all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Christoph Heiss <c.heiss@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change
Date: Mon, 24 Jul 2023 11:03:45 +0200	[thread overview]
Message-ID: <20230724090408.221672-1-c.heiss@proxmox.com> (raw)

tl;dr implements the result of the discussion in [0].

First, this removes the dreaded LDAP DN regex, replacing it instead with
a proper schema format, which does validation using
Net::LDAP::Util::canonical_dn().

Further, upon saving a LDAP realm in the UI, it tries to connect & bind
using the provided credentials, providing the user with immediate
feedback whether they are valid or not.

The same approach is already implemented in PBS [1].

Changes were tested against slapd 2.5.13+dfsg-5.

[0] https://lists.proxmox.com/pipermail/pve-devel/2023-May/056839.html
[1] https://git.proxmox.com/?p=proxmox-backup.git;a=commitdiff;h=5210f3b5

v1: https://lists.proxmox.com/pipermail/pve-devel/2023-July/058274.html

Notable changes v1 -> v2:
  * Fixed updating a LDAP realm via raw API/pveum/pvesh (see #5)

pve-common:

Christoph Heiss (3):
  schema: add `ldap-dn` format for validating LDAP distinguished names
  test: add test cases for new 'ldap-dn' schema format
  ldap: handle errors explicitly everywhere instead of simply `die`ing

 debian/control              |  2 ++
 src/PVE/JSONSchema.pm       | 12 +++++++++
 src/PVE/LDAP.pm             | 11 ++++----
 test/Makefile               |  1 +
 test/ldap_dn_format_test.pl | 54 +++++++++++++++++++++++++++++++++++++
 5 files changed, 75 insertions(+), 5 deletions(-)

pve-access-control:

Christoph Heiss (2):
  ldap: validate LDAP DNs using the `ldap-dn` schema format
  ldap: check bind credentials with LDAP directory directly on change

 src/PVE/API2/Domains.pm |  7 +++++--
 src/PVE/Auth/LDAP.pm    | 28 ++++++++++++++++------------
 2 files changed, 21 insertions(+), 14 deletions(-)

--
2.41.0





             reply	other threads:[~2023-07-24  9:04 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-07-24  9:03 Christoph Heiss [this message]
2023-07-24  9:03 ` [pve-devel] [PATCH common v2 1/5] schema: add `ldap-dn` format for validating LDAP distinguished names Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH common v2 2/5] test: add test cases for new 'ldap-dn' schema format Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH common v2 3/5] ldap: handle errors explicitly everywhere instead of simply `die`ing Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH access-control v2 4/5] ldap: validate LDAP DNs using the `ldap-dn` schema format Christoph Heiss
2023-07-24  9:03 ` [pve-devel] [PATCH access-control v2 5/5] ldap: check bind credentials with LDAP directory directly on change Christoph Heiss
2023-07-24 13:18 ` [pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change Friedrich Weber
2023-07-27  9:54 ` Lukas Wagner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230724090408.221672-1-c.heiss@proxmox.com \
    --to=c.heiss@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal