From: "Shannon Sterz" <s.sterz@proxmox.com>
To: "Shannon Sterz" <s.sterz@proxmox.com>,
"Christian Ebner" <c.ebner@proxmox.com>,
"Proxmox Backup Server development discussion"
<pbs-devel@lists.proxmox.com>
Subject: [pbs-devel] Superseded: Re: [PATCH proxmox v2] login: use `ticket` if both it and `ticket_info` are provided
Date: Thu, 02 Oct 2025 09:57:56 +0200 [thread overview]
Message-ID: <DD7OD78J2Q6H.346UJ92TC0355@proxmox.com> (raw)
In-Reply-To: <DD7O7RLF50HZ.1NAU5VCE3AE7A@proxmox.com>
Superseded-by: https://lore.proxmox.com/all/DD7O7RLF50HZ.1NAU5VCE3AE7A@proxmox.com/T/#t
On Thu Oct 2, 2025 at 9:50 AM CEST, Shannon Sterz wrote:
> On Wed Oct 1, 2025 at 5:02 PM CEST, Christian Ebner wrote:
>> On 10/1/25 3:11 PM, Shannon Sterz wrote:
>>> previously the precense of `ticket_info` was assumed to indicate the
>>> HTTPOnly authentication flow. the `ticket` field was ignore in that
>>> case, because the client has no way of validating a ticket anyway.
>>>
>>> this commit changes the behaviour to assume that the server is not
>>> trying to "trick us" and that the presence of a `ticket` field
>>> indicates that this value should be used for authentication. if the
>>> `ticket_info` field is also present, it will be ignored.
>>>
>>> this fixes an issue where authentication against later versions of
>>> proxmox-backup-server 3.4 failed. including versions up to and
>>> including version 3.4.6-1.
>>>
>>> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
>>> ---
>>
>> Only one question: Should the `SecondFactorChallenge::response_bytes()`
>> also prioritize `ticket` over `ticket_info` to get the same flow behavior?
>
> yes sorry that was an oversight on my end, will send a v3 in a minute.
>
>> Other than that the changes look good to me, as they do follow the same
>> intend of parsing the full ticket I did try
>> to force via the compat mode in
>> https://lore.proxmox.com/pdm-devel/DD70FPP8GIBO.2K8CWBW5XPL0K@proxmox.com/T/
>>
>> Tested ticket parsing and request authentication works with this patch
>> applied by using PDM remote add wizard (which uses the proxmox-login)
>> for the following version:
>> - PBS 3.4.0 (fresh install from ISO), 3.4.6, 4.0.11 (fresh install from
>> ISO), 4.0.15
>> - PVE 8.4.0 (fresh install from ISO), 8.4.14, 9.0.3 (fresh install from
>> ISO), 9.0.10
>>
>> Please consider:
>>
>> Reviewed-by: Christian Ebner <c.ebner@proxmox.com>
>> Tested-by: Christian Ebner <c.ebner@proxmox.com>
_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
prev parent reply other threads:[~2025-10-02 7:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-01 13:11 [pbs-devel] " Shannon Sterz
2025-10-01 15:02 ` Christian Ebner
2025-10-02 7:50 ` Shannon Sterz
2025-10-02 7:57 ` Shannon Sterz [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DD7OD78J2Q6H.346UJ92TC0355@proxmox.com \
--to=s.sterz@proxmox.com \
--cc=c.ebner@proxmox.com \
--cc=pbs-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.