From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id C35E41FF0EA for ; Thu, 13 Aug 2026 17:06:02 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id F0D75218DA; Thu, 13 Aug 2026 17:06:01 +0200 (CEST) From: Thomas Ellmenreich To: pdm-devel@lists.proxmox.com Subject: [PATCH datacenter-manager/proxmox 0/4] fix #7747: OpenID: allow non HTTP scheme in redirect URL Date: Thu, 13 Aug 2026 17:05:47 +0200 Message-ID: <20260813150551.415237-1-t.ellmenreich@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1786633539667 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.113 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: MF4KJ4VD5U4MTTBQCT62VWCW5RFHALGA X-Message-ID-Hash: MF4KJ4VD5U4MTTBQCT62VWCW5RFHALGA X-MailFrom: t.ellmenreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Thomas Ellmenreich X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: As reported in this bug: [1], PDM's '/access/openid/auth-url' endpoint only accepts URL's that either have a HTTP or HTTPS scheme. Also as the user mentions, this is a problem for native app authentication flows that might want to redirect back to the application after successful authentication. Since PVE already accepts redirect URLs with any scheme, this series also extends PDM's validation to allow other schemes. Implementation -------------- To avoid duplicated regex strings, part of the original HTTP_URL_REGEX was refactored out, and then reused for the new URL_REGEX. Testing ------- I tested this with a simple curl request to both PDM's and PVE's 'auth-url' endpoints. Providing a HTTP and non HTTP scheme, to see where the process fails. ``` curl -o - --data '{"realm":"myrealm","redirect-url":"https://pdm1:8443"}' \ --header 'Content-Type: application/json;charset=UTF-8' \ -k https://pdm1:8443/api2/extjs/access/openid/auth-url | jq ``` [1]: https://bugzilla.proxmox.com/show_bug.cgi?id=7747 proxmox: Thomas Ellmenreich (3): api-types: reorganise unit tests api-types: refactor HTTP_URL_REGEX construction api-types: add a scheme generic URL regex pbs-api-types/src/lib.rs | 1 + proxmox-schema/src/api_types.rs | 128 ++++++++++++++++++++++++-------- 2 files changed, 97 insertions(+), 32 deletions(-) proxmox-datacenter-manager: Thomas Ellmenreich (1): fix #7747: openid: allow non HTTP schemes in redirect URL lib/pdm-api-types/src/lib.rs | 1 + server/src/api/access/openid.rs | 6 ++---- 2 files changed, 3 insertions(+), 4 deletions(-) Summary over all repositories: 4 files changed, 100 insertions(+), 36 deletions(-) -- Generated by murpp 0.12.0