Re: [pbs-devel] [PATCH proxmox-backup 07/17] api-types: add config options for LDAP user sync

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

On Tue, Jan 03, 2023 at 03:22:58PM +0100, Lukas Wagner wrote:
> Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
> ---
>  pbs-api-types/src/ldap.rs      | 124 ++++++++++++++++++++++++++++++++-
>  src/api2/config/access/ldap.rs |  37 ++++++++++
>  2 files changed, 159 insertions(+), 2 deletions(-)
> 
> diff --git a/pbs-api-types/src/ldap.rs b/pbs-api-types/src/ldap.rs
> index a08e124b..672c81cd 100644
> --- a/pbs-api-types/src/ldap.rs
> +++ b/pbs-api-types/src/ldap.rs
> @@ -1,6 +1,6 @@
>  use serde::{Deserialize, Serialize};
>  
> -use proxmox_schema::{api, Updater};
> +use proxmox_schema::{api, ApiStringFormat, ApiType, ArraySchema, Schema, StringSchema, Updater};
>  
>  use super::{REALM_ID_SCHEMA, SINGLE_LINE_COMMENT_SCHEMA};
>  
> @@ -32,7 +32,19 @@ pub enum LdapMode {
>          "verify": {
>              optional: true,
>              default: false,
> -        }
> +        },
> +        "sync-defaults-options": {
> +            schema: SYNC_DEFAULTS_STRING_SCHEMA,
> +            optional: true,
> +        },
> +        "sync-attributes": {
> +            schema: SYNC_ATTRIBUTES_SCHEMA,
> +            optional: true,
> +        },
> +        "user-classes" : {
> +            optional: true,
> +            schema: USER_CLASSES_SCHEMA,
> +        },
>      },
>  )]
>  #[derive(Serialize, Deserialize, Updater, Clone)]
> @@ -68,4 +80,112 @@ pub struct LdapRealmConfig {
>      /// Bind password for the given bind-dn
>      #[serde(skip_serializing_if = "Option::is_none")]
>      pub password: Option<String>,
> +    /// Custom LDAP search filter for user sync
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub filter: Option<String>,
> +    /// Default options for LDAP sync
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub sync_defaults_options: Option<String>,
> +    /// List of attributes to sync from LDAP to user config
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub sync_attributes: Option<String>,
> +    /// User ``objectClass`` classes to sync
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub user_classes: Option<String>,
> +}
> +
> +#[api(
> +    properties: {
> +        "remove-vanished": {
> +            optional: true,
> +            schema: REMOVE_VANISHED_SCHEMA,
> +        },
> +    },
> +
> +)]
> +#[derive(Serialize, Deserialize, Updater, Default, Debug)]
> +#[serde(rename_all = "kebab-case")]
> +/// Default options for LDAP synchronization runs
> +pub struct SyncDefaultsOptions {
> +    /// How to handle vanished properties/users
> +    pub remove_vanished: Option<String>,

^ Should be possible to actually use `RemoveVanished` as a type here?
(and replace `schema: REMOVE_..` with `type: RemoveVanished,` in the
`#[api]` block.

> +    /// Enable new users after sync
> +    pub enable_new: Option<bool>,
> +}
> +
> +#[api()]
> +#[derive(Serialize, Deserialize, Debug, PartialEq, Eq)]
> +#[serde(rename_all = "kebab-case")]
> +/// remove-vanished options
> +pub enum RemoveVanished {
> +    /// Delete ACLs for vanished users
> +    Acl,
> +    /// Remove vanished users
> +    Entry,
> +    /// Remove vanished properties from users (e.g. email)
> +    Properties,
>  }
> +
> +pub const SYNC_DEFAULTS_STRING_SCHEMA: Schema = StringSchema::new("sync defaults options")
> +    .format(&ApiStringFormat::PropertyString(
> +        &SyncDefaultsOptions::API_SCHEMA,
> +    ))
> +    .schema();
> +
> +const REMOVE_VANISHED_DESCRIPTION: &str =
> +    "A semicolon-seperated list of things to remove when they or the user \
> +vanishes during user synchronization. The following values are possible: ``entry`` removes the \
> +user when not returned from the sync; ``properties`` removes any  \
> +properties on existing user that do not appear in the source. \
> +``acl`` removes ACLs when the user is not returned from the sync.";
> +
> +pub const REMOVE_VANISHED_SCHEMA: Schema = StringSchema::new(REMOVE_VANISHED_DESCRIPTION)
> +    .format(&ApiStringFormat::PropertyString(&REMOVE_VANISHED_ARRAY))
> +    .schema();
> +
> +pub const REMOVE_VANISHED_ARRAY: Schema = ArraySchema::new(
> +    "Array of remove-vanished options",
> +    &RemoveVanished::API_SCHEMA,
> +)
> +.min_length(1)
> +.schema();
> +
> +#[api()]
> +#[derive(Serialize, Deserialize, Updater, Default, Debug)]
> +#[serde(rename_all = "kebab-case")]
> +/// Determine which LDAP attributes should be synced to which user attributes
> +pub struct SyncAttributes {
> +    /// Name of the LDAP attribute containing the user's email address
> +    pub email: Option<String>,
> +    /// Name of the LDAP attribute containing the user's first name
> +    pub firstname: Option<String>,
> +    /// Name of the LDAP attribute containing the user's last name
> +    pub lastname: Option<String>,
> +}
> +
> +const SYNC_ATTRIBUTES_TEXT: &str = "Comma-separated list of key=value pairs for specifying \
> +which LDAP attributes map to which PBS user field. For example, \
> +to map the LDAP attribute ``mail`` to PBS's ``email``, write \
> +``email=mail``.";
> +
> +pub const SYNC_ATTRIBUTES_SCHEMA: Schema = StringSchema::new(SYNC_ATTRIBUTES_TEXT)
> +    .format(&ApiStringFormat::PropertyString(
> +        &SyncAttributes::API_SCHEMA,
> +    ))
> +    .schema();
> +
> +pub const USER_CLASSES_ARRAY: Schema = ArraySchema::new(
> +    "Array of user classes",
> +    &StringSchema::new("user class").schema(),
> +)
> +.min_length(1)
> +.schema();
> +
> +const USER_CLASSES_TEXT: &str = "Comma-separated list of allowed objectClass values for user synchronization. \
> +For instance, if ``user-classes`` is set to ``person,user``, then user synchronization will consider all LDAP entities
> +where ``objectClass: person`` `or` ``objectClass: user``.";

^ seems to need reformatting (100 char limit)

> +
> +pub const USER_CLASSES_SCHEMA: Schema = StringSchema::new(USER_CLASSES_TEXT)
> +    .format(&ApiStringFormat::PropertyString(&USER_CLASSES_ARRAY))
> +    .default("inetorgperson,posixaccount,person,user")
> +    .schema();