some(scopes),
+ acr_values,
+ };
+ OpenIdAuthenticator::discover(&config, redirect_url)
+}
+
+#[sortable]
+pub const API_METHOD_OPENID_LOGIN: ApiMethod = ApiMethod::new_full(
+ &ApiHandler::AsyncHttpBodyParameters(&create_ticket_http_only),
+ ParameterSchema::Object(&ObjectSchema::new(
+ "Get a new ticket as an HttpOnly cookie. Supports tickets via cookies.",
+ &sorted!([
+ ("state", false, &StringSchema::new("OpenId state.").schema()),
+ (
+ "code",
+ false,
+ &StringSchema::new("OpenId authorization code.").schema(),
+ ),
+ (
+ "redirect-url",
+ false,
+ &StringSchema::new(
+ "Redirection Url. The client should set this to used server url.",
+ )
+ .schema(),
+ ),
+ ]),
+ )),
+)
+.returns(::proxmox_schema::ReturnType::new(
+ false,
+ &CreateTicketResponse::API_SCHEMA,
+))
+.protected(true)
+.access(None, &Permission::World)
+.reload_timezone(true);
+
+fn create_ticket_http_only(
+ _parts: Parts,
+ param: Value,
+ _info: &ApiMethod,
+ rpcenv: Box<dyn RpcEnvironment>,
+) -> ApiResponseFuture {
+ Box::pin(async move {
+ use proxmox_rest_server::RestEnvironment;
+
+ let code = param["code"]
+ .as_str()
+ .ok_or_else(|| format_err!("missing non-optional parameter: code"))?
+ .to_owned();
+ let state = param["state"]
+ .as_str()
+ .ok_or_else(|| format_err!("missing non-optional parameter: state"))?
+ .to_owned();
+ let redirect_url = param["redirect-url"]
+ .as_str()
+ .ok_or_else(|| format_err!("missing non-optional parameter: redirect-url"))?
+ .to_owned();
+
+ let env: &RestEnvironment = rpcenv
+ .as_any()
+ .downcast_ref::<RestEnvironment>()
+ .ok_or_else(|| format_err!("detected wrong RpcEnvironment type"))?;
+
+ let user_info = CachedUserInfo::new()?;
+ let auth_context = auth::get_auth_context()
+ .ok_or_else(|| format_err!("could not get authentication context"))?;
+
+ let mut tested_username = None;
+
+ let result = try_block!({
+ let (realm, private_auth_state) =
+ OpenIdAuthenticator::verify_public_auth_state(PDM_RUN_DIR_M!(), &state)?;
+
+ let (domains, _digest) = pdm_config::domains::config()?;
+ let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+ let open_id = openid_authenticator(&config, &redirect_url)?;
+ let info = open_id.verify_authorization_code_simple(&code, &private_auth_state)?;
+ let name_attr = config.username_claim.as_deref().unwrap_or("sub");
+
+ // Try to be compatible with previous versions
+ let try_attr = match name_attr {
+ "subject" => Some("sub"),
+ "username" => Some("preferred_username"),
+ _ => None,
+ };
+
+ let unique_name = if let Some(name) = info[name_attr]
+ .as_str()
+ .or_else(|| try_attr.and_then(|att| info[att].as_str()))
+ {
+ name.to_owned()
+ } else {
+ bail!("missing claim '{name_attr}'");
+ };
+
+ let user_id = Userid::try_from(format!("{unique_name}@{realm}"))?;
+ tested_username = Some(unique_name);
+
+ if !user_info.is_active_user_id(&user_id) {
+ if config.autocreate.unwrap_or(false) {
+ let _lock = proxmox_access_control::user::lock_config()?;
+ let (mut user_config, _digest) = proxmox_access_control::user::config()?;
+
+ if let Ok(old_user) = user_config.lookup::<User>("user", user_id.as_str()) {
+ if let Some(false) = old_user.enable {
+ bail!("user '{user_id}' is disabled.");
+ } else {
+ bail!("autocreate user failed - '{user_id}' already exists.");
+ }
+ }
+
+ let firstname = info["given_name"]
+ .as_str()
+ .map(|n| n.to_string())
+ .filter(|n| FIRST_NAME_SCHEMA.parse_simple_value(n).is_ok());
+
+ let lastname = info["family_name"]
+ .as_str()
+ .map(|n| n.to_string())
+ .filter(|n| LAST_NAME_SCHEMA.parse_simple_value(n).is_ok());
+
+ let email = info["email"]
+ .as_str()
+ .map(|n| n.to_string())
+ .filter(|n| EMAIL_SCHEMA.parse_simple_value(n).is_ok());
+
+ let user = User {
+ userid: user_id.clone(),
+ comment: None,
+ enable: None,
+ expire: None,
+ firstname,
+ lastname,
+ email,
+ };
+
+ user_config.set_data(user.userid.as_str(), "user", &user)?;
+ proxmox_access_control::user::save_config(&user_config)?;
+ } else {
+ bail!("user account '{user_id}' missing, disabled or expired.");
+ }
+ }
+
+ let api_ticket = ApiTicket::Full(user_id.clone());
+ let ticket = Ticket::new(auth_context.auth_prefix(), &api_ticket)?;
+ let token = assemble_csrf_prevention_token(auth_context.csrf_secret(), &user_id);
+ env.log_auth(user_id.as_str());
+
+ Ok((user_id, ticket, token))
+ });
+
+ let (user_id, mut ticket, token) = result.map_err(|err| {
+ let msg = err.to_string();
+ env.log_failed_auth(tested_username, &msg);
+ http_err!(UNAUTHORIZED, "{msg}")
+ })?;
+
+ let cookie = format!(
+ "{}={}; Secure; SameSite=Lax; HttpOnly; Path=/;",
+ auth_context.prefixed_auth_cookie_name(),
+ ticket.sign(auth_context.keyring(), None)?,
+ );
+
+ let response = Response::builder()
+ .header(hyper::http::header::CONTENT_TYPE, "application/json")
+ .header(hyper::header::SET_COOKIE, cookie);
+
+ let data = CreateTicketResponse {
+ csrfprevention_token: Some(token),
+ ticket: None,
+ ticket_info: Some(ticket.ticket_info()),
+ username: user_id,
+ };
+
+ Ok(response.body(
+ json!({"data": data, "status": 200, "success": true })
+ .to_string()
+ .into(),
+ )?)
+ })
+}
+
+#[api(
+ protected: true,
+ input: {
+ properties: {
+ realm: {
+ schema: REALM_ID_SCHEMA,
+ },
+ "redirect-url": {
+ schema: HTTP_URL_SCHEMA,
+ },
+ },
+ },
+ returns: {
+ description: "Redirection URL.",
+ type: String,
+ },
+ access: {
+ description: "Anyone can access this (before the user is authenticated).",
+ permission: &Permission::World,
+ },
+)]
+/// Create OpenID Redirect Session
+pub fn openid_auth_url(
+ realm: String,
+ redirect_url: String,
+ _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<String, Error> {
+ let (domains, _digest) = pdm_config::domains::config()?;
+ let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+
+ let open_id = openid_authenticator(&config, &redirect_url)?;
+
+ let url = open_id.authorize_url(PDM_RUN_DIR_M!(), &realm)?;
+
+ Ok(url)
+}
+
+#[sortable]
+const SUBDIRS: SubdirMap = &sorted!([
+ ("login", &Router::new().post(&API_METHOD_OPENID_LOGIN)),
+ ("auth-url", &Router::new().post(&API_METHOD_OPENID_AUTH_URL)),
+]);
+
+pub const ROUTER: Router = Router::new()
+ .get(&list_subdirs_api_method!(SUBDIRS))
+ .subdirs(SUBDIRS);
diff --git a/server/src/api/config/access/mod.rs b/server/src/api/config/access/mod.rs
index 7454f53..5776152 100644
--- a/server/src/api/config/access/mod.rs
+++ b/server/src/api/config/access/mod.rs
@@ -4,12 +4,14 @@ use proxmox_sortable_macro::sortable;
mod ad;
mod ldap;
+mod openid;
pub mod tfa;
#[sortable]
const SUBDIRS: SubdirMap = &sorted!([
("tfa", &tfa::ROUTER),
("ldap", &ldap::ROUTER),
+ ("openid", &openid::ROUTER),
("ad", &ad::ROUTER),
]);
diff --git a/server/src/api/config/access/openid.rs b/server/src/api/config/access/openid.rs
new file mode 100644
index 0000000..1832448
--- /dev/null
+++ b/server/src/api/config/access/openid.rs
@@ -0,0 +1,289 @@
+/// Configure OpenId realms
+use anyhow::Error;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
+use proxmox_schema::{api, param_bail};
+
+use pdm_api_types::ConfigDigest;
+use pdm_api_types::{
+ OpenIdRealmConfig, OpenIdRealmConfigUpdater, PRIV_REALM_ALLOCATE, PRIV_SYS_AUDIT,
+ REALM_ID_SCHEMA,
+};
+use pdm_config::domains;
+
+#[api(
+ input: {
+ properties: {},
+ },
+ returns: {
+ description: "List of configured OpenId realms.",
+ type: Array,
+ items: { type: OpenIdRealmConfig },
+ },
+ access: {
+ permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+ },
+)]
+/// List configured OpenId realms
+pub fn list_openid_realms(
+ _param: Value,
+ rpcenv: &mut dyn RpcEnvironment,
+) -> Result<Vec<OpenIdRealmConfig>, Error> {
+ let (config, digest) = domains::config()?;
+
+ let list = config.convert_to_typed_array("openid")?;
+
+ rpcenv["digest"] = hex::encode(digest).into();
+
+ Ok(list)
+}
+
+#[api(
+ protected: true,
+ input: {
+ properties: {
+ config: {
+ type: OpenIdRealmConfig,
+ flatten: true,
+ },
+ },
+ },
+ access: {
+ permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+ },
+)]
+/// Create a new OpenId realm
+pub fn create_openid_realm(config: OpenIdRealmConfig) -> Result<(), Error> {
+ let _lock = domains::lock_config()?;
+
+ let (mut domains, _digest) = domains::config()?;
+
+ if domains::exists(&domains, &config.realm) {
+ param_bail!("realm", "realm '{}' already exists.", config.realm);
+ }
+
+ if let Some(true) = config.default {
+ domains::unset_default_realm(&mut domains)?;
+ }
+
+ domains.set_data(&config.realm, "openid", &config)?;
+
+ domains::save_config(&domains)?;
+
+ Ok(())
+}
+
+#[api(
+ protected: true,
+ input: {
+ properties: {
+ realm: {
+ schema: REALM_ID_SCHEMA,
+ },
+ digest: {
+ optional: true,
+ type: ConfigDigest,
+ },
+ },
+ },
+ access: {
+ permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+ },
+)]
+/// Remove a OpenID realm configuration
+pub fn delete_openid_realm(
+ realm: String,
+ digest: Option<ConfigDigest>,
+ _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+ let _lock = domains::lock_config()?;
+
+ let (mut domains, expected_digest) = domains::config()?;
+ expected_digest.detect_modification(digest.as_ref())?;
+
+ if domains.sections.remove(&realm).is_none() {
+ http_bail!(NOT_FOUND, "realm '{realm}' does not exist.");
+ }
+
+ domains::save_config(&domains)?;
+
+ Ok(())
+}
+
+#[api(
+ input: {
+ properties: {
+ realm: {
+ schema: REALM_ID_SCHEMA,
+ },
+ },
+ },
+ returns: { type: OpenIdRealmConfig },
+ access: {
+ permission: &Permission::Privilege(&["access", "domains"], PRIV_SYS_AUDIT, false),
+ },
+)]
+/// Read the OpenID realm configuration
+pub fn read_openid_realm(
+ realm: String,
+ rpcenv: &mut dyn RpcEnvironment,
+) -> Result<OpenIdRealmConfig, Error> {
+ let (domains, digest) = domains::config()?;
+
+ let config = domains.lookup("openid", &realm)?;
+ rpcenv["digest"] = hex::encode(digest).into();
+
+ Ok(config)
+}
+
+#[api()]
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+/// Deletable property name
+pub enum DeletableProperty {
+ /// Delete the client key.
+ ClientKey,
+ /// Delete the comment property.
+ Comment,
+ /// Delete the default property.
+ Default,
+ /// Delete the autocreate property
+ Autocreate,
+ /// Delete the scopes property
+ Scopes,
+ /// Delete the prompt property
+ Prompt,
+ /// Delete the acr_values property
+ AcrValues,
+}
+
+#[api(
+ protected: true,
+ input: {
+ properties: {
+ realm: {
+ schema: REALM_ID_SCHEMA,
+ },
+ update: {
+ type: OpenIdRealmConfigUpdater,
+ flatten: true,
+ },
+ delete: {
+ description: "List of properties to delete.",
+ type: Array,
+ optional: true,
+ items: {
+ type: DeletableProperty,
+ }
+ },
+ digest: {
+ optional: true,
+ type: ConfigDigest,
+ },
+ },
+ },
+ returns: { type: OpenIdRealmConfig },
+ access: {
+ permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+ },
+)]
+/// Update an OpenID realm configuration
+pub fn update_openid_realm(
+ realm: String,
+ update: OpenIdRealmConfigUpdater,
+ delete: Option<Vec<DeletableProperty>>,
+ digest: Option<ConfigDigest>,
+ _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+ let _lock = domains::lock_config()?;
+
+ let (mut domains, expected_digest) = domains::config()?;
+ expected_digest.detect_modification(digest.as_ref())?;
+
+ let mut config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+
+ if let Some(delete) = delete {
+ for delete_prop in delete {
+ match delete_prop {
+ DeletableProperty::ClientKey => {
+ config.client_key = None;
+ }
+ DeletableProperty::Comment => {
+ config.comment = None;
+ }
+ DeletableProperty::Default => {
+ config.default = None;
+ }
+ DeletableProperty::Autocreate => {
+ config.autocreate = None;
+ }
+ DeletableProperty::Scopes => {
+ config.scopes = None;
+ }
+ DeletableProperty::Prompt => {
+ config.prompt = None;
+ }
+ DeletableProperty::AcrValues => {
+ config.acr_values = None;
+ }
+ }
+ }
+ }
+
+ if let Some(comment) = update.comment {
+ let comment = comment.trim().to_string();
+ if comment.is_empty() {
+ config.comment = None;
+ } else {
+ config.comment = Some(comment);
+ }
+ }
+
+ if let Some(true) = update.default {
+ domains::unset_default_realm(&mut domains)?;
+ config.default = Some(true);
+ } else {
+ config.default = None;
+ }
+
+ if let Some(issuer_url) = update.issuer_url {
+ config.issuer_url = issuer_url;
+ }
+ if let Some(client_id) = update.client_id {
+ config.client_id = client_id;
+ }
+
+ if update.client_key.is_some() {
+ config.client_key = update.client_key;
+ }
+ if update.autocreate.is_some() {
+ config.autocreate = update.autocreate;
+ }
+ if update.scopes.is_some() {
+ config.scopes = update.scopes;
+ }
+ if update.prompt.is_some() {
+ config.prompt = update.prompt;
+ }
+ if update.acr_values.is_some() {
+ config.acr_values = update.acr_values;
+ }
+
+ domains.set_data(&realm, "openid", &config)?;
+
+ domains::save_config(&domains)?;
+
+ Ok(())
+}
+
+const ITEM_ROUTER: Router = Router::new()
+ .get(&API_METHOD_READ_OPENID_REALM)
+ .put(&API_METHOD_UPDATE_OPENID_REALM)
+ .delete(&API_METHOD_DELETE_OPENID_REALM);
+
+pub const ROUTER: Router = Router::new()
+ .get(&API_METHOD_LIST_OPENID_REALMS)
+ .post(&API_METHOD_CREATE_OPENID_REALM)
+ .match_all("realm", &ITEM_ROUTER);
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 532350d..9413a83 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -81,7 +81,11 @@ fn setup_auth_context(use_private_key: bool) {
proxmox_auth_api::set_auth_context(AUTH_CONTEXT.get().unwrap());
}
-struct PdmAuthContext {
+pub(crate) fn get_auth_context() -> Option<&'static PdmAuthContext> {
+ AUTH_CONTEXT.get()
+}
+
+pub(crate) struct PdmAuthContext {
keyring: Keyring,
csrf_secret: &'static HMACKey,
}
--
2.47.3
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 17+ messages in thread