From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 562361FF183 for ; Wed, 24 Sep 2025 16:51:14 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 69850B4DD; Wed, 24 Sep 2025 16:51:43 +0200 (CEST) From: Shannon Sterz To: pdm-devel@lists.proxmox.com Date: Wed, 24 Sep 2025 16:51:37 +0200 Message-ID: <20250924145137.407070-9-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250924145137.407070-1-s.sterz@proxmox.com> References: <20250924145137.407070-1-s.sterz@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1758725485609 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.057 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pdm-devel] [PATCH datacenter-manager 3/3] server: clean up acl tree entries and api tokens when deleting users X-BeenThere: pdm-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Datacenter Manager development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pdm-devel-bounces@lists.proxmox.com Sender: "pdm-devel" Signed-off-by: Shannon Sterz --- server/src/api/access/users.rs | 39 +++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/server/src/api/access/users.rs b/server/src/api/access/users.rs index da598d8..1d1accb 100644 --- a/server/src/api/access/users.rs +++ b/server/src/api/access/users.rs @@ -334,20 +334,19 @@ pub fn update_user( /// Remove a user from the configuration file. pub fn delete_user(userid: Userid, digest: Option) -> Result<(), Error> { let _lock = proxmox_access_control::user::lock_config()?; + let _acl_lock = proxmox_access_control::acl::lock_config()?; let _tfa_lock = crate::auth::tfa::write_lock()?; - let (mut config, config_digest) = proxmox_access_control::user::config()?; + let (mut user_config, config_digest) = proxmox_access_control::user::config()?; config_digest.detect_modification(digest.as_ref())?; - match config.sections.get(userid.as_str()) { + match user_config.sections.get(userid.as_str()) { Some(_) => { - config.sections.remove(userid.as_str()); + user_config.sections.remove(userid.as_str()); } None => bail!("user '{}' does not exist.", userid), } - proxmox_access_control::user::save_config(&config)?; - let authenticator = crate::auth::lookup_authenticator(userid.realm())?; match authenticator.remove_password(userid.name()) { Ok(()) => {} @@ -375,6 +374,36 @@ pub fn delete_user(userid: Userid, digest: Option) -> Result<(), E } } + let user_tokens: Vec = user_config + .convert_to_typed_array::("token")? + .into_iter() + .filter(|token| token.tokenid.user().eq(&userid)) + .collect(); + + let (mut acl_config, _digest) = proxmox_access_control::acl::config()?; + + let auth_id = userid.clone().into(); + acl_config.delete_authid(&auth_id); + + for token in user_tokens { + if let Some(token_name) = token.tokenid.tokenname() { + let tokenid = Authid::from((userid.clone(), Some(token_name.to_owned()))); + let tokenid_string = tokenid.to_string(); + if user_config.sections.remove(&tokenid_string).is_none() { + bail!( + "token '{}' of user '{userid}' does not exist.", + token_name.as_str() + ); + } + + proxmox_access_control::token_shadow::delete_secret(&tokenid)?; + acl_config.delete_authid(&tokenid); + } + } + + proxmox_access_control::user::save_config(&user_config)?; + proxmox_access_control::acl::save_config(&acl_config)?; + Ok(()) } -- 2.47.3 _______________________________________________ pdm-devel mailing list pdm-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel