From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 924691FF0B2 for ; Mon, 24 Aug 2026 14:58:00 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4ECE921575; Mon, 24 Aug 2026 14:58:00 +0200 (CEST) From: Thomas Ellmenreich To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup 1/1] openid auth: improve error logging Date: Mon, 24 Aug 2026 14:57:36 +0200 Message-ID: <20260824125736.190804-1-t.ellmenreich@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1787576245396 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.690 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: T3LUXIW366LJCOEGRVLWSTMCEYK4JXOX X-Message-ID-Hash: T3LUXIW366LJCOEGRVLWSTMCEYK4JXOX X-MailFrom: t.ellmenreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Thomas Ellmenreich , Lukas Wagner X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Improve logging when getting the authorization URL fails. Previously, the details of the error were completly swallowed, making it difficult to diagnose problems connecting to the OpenID Connect Server. The new log statement prints out the produced error with all of the contexts provided to `anyhow`, instead of just the one on top of the stack. Doing so should make OpenID connection errors easier to debug. The missing log statement came up as an issue in PDM [1], and this patch now also introduces this to PBS. The original patch in PDM is: [2]. [1]: https://bugzilla.proxmox.com/show_bug.cgi?id=7135 [2]: https://lore.proxmox.com/pdm-devel/20260821102147.220586-1-t.ellmenreich@proxmox.com/T/#t Suggested-by: Lukas Wagner Signed-off-by: Thomas Ellmenreich --- As mentioned by @Lukas on the PDM mailing list: [3] the log statement introduced by this: [2] patch should also be added to PBS for the same reasons. As one might notice, this code is a 1 for 1 copy of the PDM code, and as such should be refactored into a common crate, like proxmox-openid. As that is a bigger intervention, it will be handled in a future series. [3]: https://lore.proxmox.com/pdm-devel/178731214859.187715.588193495057111260.b4-ty@proxmox.com/ src/api2/access/openid.rs | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/api2/access/openid.rs b/src/api2/access/openid.rs index 34f14f467..2e3df269c 100644 --- a/src/api2/access/openid.rs +++ b/src/api2/access/openid.rs @@ -321,14 +321,16 @@ fn openid_auth_url( redirect_url: String, _rpcenv: &mut dyn RpcEnvironment, ) -> Result { - let (domains, _digest) = pbs_config::domains::config()?; - let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?; + let url_result = proxmox_lang::try_block!({ + let (domains, _digest) = pbs_config::domains::config()?; + let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?; - let open_id = openid_authenticator(&config, &redirect_url)?; + let open_id = openid_authenticator(&config, &redirect_url)?; - let url = open_id.authorize_url(PROXMOX_BACKUP_RUN_DIR_M!(), &realm)?; + open_id.authorize_url(PROXMOX_BACKUP_RUN_DIR_M!(), &realm) + }); - Ok(url) + url_result.inspect_err(|err| log::error!("could not get openid auth url: {err:#}")) } #[sortable] -- 2.47.3