From: Christoph Heiss <c.heiss@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change
Date: Mon, 24 Jul 2023 11:03:45 +0200 [thread overview]
Message-ID: <20230724090408.221672-1-c.heiss@proxmox.com> (raw)
tl;dr implements the result of the discussion in [0].
First, this removes the dreaded LDAP DN regex, replacing it instead with
a proper schema format, which does validation using
Net::LDAP::Util::canonical_dn().
Further, upon saving a LDAP realm in the UI, it tries to connect & bind
using the provided credentials, providing the user with immediate
feedback whether they are valid or not.
The same approach is already implemented in PBS [1].
Changes were tested against slapd 2.5.13+dfsg-5.
[0] https://lists.proxmox.com/pipermail/pve-devel/2023-May/056839.html
[1] https://git.proxmox.com/?p=proxmox-backup.git;a=commitdiff;h=5210f3b5
v1: https://lists.proxmox.com/pipermail/pve-devel/2023-July/058274.html
Notable changes v1 -> v2:
* Fixed updating a LDAP realm via raw API/pveum/pvesh (see #5)
pve-common:
Christoph Heiss (3):
schema: add `ldap-dn` format for validating LDAP distinguished names
test: add test cases for new 'ldap-dn' schema format
ldap: handle errors explicitly everywhere instead of simply `die`ing
debian/control | 2 ++
src/PVE/JSONSchema.pm | 12 +++++++++
src/PVE/LDAP.pm | 11 ++++----
test/Makefile | 1 +
test/ldap_dn_format_test.pl | 54 +++++++++++++++++++++++++++++++++++++
5 files changed, 75 insertions(+), 5 deletions(-)
pve-access-control:
Christoph Heiss (2):
ldap: validate LDAP DNs using the `ldap-dn` schema format
ldap: check bind credentials with LDAP directory directly on change
src/PVE/API2/Domains.pm | 7 +++++--
src/PVE/Auth/LDAP.pm | 28 ++++++++++++++++------------
2 files changed, 21 insertions(+), 14 deletions(-)
--
2.41.0
next reply other threads:[~2023-07-24 9:04 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-24 9:03 Christoph Heiss [this message]
2023-07-24 9:03 ` [pve-devel] [PATCH common v2 1/5] schema: add `ldap-dn` format for validating LDAP distinguished names Christoph Heiss
2023-07-24 9:03 ` [pve-devel] [PATCH common v2 2/5] test: add test cases for new 'ldap-dn' schema format Christoph Heiss
2023-07-24 9:03 ` [pve-devel] [PATCH common v2 3/5] ldap: handle errors explicitly everywhere instead of simply `die`ing Christoph Heiss
2023-07-24 9:03 ` [pve-devel] [PATCH access-control v2 4/5] ldap: validate LDAP DNs using the `ldap-dn` schema format Christoph Heiss
2023-07-24 9:03 ` [pve-devel] [PATCH access-control v2 5/5] ldap: check bind credentials with LDAP directory directly on change Christoph Heiss
2023-07-24 13:18 ` [pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change Friedrich Weber
2023-07-27 9:54 ` Lukas Wagner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230724090408.221672-1-c.heiss@proxmox.com \
--to=c.heiss@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal