From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 14A101FF0AB for ; Wed, 23 Sep 2026 23:00:17 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 39E1521608; Wed, 23 Sep 2026 23:00:13 +0200 (CEST) From: Thomas Lamprecht To: pve-devel@lists.proxmox.com Subject: [PATCH cluster/access-control/manager/docs/proxmox 0/9] fix #7805: add a datacenter-wide API token policy Date: Wed, 23 Sep 2026 22:59:49 +0200 Message-ID: <20260923210000.4031318-1-t.lamprecht@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1790197207108 X-SPAM-LEVEL: Spam detection results: 1 AWL 0.688 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLACK 3 Contains an URL listed in the URIBL blacklist [types.rs] Message-ID-Hash: 2HY5GQC3EXEB3ER3PNUKUFIZMTMOGT5Q X-Message-ID-Hash: 2HY5GQC3EXEB3ER3PNUKUFIZMTMOGT5Q X-MailFrom: t.lamprecht@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Compliance rules like PCI DSS, SOC 2, or ISO 27001 often require that credentials have a limited lifetime, but there is no central way to enforce that for API tokens. Add an optional token-policy option to datacenter.cfg to require an expiration date, limit the maximum token lifetime, forbid changing the expiration date of existing tokens, and require privilege separation. The policy is only checked when a token is created or updated, and only for values that actually change, so existing tokens stay valid even if their lifetime exceeds a newly configured maximum one. Extending the expiration date within the limit stays possible, unless the opt-in 'disallow-expiry-changes' switch is set (see [0] for the rationale). The web UI exposes these options under Datacenter -> Options and adjusts the token dialogs to the policy. Changing the policy requires Sys.Modify on '/', like any other datacenter option; an extra auth-specific privilege check was skipped for now, for the current built-in roles it would land in the same roles as Sys.Modify, adding new built-in roles here is IMO scope creep and this can still be done later (with some more thoughts on how to handle all these datacenter options). FWIW, the first manager patch (4/9 overall) fixes a pre-existing issue w.r.t. only submitting the expiration date when changed, which the policy checks would expose more often, but it'd also make sense on its own and could be applied independently already. The last two patches port the backend part to the common rust stack, so PBS and PDM can opt in through their AccessControlConfig, and to prepare moving pve-access-control over to rust later. Only the expiry parts apply there, tokens in the rust stack always use separate ACLs, i.e. no sharing with the underlying users there. Dependencies: access-control needs the cluster patch, manager needs both, and building manager needs the pve-doc-generator with the new online-help anchor from the docs patch (or ALLOW_MISSING=1), which is why the docs patch comes before the manager ones; the proxmox patches are independent. d/control needs the respective versioned dependency bumps added on applying, and the generated datacenter option reference in pve-docs needs the usual make update once the cluster side is packaged. [0]: https://bugzilla.proxmox.com/show_bug.cgi?id=7805 cluster: Thomas Lamprecht (1): datacenter config: add token-policy option src/PVE/DataCenterConfig.pm | 51 ++++++++++++++++++++++++++++++ src/test/Makefile | 6 +++- src/test/test_token_policy.pl | 72 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 128 insertions(+), 1 deletion(-) access-control: Thomas Lamprecht (1): fix #7805: api: token: enforce datacenter token policy src/PVE/API2/User.pm | 32 +++++- src/PVE/AccessControl.pm | 59 +++++++++++ src/test/Makefile | 2 + src/test/token-policy-api-test.pl | 102 ++++++++++++++++++ src/test/token-policy-test.pl | 217 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 409 insertions(+), 3 deletions(-) docs: Thomas Lamprecht (1): user management: document the API token policy pveum.adoc | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) manager: Thomas Lamprecht (4): ui: token edit: only submit the expiration date when changed api: cluster options: return token-policy without Sys.Audit ui: dc options: allow editing the API token policy ui: token edit: adapt to the datacenter API token policy PVE/API2/Cluster.pm | 2 +- www/manager6/UIOptions.js | 14 ++++- www/manager6/dc/OptionView.js | 108 +++++++++++++++++++++++++++++++++ www/manager6/dc/TokenEdit.js | 136 +++++++++++++++++++++++++++++++++++++++++- www/manager6/dc/TokenView.js | 36 ++++++----- 5 files changed, 278 insertions(+), 18 deletions(-) proxmox: Thomas Lamprecht (2): access-control: add API token policy type with expiry checks access-control: enforce token policy on token create and update proxmox-access-control/src/api/tokens.rs | 17 +++ proxmox-access-control/src/init.rs | 15 ++ proxmox-access-control/src/types.rs | 227 +++++++++++++++++++++++++++++++ 3 files changed, 259 insertions(+) -- 2.47.3