From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <webmaster@jbsky.fr> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id CEA5774607 for <pve-devel@lists.proxmox.com>; Tue, 1 Jun 2021 21:04:38 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id B93D12C3E1 for <pve-devel@lists.proxmox.com>; Tue, 1 Jun 2021 21:04:08 +0200 (CEST) Received: from smtp.smtpout.orange.fr (smtp06.smtpout.orange.fr [80.12.242.128]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id CD6A22C3CB for <pve-devel@lists.proxmox.com>; Tue, 1 Jun 2021 21:04:06 +0200 (CEST) Received: from dovecot.localdomain ([90.118.15.232]) by mwinf5d29 with ME id Bv3z2500R50Qfqq03v3znw; Tue, 01 Jun 2021 21:04:00 +0200 X-ME-Helo: dovecot.localdomain X-ME-Auth: anVsaWVuLmJsYWlzNUBvcmFuZ2UuZnI= X-ME-Date: Tue, 01 Jun 2021 21:04:00 +0200 X-ME-IP: 90.118.15.232 Message-ID: <689597d36cbfd5debb30f76164f88201@mwinf5d29.me-wanadoo.net> MIME-Version: 1.0 To: Dietmar Maurer <dietmar@proxmox.com>, Proxmox VE development discussion <pve-devel@lists.proxmox.com> From: wb <webmaster@jbsky.fr> Date: Tue, 1 Jun 2021 21:03:58 +0200 Importance: normal X-Priority: 3 In-Reply-To: <2082173493.3135.1622538241740@webmail.proxmox.com> References: <2082173493.3135.1622538241740@webmail.proxmox.com> X-SPAM-LEVEL: Spam detection results: 1 AWL 0.043 Adjusted score from AWL reputation of From: address HTML_MESSAGE 0.001 HTML included in message KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods KAM_NUMSUBJECT 0.5 Subject ends in numbers excluding current years RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [saml.pm] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: [pve-devel] =?utf-8?b?UkXCoDogIFtQQVRDSF0gW1BBVENIIHB2ZS1hY2Nl?= =?utf-8?q?ss-control=5D_SSO_feature=3Alogin_with_SAMLv2?= X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> List-Post: <mailto:pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Tue, 01 Jun 2021 19:04:38 -0000 > I wonder why you want to store temporary data in /etc/pve/tmp/saml. Would= n't it we good enough > to store that on the local file system? On the one hand, I enjoyed reusing your work. On the other hand, I think it is more secure to put this kind of data in /e= tc/pve/tmp/saml than in /tmp/saml/ Then, yes, it is possible to store it on /tmp/saml for example, it is varia= ble data. Nothing is fixed, you are free to do what you want. > Unfortunately, your code depends on code not packaged for Debian. Any ide= a=20 > how to replace that (cpanm Net::SAML2)? Since I'm not a perl specialist, I took what seemed to me the most standard= in this language. Have you considered cloning this repos available on GitH= ub(https://github.com/perl-net-saml2/perl-Net-SAML2)? > Or better, is there a 'rust' implementaion for SAML2? If so, we could mak= e perl bindings > for that and reuse the code with Proxmox Backup Server. Do you have a specific project or library in mind? Unfortunately, I don't have any knowledge about rust and I'll have a hard t= ime accompanying you on this topic. However, it seems that there are projec= ts on github in opensource, for example https://github.com/njaremko/samael. I'll tell you again,nothing is fixed, you are free to do what you want. I test with lemonldapng which is less simple to install and to handle than = keycloak. I remain at your disposal if needed. Yours sincerely, De=C2=A0: Dietmar Maurer Envoy=C3=A9 le=C2=A0:mardi 1 juin 2021 11:04 =C3=80=C2=A0: Proxmox VE development discussion; Julien BLAIS Objet=C2=A0:Re: [pve-devel] [PATCH] [PATCH pve-access-control] SSO feature:= login with SAMLv2 Unfortunately, your code depends on code not packaged for Debian. Any idea= =20 how to replace that (cpanm Net::SAML2)? Or better, is there a 'rust' implementaion for SAML2? If so, we could make = perl bindings for that and reuse the code with Proxmox Backup Server. Other ideas? > diff --git a/src/PVE/Auth/SAML.pm b/src/PVE/Auth/SAML.pm > new file mode 100644 > index 0000000..4653cb7 > --- /dev/null > +++ b/src/PVE/Auth/SAML.pm > @@ -0,0 +1,248 @@ > +# Instructions for installation : > +# apt-get install libxml2 make gcc libssl-dev libperl-dev git cpanminus > +# cpanm Net::SAML2 > +# ln -s /usr/local/share/perl/5.28.1/Net/SAML2 /usr/share/perl/5.28.1/Ne= t/SAML2 > +# ln -s /usr/local/share/perl/5.28.1/Net/SAML2 /usr/share/perl5/Net/SAML= 2