[pdm-devel] [PATCH datacenter-manager/yew-comp 0/8] openid support for PDM

[pdm-devel] [PATCH datacenter-manager/yew-comp 0/8] openid support for PDM

[Shannon Sterz]

this series adds openid support to PDM. the implementation is based on
PBS' implementation with a some adaptions:

- smaller refactorings to use more data types instead of simply putting
  them together with serde_json::json!
- move variables into format strings where possible
- only support the HttpOnly variant of the authentication flow

when going through this i at first wanted to put most of the api
endpoints' logic into a proxmox-rs crate. however, i decided against
that as that would have created a couple of other problems. i'll outline
different options below and why i decided against them:

- access-control: the login endpoint needs to be able to sign a ticket.
  currently access-control does not have access to the keyring that
  would be necessary for that. the keyring is available in auth-api, but
  making it public there has possible other downsides. such as suddenly
  making it very hard to audit which parts of our code have access to
  the keyring through auth-api.
- auth-api: the login endpoint would need access to the domains and user
  configs. the first to setup the openid login against the correct host.
  the latter for the auto-create feature when logging in users that have
  no user information in the config yet.
  the user config could be obtained by depending on access-control.
  albeit, that would have required untangling some circular dependencies
  between auth-api and access-control. the domain config, however, is
  currently not in a proxmox-rs crate. so we would have needed to factor
  that out first, which would create quite a bit of churn.
- a new crate/openid crate: this mostly combines the drawbacks of the
  previous two options. so i discarded that as an option too.

if we still want to move the code to a shared proxmox-rs crate, i can
revise this series. however, i think this is a sensible approach for
now.

the series also includes adaptions for proxmox-yew-comp to adapt to
openid login flow and add some missing ui around default realms.

Changelog
---------

the first two patches where taken from a different series [1] and slightly
adapted:

- remove a useless log statement
- instead of referring to "openid authentication" correctly call it
  "openid authorization"
- remove a useless sort() call

[1]: https://lore.proxmox.com/all/20251008151936.386950-1-s.sterz@proxmox.com/

proxmox-yew-comp:

Shannon Sterz (5):
  login_panel/realm_selector: use default realm provided by api
  login_panel/realm_selector: add support for openid realm logins
  auth view: add openid icon to openid menu option
  auth edit openid: add a default realm checkbox
  utils/login panel: move openid redirection authorization helper to
    utils

 src/auth_edit_openid.rs |  11 +-
 src/auth_view.rs        |   2 +-
 src/login_panel.rs      | 312 +++++++++++++++++++++++++++++++---------
 src/realm_selector.rs   |  83 ++++++++++-
 src/utils.rs            |  32 +++++
 5 files changed, 357 insertions(+), 83 deletions(-)


proxmox-datacenter-manager:

Shannon Sterz (3):
  api-types: add default field to openid realm config
  server: api: add support for adding openid realms and openid logins
  ui: enable openid realms in realm panel

 Cargo.toml                             |   2 +-
 lib/pdm-api-types/src/openid.rs        |   3 +
 server/Cargo.toml                      |   1 +
 server/src/api/access/mod.rs           |   2 +
 server/src/api/access/openid.rs        | 311 +++++++++++++++++++++++++
 server/src/api/config/access/mod.rs    |   2 +
 server/src/api/config/access/openid.rs | 290 +++++++++++++++++++++++
 server/src/auth/mod.rs                 |   6 +-
 ui/src/configuration/mod.rs            |   1 +
 9 files changed, 616 insertions(+), 2 deletions(-)
 create mode 100644 server/src/api/access/openid.rs
 create mode 100644 server/src/api/config/access/openid.rs


Summary over all repositories:
  14 files changed, 973 insertions(+), 85 deletions(-)

--
Generated by git-murpp 0.8.1


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH yew-comp 1/5] login_panel/realm_selector: use default realm provided by api

[Shannon Sterz]

when a user has not previously safed their username and realm, use the
default realm provided via the api. if no realm has been specified at
all, still fall back to "pam".

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
note: this was original part of a different series [1].

[1]: https://lore.proxmox.com/all/20251008151936.386950-1-s.sterz@proxmox.com/

 src/login_panel.rs    | 10 +++----
 src/realm_selector.rs | 63 ++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 62 insertions(+), 11 deletions(-)

diff --git a/src/login_panel.rs b/src/login_panel.rs
index 0b835e7..6c3aaa7 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -29,9 +29,9 @@ pub struct LoginPanel {
     pub on_login: Option<Callback<Authentication>>,

     /// Default realm.
-    #[prop_or(AttrValue::from("pam"))]
+    #[prop_or_default]
     #[builder]
-    pub default_realm: AttrValue,
+    pub default_realm: Option<AttrValue>,

     /// Mobile Layout
     ///
@@ -125,16 +125,16 @@ impl ProxmoxLoginPanel {
         });
     }

-    fn get_defaults(&self, props: &LoginPanel) -> (String, String) {
+    fn get_defaults(&self, props: &LoginPanel) -> (String, Option<AttrValue>) {
         let mut default_username = String::from("root");
-        let mut default_realm = props.default_realm.to_string();
+        let mut default_realm = props.default_realm.clone();

         if props.mobile || *self.save_username {
             let last_userid: String = (*self.last_username).to_string();
             if !last_userid.is_empty() {
                 if let Some((user, realm)) = last_userid.rsplit_once('@') {
                     default_username = user.to_owned();
-                    default_realm = realm.to_owned().into();
+                    default_realm = Some(AttrValue::from(realm.to_owned()));
                 }
             }
         }
diff --git a/src/realm_selector.rs b/src/realm_selector.rs
index 0c57bf6..a882e39 100644
--- a/src/realm_selector.rs
+++ b/src/realm_selector.rs
@@ -1,4 +1,4 @@
-use anyhow::format_err;
+use anyhow::{format_err, Error};
 use std::rc::Rc;

 use yew::html::IntoPropValue;
@@ -61,18 +61,36 @@ impl RealmSelector {
     }
 }

-pub struct ProxmoxRealmSelector {
+struct ProxmoxRealmSelector {
     store: Store<BasicRealmInfo>,
     validate: ValidateFn<(String, Store<BasicRealmInfo>)>,
     picker: RenderFn<SelectorRenderArgs<Store<BasicRealmInfo>>>,
+    loaded_default_realm: Option<AttrValue>,
+}
+
+impl ProxmoxRealmSelector {
+    async fn load_realms(url: AttrValue) -> Msg {
+        let response: Result<_, Error> = crate::http_get_full(url.to_string(), None).await;
+
+        match response {
+            Ok(data) => Msg::LoadComplete(data.data),
+            Err(_) => Msg::LoadFailed,
+        }
+    }
+}
+
+enum Msg {
+    LoadComplete(Vec<BasicRealmInfo>),
+    LoadFailed,
 }

 impl Component for ProxmoxRealmSelector {
-    type Message = ();
+    type Message = Msg;
     type Properties = RealmSelector;

     fn create(ctx: &Context<Self>) -> Self {
-        let store = Store::new().on_change(ctx.link().callback(|_| ())); // trigger redraw
+        let store = Store::new();
+        let url = ctx.props().path.clone();

         let validate = ValidateFn::new(|(realm, store): &(String, Store<BasicRealmInfo>)| {
             store
@@ -94,23 +112,56 @@ impl Component for ProxmoxRealmSelector {
                 .into()
         });

+        ctx.link().send_future(Self::load_realms(url));
+
         Self {
             store,
             validate,
             picker,
+            loaded_default_realm: None,
+        }
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Msg::LoadComplete(data) => {
+                let realm = ctx
+                    .props()
+                    .default
+                    .as_ref()
+                    .and_then(|d| data.iter().find(|r| &r.realm == d))
+                    .or_else(|| data.iter().find(|r| r.default.unwrap_or_default()))
+                    .or_else(|| data.iter().find(|r| r.ty == "pam"))
+                    .map(|r| AttrValue::from(r.realm.clone()));
+
+                self.loaded_default_realm = realm;
+                self.store.set_data(data);
+                true
+            }
+            // not much we can do here, so just don't re-render
+            Msg::LoadFailed => false,
         }
     }

     fn view(&self, ctx: &Context<Self>) -> Html {
         let props = ctx.props();
+        let store = self.store.clone();
+
+        let default = props
+            .default
+            .clone()
+            .or_else(|| self.loaded_default_realm.clone())
+            .unwrap_or(AttrValue::from("pam"));

         Selector::new(self.store.clone(), self.picker.clone())
             .with_std_props(&props.std_props)
             .with_input_props(&props.input_props)
             .required(true)
-            .default(props.default.as_deref().unwrap_or("pam").to_string())
-            .loader(props.path.clone())
+            .default(&default)
             .validate(self.validate.clone())
+            // force re-render of the selector after load; returning `true` in update does not
+            // re-render the selector by itself
+            .key(format!("realm-selector-{default}"))
             .into()
     }
 }
--
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH yew-comp 2/5] login_panel/realm_selector: add support for openid realm logins

[Shannon Sterz]

this commit adds support for the openid login flow. it also modifies
the realm selector so that the currently selected realm can be
communicated to the login panel, which can then only render the fields
necessary for an openid realm.

the future handling the openid login request is intentionally spawned
with `wasm_bindgen_futures::spawn_local` so that it does not get
aborted when the view is re-rendered by the CatalogueLoader. it is
also wrapped in a OnceLock to avoid making the call several times.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
note: this was original part of a different series [1].

[1]: https://lore.proxmox.com/all/20251008151936.386950-1-s.sterz@proxmox.com/

 src/login_panel.rs    | 328 +++++++++++++++++++++++++++++++++---------
 src/realm_selector.rs |  26 +++-
 2 files changed, 285 insertions(+), 69 deletions(-)

diff --git a/src/login_panel.rs b/src/login_panel.rs
index 6c3aaa7..8926a32 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -1,5 +1,9 @@
+use std::collections::HashMap;
 use std::rc::Rc;
+use std::sync::OnceLock;

+use proxmox_login::api::CreateTicketResponse;
+use pwt::css::ColorScheme;
 use pwt::props::PwtSpace;
 use pwt::state::PersistentState;
 use pwt::touch::{SnackBar, SnackBarContextExt};
@@ -11,12 +15,15 @@ use pwt::widget::form::{Checkbox, Field, Form, FormContext, InputType, ResetButt
 use pwt::widget::{Column, FieldLabel, InputPanel, LanguageSelector, Mask, Row};
 use pwt::{prelude::*, AsyncPool};

-use proxmox_login::{Authentication, SecondFactorChallenge, TicketResult};
+use proxmox_login::{Authentication, SecondFactorChallenge, Ticket, TicketResult};

+use crate::common_api_types::BasicRealmInfo;
 use crate::{tfa::TfaDialog, RealmSelector};

 use pwt_macros::builder;

+static OPENID_LOGIN: OnceLock<()> = OnceLock::new();
+
 /// Proxmox login panel
 ///
 /// Should support all proxmox product and TFA.
@@ -73,6 +80,9 @@ pub enum Msg {
     Yubico(String),
     RecoveryKey(String),
     WebAuthn(String),
+    UpdateRealm(BasicRealmInfo),
+    OpenIDLogin,
+    OpenIDAuthorization(HashMap<String, String>),
 }

 pub struct ProxmoxLoginPanel {
@@ -83,6 +93,7 @@ pub struct ProxmoxLoginPanel {
     save_username: PersistentState<bool>,
     last_username: PersistentState<String>,
     async_pool: AsyncPool,
+    selected_realm: Option<BasicRealmInfo>,
 }

 impl ProxmoxLoginPanel {
@@ -125,6 +136,121 @@ impl ProxmoxLoginPanel {
         });
     }

+    fn openid_redirect(&self, ctx: &Context<Self>) {
+        let link = ctx.link().clone();
+        let Some(realm) = self.selected_realm.as_ref() else {
+            return;
+        };
+        let Ok(location) = gloo_utils::window().location().origin() else {
+            return;
+        };
+
+        let data = serde_json::json!({
+            "realm": realm.realm,
+            "redirect-url": location,
+        });
+
+        self.async_pool.spawn(async move {
+            match crate::http_post::<String>("/access/openid/auth-url", Some(data)).await {
+                Ok(data) => {
+                    let _ = gloo_utils::window().location().assign(&data);
+                }
+                Err(err) => {
+                    link.send_message(Msg::LoginError(err.to_string()));
+                }
+            }
+        });
+    }
+
+    fn openid_redirection_authorization(ctx: &Context<Self>) {
+        let Ok(query_string) = gloo_utils::window().location().search() else {
+            return;
+        };
+
+        let mut auth = HashMap::new();
+        let query_parameters = query_string.split('&');
+
+        for param in query_parameters {
+            let mut key_value = param.split('=');
+
+            match (key_value.next(), key_value.next()) {
+                (Some("?code") | Some("code"), Some(value)) => {
+                    auth.insert("code".to_string(), value.to_string());
+                }
+                (Some("?state") | Some("state"), Some(value)) => {
+                    if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
+                        auth.insert("state".to_string(), decoded.to_string());
+                    }
+                }
+                _ => continue,
+            };
+        }
+
+        if auth.contains_key("code") && auth.contains_key("state") {
+            ctx.link().send_message(Msg::OpenIDAuthorization(auth));
+        }
+    }
+
+    fn openid_login(&self, ctx: &Context<Self>, mut auth: HashMap<String, String>) {
+        let link = ctx.link().clone();
+        let save_username = ctx.props().mobile || *self.save_username;
+        let Ok(origin) = gloo_utils::window().location().origin() else {
+            return;
+        };
+
+        auth.insert("redirect-url".into(), origin.clone());
+
+        let Ok(auth) = serde_json::to_value(auth) else {
+            return;
+        };
+
+        // run this only once, an openid state is only valid for one round trip. so resending it
+        // here will just fail. also use an unabortable future here for the same reason. otherwise
+        // we could be interrupted by, for example, the catalog loader needing to re-render the
+        // app.
+        OPENID_LOGIN.get_or_init(|| {
+            wasm_bindgen_futures::spawn_local(async move {
+                match crate::http_post::<CreateTicketResponse>("/access/openid/login", Some(auth))
+                    .await
+                {
+                    Ok(creds) => {
+                        let Some(ticket) = creds
+                            .ticket
+                            .or(creds.ticket_info)
+                            .and_then(|t| t.parse::<Ticket>().ok())
+                        else {
+                            log::error!("neither ticket nor ticket-info in openid login response!");
+                            return;
+                        };
+
+                        let Some(csrfprevention_token) = creds.csrfprevention_token else {
+                            log::error!("no CSRF prevention token in the openid login response!");
+                            return;
+                        };
+
+                        let auth = Authentication {
+                            api_url: "".to_string(),
+                            userid: creds.username,
+                            ticket,
+                            clustername: None,
+                            csrfprevention_token,
+                        };
+
+                        // update the authentication, set the realm and user for the next login and
+                        // reload without the query parameters.
+                        crate::http_set_auth(auth.clone());
+                        if save_username {
+                            PersistentState::<String>::new("ProxmoxLoginPanelUsername")
+                                .update(auth.userid.clone());
+                        }
+                        let _ = gloo_utils::window().location().assign(&origin);
+                    }
+                    Err(err) => link.send_message(Msg::LoginError(err.to_string())),
+                }
+            });
+        });
+    }
+
     fn get_defaults(&self, props: &LoginPanel) -> (String, Option<AttrValue>) {
         let mut default_username = String::from("root");
         let mut default_realm = props.default_realm.clone();
@@ -161,36 +287,64 @@ impl ProxmoxLoginPanel {
                 .on_webauthn(ctx.link().callback(Msg::WebAuthn))
         });

-        let form_panel = Column::new()
+        let mut form_panel = Column::new()
             .class(pwt::css::FlexFit)
             .padding(2)
-            .with_flex_spacer()
-            .with_child(
-                FieldLabel::new(tr!("User name"))
-                    .id(username_label_id.clone())
-                    .padding_bottom(PwtSpace::Em(0.25)),
-            )
-            .with_child(
-                Field::new()
-                    .name("username")
-                    .label_id(username_label_id)
-                    .default(default_username)
-                    .required(true)
-                    .autofocus(true),
-            )
-            .with_child(
-                FieldLabel::new(tr!("Password"))
-                    .id(password_label_id.clone())
-                    .padding_top(1)
-                    .padding_bottom(PwtSpace::Em(0.25)),
-            )
-            .with_child(
-                Field::new()
-                    .name("password")
-                    .label_id(password_label_id)
-                    .required(true)
-                    .input_type(InputType::Password),
-            )
+            .with_flex_spacer();
+
+        if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty != "openid")
+            .unwrap_or(true)
+        {
+            form_panel = form_panel
+                .with_child(
+                    FieldLabel::new(tr!("User name"))
+                        .id(username_label_id.clone())
+                        .padding_bottom(PwtSpace::Em(0.25)),
+                )
+                .with_child(
+                    Field::new()
+                        .name("username")
+                        .label_id(username_label_id)
+                        .default(default_username)
+                        .required(true)
+                        .autofocus(true),
+                )
+                .with_child(
+                    FieldLabel::new(tr!("Password"))
+                        .id(password_label_id.clone())
+                        .padding_top(1)
+                        .padding_bottom(PwtSpace::Em(0.25)),
+                )
+                .with_child(
+                    Field::new()
+                        .name("password")
+                        .label_id(password_label_id)
+                        .input_type(InputType::Password),
+                );
+        }
+
+        let submit_button = SubmitButton::new().class(ColorScheme::Primary).margin_y(4);
+
+        let submit_button = if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty == "openid")
+            .unwrap_or_default()
+        {
+            submit_button
+                .text(tr!("Login (OpenID redirect)"))
+                .check_dirty(false)
+                .on_submit(link.callback(move |_| Msg::OpenIDLogin))
+        } else {
+            submit_button
+                .text(tr!("Login"))
+                .on_submit(link.callback(move |_| Msg::Submit))
+        };
+
+        let form_panel = form_panel
             .with_child(
                 FieldLabel::new(tr!("Realm"))
                     .id(realm_label_id.clone())
@@ -202,15 +356,13 @@ impl ProxmoxLoginPanel {
                     .name("realm")
                     .label_id(realm_label_id)
                     .path(props.domain_path.clone())
+                    .on_change({
+                        let link = link.clone();
+                        move |r: BasicRealmInfo| link.send_message(Msg::UpdateRealm(r))
+                    })
                     .default(default_realm),
             )
-            .with_child(
-                SubmitButton::new()
-                    .class("pwt-scheme-primary")
-                    .margin_y(4)
-                    .text(tr!("Login"))
-                    .on_submit(link.callback(move |_| Msg::Submit)),
-            )
+            .with_child(submit_button)
             .with_optional_child(self.login_error.as_ref().map(|msg| {
                 let icon_class = classes!("fa-lg", "fa", "fa-align-center", "fa-exclamation-triangle");
                 let text = tr!("Login failed. Please try again ({0})", msg);
@@ -244,32 +396,46 @@ impl ProxmoxLoginPanel {

         let (default_username, default_realm) = self.get_defaults(props);

-        let input_panel = InputPanel::new()
+        let mut input_panel = InputPanel::new()
             .class(pwt::css::Overflow::Auto)
             .width("initial") // don't try to minimize size
-            .padding(4)
-            .with_field(
-                tr!("User name"),
-                Field::new()
-                    .name("username")
-                    .default(default_username)
-                    .required(true)
-                    .autofocus(true),
-            )
-            .with_field(
-                tr!("Password"),
-                Field::new()
-                    .name("password")
-                    .required(true)
-                    .input_type(InputType::Password),
-            )
-            .with_field(
-                tr!("Realm"),
-                RealmSelector::new()
-                    .name("realm")
-                    .path(props.domain_path.clone())
-                    .default(default_realm),
-            );
+            .padding(4);
+
+        if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty != "openid")
+            .unwrap_or(true)
+        {
+            input_panel = input_panel
+                .with_field(
+                    tr!("User name"),
+                    Field::new()
+                        .name("username")
+                        .default(default_username)
+                        .required(true)
+                        .autofocus(true),
+                )
+                .with_field(
+                    tr!("Password"),
+                    Field::new()
+                        .name("password")
+                        .required(true)
+                        .input_type(InputType::Password),
+                );
+        }
+
+        let input_panel = input_panel.with_field(
+            tr!("Realm"),
+            RealmSelector::new()
+                .name("realm")
+                .path(props.domain_path.clone())
+                .on_change({
+                    let link = link.clone();
+                    move |r: BasicRealmInfo| link.send_message(Msg::UpdateRealm(r))
+                })
+                .default(default_realm),
+        );

         let tfa_dialog = self.challenge.as_ref().map(|challenge| {
             TfaDialog::new(challenge.clone())
@@ -292,6 +458,24 @@ impl ProxmoxLoginPanel {
             .with_child(html! {<label id={save_username_label_id} style="user-select:none;">{tr!("Save User name")}</label>})
             .with_child(save_username_field);

+        let submit_button = SubmitButton::new().class(ColorScheme::Primary);
+
+        let submit_button = if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty == "openid")
+            .unwrap_or_default()
+        {
+            submit_button
+                .text(tr!("Login (OpenID redirect)"))
+                .check_dirty(false)
+                .on_submit(link.callback(move |_| Msg::OpenIDLogin))
+        } else {
+            submit_button
+                .text(tr!("Login"))
+                .on_submit(link.callback(move |_| Msg::Submit))
+        };
+
         let toolbar = Row::new()
             .padding(2)
             .gap(2)
@@ -301,12 +485,7 @@ impl ProxmoxLoginPanel {
             .with_flex_spacer()
             .with_child(save_username)
             .with_child(ResetButton::new())
-            .with_child(
-                SubmitButton::new()
-                    .class("pwt-scheme-primary")
-                    .text(tr!("Login"))
-                    .on_submit(link.callback(move |_| Msg::Submit)),
-            );
+            .with_child(submit_button);

         let form_panel = Column::new()
             .class(pwt::css::FlexFit)
@@ -342,6 +521,8 @@ impl Component for ProxmoxLoginPanel {
         let save_username = PersistentState::<bool>::new("ProxmoxLoginPanelSaveUsername");
         let last_username = PersistentState::<String>::new("ProxmoxLoginPanelUsername");

+        Self::openid_redirection_authorization(ctx);
+
         Self {
             form_ctx,
             loading: false,
@@ -350,6 +531,7 @@ impl Component for ProxmoxLoginPanel {
             save_username,
             last_username,
             async_pool: AsyncPool::new(),
+            selected_realm: None,
         }
     }

@@ -483,6 +665,20 @@ impl Component for ProxmoxLoginPanel {
                 }
                 true
             }
+            Msg::UpdateRealm(realm) => {
+                self.selected_realm = Some(realm);
+                true
+            }
+            Msg::OpenIDLogin => {
+                self.loading = true;
+                self.openid_redirect(ctx);
+                false
+            }
+            Msg::OpenIDAuthorization(auth) => {
+                self.loading = true;
+                self.openid_login(ctx, auth);
+                false
+            }
         }
     }

diff --git a/src/realm_selector.rs b/src/realm_selector.rs
index a882e39..305e544 100644
--- a/src/realm_selector.rs
+++ b/src/realm_selector.rs
@@ -1,4 +1,5 @@
 use anyhow::{format_err, Error};
+use html::IntoEventCallback;
 use std::rc::Rc;

 use yew::html::IntoPropValue;
@@ -47,6 +48,11 @@ pub struct RealmSelector {
     #[builder(IntoPropValue, into_prop_value)]
     #[prop_or("/access/domains".into())]
     pub path: AttrValue,
+
+    /// Change callback
+    #[builder_cb(IntoEventCallback, into_event_callback, BasicRealmInfo)]
+    #[prop_or_default]
+    pub on_change: Option<Callback<BasicRealmInfo>>,
 }

 impl Default for RealmSelector {
@@ -131,10 +137,15 @@ impl Component for ProxmoxRealmSelector {
                     .as_ref()
                     .and_then(|d| data.iter().find(|r| &r.realm == d))
                     .or_else(|| data.iter().find(|r| r.default.unwrap_or_default()))
-                    .or_else(|| data.iter().find(|r| r.ty == "pam"))
-                    .map(|r| AttrValue::from(r.realm.clone()));
+                    .or_else(|| data.iter().find(|r| r.ty == "pam"));

-                self.loaded_default_realm = realm;
+                if let Some(cb) = ctx.props().on_change.as_ref() {
+                    if let Some(realm) = realm {
+                        cb.emit(realm.clone());
+                    }
+                }
+
+                self.loaded_default_realm = realm.map(|r| AttrValue::from(r.realm.clone()));
                 self.store.set_data(data);
                 true
             }
@@ -153,12 +164,21 @@ impl Component for ProxmoxRealmSelector {
             .or_else(|| self.loaded_default_realm.clone())
             .unwrap_or(AttrValue::from("pam"));

+        let on_change = props.on_change.clone().map(|c| {
+            Callback::from(move |k| {
+                if let Some(realm) = store.read().lookup_record(&k) {
+                    c.emit(realm.clone());
+                }
+            })
+        });
+
         Selector::new(self.store.clone(), self.picker.clone())
             .with_std_props(&props.std_props)
             .with_input_props(&props.input_props)
             .required(true)
             .default(&default)
             .validate(self.validate.clone())
+            .on_change(on_change)
             // force re-render of the selector after load; returning `true` in update does not
             // re-render the selector by itself
             .key(format!("realm-selector-{default}"))
--
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH yew-comp 3/5] auth view: add openid icon to openid menu option

[Shannon Sterz]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/auth_view.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/auth_view.rs b/src/auth_view.rs
index aac08e0..d6e5528 100644
--- a/src/auth_view.rs
+++ b/src/auth_view.rs
@@ -303,7 +303,7 @@ impl LoadableComponent for ProxmoxAuthView {
         if props.openid_base_url.is_some() {
             add_menu.add_item(
                 MenuItem::new(tr!("OpenId Connect Server"))
-                    //.icon_class("fa fa-fw fa-user-o")
+                    .icon_class("fa fa-fw fa-openid")
                     .on_select(
                         ctx.link()
                             .change_view_callback(|_| Some(ViewState::AddOpenID)),
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH yew-comp 4/5] auth edit openid: add a default realm checkbox

[Shannon Sterz]

so that openid realms can be set as default realms

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/auth_edit_openid.rs | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/auth_edit_openid.rs b/src/auth_edit_openid.rs
index 5c29e15..8968ea1 100644
--- a/src/auth_edit_openid.rs
+++ b/src/auth_edit_openid.rs
@@ -106,10 +106,7 @@ fn render_input_form(form_ctx: FormContext, props: AuthEditOpenID) -> Html {
                 .submit(!is_edit),
         )
         .with_right_field(tr!("Autocreate Users"), Checkbox::new().name("autocreate"))
-        .with_field(
-            tr!("Client ID"),
-            Field::new().name("client-id").required(true),
-        )
+        .with_field(tr!("Default Realm"), Checkbox::new().name("default"))
         .with_right_field(
             tr!("Username Claim"),
             Combobox::new()
@@ -120,13 +117,17 @@ fn render_input_form(form_ctx: FormContext, props: AuthEditOpenID) -> Html {
                 .placeholder(tr!("Default"))
                 .items(username_claim_items),
         )
-        .with_field(tr!("Client Key"), Field::new().name("client-key"))
+        .with_field(
+            tr!("Client ID"),
+            Field::new().name("client-id").required(true),
+        )
         .with_right_field(
             tr!("Scopes"),
             Field::new()
                 .name("scopes")
                 .placeholder(tr!("Default") + " (" + &tr!("email profile") + ")"),
         )
+        .with_field(tr!("Client Key"), Field::new().name("client-key"))
         .with_right_field(
             tr!("Prompt"),
             Combobox::new()
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH yew-comp 5/5] utils/login panel: move openid redirection authorization helper to utils

[Shannon Sterz]

this allows users of this crate to check whether url parameters for an
openid authorization request are present. allowing for minimal user
interaction for completing the login flow.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
note: this is mostly important for users of this crate that don't show
the login component right away (for example, because they want to render
a consent screen first).

 src/login_panel.rs | 34 ++++------------------------------
 src/utils.rs       | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 30 deletions(-)

diff --git a/src/login_panel.rs b/src/login_panel.rs
index 8926a32..f2ce93f 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -18,6 +18,7 @@ use pwt::{prelude::*, AsyncPool};
 use proxmox_login::{Authentication, SecondFactorChallenge, Ticket, TicketResult};

 use crate::common_api_types::BasicRealmInfo;
+use crate::utils;
 use crate::{tfa::TfaDialog, RealmSelector};

 use pwt_macros::builder;
@@ -162,35 +163,6 @@ impl ProxmoxLoginPanel {
         });
     }

-    fn openid_redirection_authorization(ctx: &Context<Self>) {
-        let Ok(query_string) = gloo_utils::window().location().search() else {
-            return;
-        };
-
-        let mut auth = HashMap::new();
-        let query_parameters = query_string.split('&');
-
-        for param in query_parameters {
-            let mut key_value = param.split('=');
-
-            match (key_value.next(), key_value.next()) {
-                (Some("?code") | Some("code"), Some(value)) => {
-                    auth.insert("code".to_string(), value.to_string());
-                }
-                (Some("?state") | Some("state"), Some(value)) => {
-                    if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
-                        auth.insert("state".to_string(), decoded.to_string());
-                    }
-                }
-                _ => continue,
-            };
-        }
-
-        if auth.contains_key("code") && auth.contains_key("state") {
-            ctx.link().send_message(Msg::OpenIDAuthorization(auth));
-        }
-    }
-
     fn openid_login(&self, ctx: &Context<Self>, mut auth: HashMap<String, String>) {
         let link = ctx.link().clone();
         let save_username = ctx.props().mobile || *self.save_username;
@@ -521,7 +493,9 @@ impl Component for ProxmoxLoginPanel {
         let save_username = PersistentState::<bool>::new("ProxmoxLoginPanelSaveUsername");
         let last_username = PersistentState::<String>::new("ProxmoxLoginPanelUsername");

-        Self::openid_redirection_authorization(ctx);
+        if let Some(auth) = utils::openid_redirection_authorization() {
+            ctx.link().send_message(Msg::OpenIDAuthorization(auth));
+        }

         Self {
             form_ctx,
diff --git a/src/utils.rs b/src/utils.rs
index 79b7ad7..1796a0b 100644
--- a/src/utils.rs
+++ b/src/utils.rs
@@ -2,6 +2,7 @@ use std::collections::HashMap;
 use std::fmt::Display;
 use std::sync::Mutex;

+use percent_encoding::percent_decode;
 use serde_json::Value;
 use wasm_bindgen::JsCast;
 use yew::prelude::*;
@@ -462,3 +463,34 @@ pub fn register_pve_tasks() {
     register_task_description("zfscreate", (tr!("ZFS Storage"), tr!("Create")));
     register_task_description("zfsremove", ("ZFS Pool", tr!("Remove")));
 }
+
+pub fn openid_redirection_authorization() -> Option<HashMap<String, String>> {
+    let Ok(query_string) = gloo_utils::window().location().search() else {
+        return None;
+    };
+
+    let mut auth = HashMap::new();
+    let query_parameters = query_string.split('&');
+
+    for param in query_parameters {
+        let mut key_value = param.split('=');
+
+        match (key_value.next(), key_value.next()) {
+            (Some("?code") | Some("code"), Some(value)) => {
+                auth.insert("code".to_string(), value.to_string());
+            }
+            (Some("?state") | Some("state"), Some(value)) => {
+                if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
+                    auth.insert("state".to_string(), decoded.to_string());
+                }
+            }
+            _ => continue,
+        };
+    }
+
+    if auth.contains_key("code") && auth.contains_key("state") {
+        return Some(auth);
+    }
+
+    None
+}
--
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 1/3] api-types: add default field to openid realm config

[Shannon Sterz]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 lib/pdm-api-types/src/openid.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/pdm-api-types/src/openid.rs b/lib/pdm-api-types/src/openid.rs
index 8893edc..c129d35 100644
--- a/lib/pdm-api-types/src/openid.rs
+++ b/lib/pdm-api-types/src/openid.rs
@@ -109,6 +109,9 @@ pub struct OpenIdRealmConfig {
     pub client_key: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub comment: Option<String>,
+    /// True if you want this to be the default realm selected on login.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<bool>,
     /// Automatically create users if they do not exist.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub autocreate: Option<bool>,
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 2/3] server: api: add support for adding openid realms and openid logins

[Shannon Sterz]

only supports the new HttpOnly authentication flow, as PDM does not
support non-HttpOnly authentication at the moment.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 Cargo.toml                             |   2 +-
 server/Cargo.toml                      |   1 +
 server/src/api/access/mod.rs           |   2 +
 server/src/api/access/openid.rs        | 311 +++++++++++++++++++++++++
 server/src/api/config/access/mod.rs    |   2 +
 server/src/api/config/access/openid.rs | 290 +++++++++++++++++++++++
 server/src/auth/mod.rs                 |   6 +-
 7 files changed, 612 insertions(+), 2 deletions(-)
 create mode 100644 server/src/api/access/openid.rs
 create mode 100644 server/src/api/config/access/openid.rs

diff --git a/Cargo.toml b/Cargo.toml
index f820409..39a0b23 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ proxmox-uuid = "1"
 
 # other proxmox crates
 proxmox-acme = "0.5"
-proxmox-openid = "0.10"
+proxmox-openid = "1.0.2"
 
 # api implementation creates
 proxmox-config-digest = "1"
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 0dfcb6c..94420b4 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -44,6 +44,7 @@ proxmox-lang.workspace = true
 proxmox-ldap.workspace = true
 proxmox-log.workspace = true
 proxmox-login.workspace = true
+proxmox-openid.workspace = true
 proxmox-rest-server = { workspace = true, features = [ "templates" ] }
 proxmox-router = { workspace = true, features = [ "cli", "server"] }
 proxmox-rrd.workspace = true
diff --git a/server/src/api/access/mod.rs b/server/src/api/access/mod.rs
index 345b22f..a6874a5 100644
--- a/server/src/api/access/mod.rs
+++ b/server/src/api/access/mod.rs
@@ -14,6 +14,7 @@ use proxmox_sortable_macro::sortable;
 use pdm_api_types::{Authid, ACL_PATH_SCHEMA, PRIVILEGES, PRIV_ACCESS_AUDIT};
 
 mod domains;
+mod openid;
 mod tfa;
 mod users;
 
@@ -33,6 +34,7 @@ const SUBDIRS: SubdirMap = &sorted!([
             .post(&proxmox_auth_api::api::API_METHOD_CREATE_TICKET_HTTP_ONLY)
             .delete(&proxmox_auth_api::api::API_METHOD_LOGOUT),
     ),
+    ("openid", &openid::ROUTER),
     ("users", &users::ROUTER),
 ]);
 
diff --git a/server/src/api/access/openid.rs b/server/src/api/access/openid.rs
new file mode 100644
index 0000000..5f662f0
--- /dev/null
+++ b/server/src/api/access/openid.rs
@@ -0,0 +1,311 @@
+//! OpenID redirect/login API
+use anyhow::{bail, format_err, Error};
+use hyper::http::request::Parts;
+use hyper::Response;
+use pdm_api_types::{OpenIdRealmConfig, OPENID_DEFAULT_SCOPE_LIST, REALM_ID_SCHEMA};
+use pdm_buildcfg::PDM_RUN_DIR_M;
+use proxmox_auth_api::api::ApiTicket;
+use proxmox_login::api::CreateTicketResponse;
+use serde_json::{json, Value};
+
+use proxmox_auth_api::api::{assemble_csrf_prevention_token, AuthContext};
+use proxmox_auth_api::ticket::Ticket;
+use proxmox_router::{
+    http_err, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
+    Router, RpcEnvironment, SubdirMap,
+};
+use proxmox_schema::{api, BooleanSchema, ObjectSchema, ParameterSchema, StringSchema};
+use proxmox_sortable_macro::sortable;
+
+use proxmox_openid::{OpenIdAuthenticator, OpenIdConfig};
+
+use proxmox_access_control::types::{User, EMAIL_SCHEMA, FIRST_NAME_SCHEMA, LAST_NAME_SCHEMA};
+use proxmox_auth_api::types::Userid;
+
+use proxmox_access_control::CachedUserInfo;
+
+use crate::auth;
+
+fn openid_authenticator(
+    realm_config: &OpenIdRealmConfig,
+    redirect_url: &str,
+) -> Result<OpenIdAuthenticator, Error> {
+    let scopes: Vec<String> = realm_config
+        .scopes
+        .as_deref()
+        .unwrap_or(OPENID_DEFAULT_SCOPE_LIST)
+        .split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+        .filter(|s| !s.is_empty())
+        .map(String::from)
+        .collect();
+
+    let mut acr_values = None;
+    if let Some(ref list) = realm_config.acr_values {
+        acr_values = Some(
+            list.split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+                .filter(|s| !s.is_empty())
+                .map(String::from)
+                .collect(),
+        );
+    }
+
+    let config = OpenIdConfig {
+        issuer_url: realm_config.issuer_url.clone(),
+        client_id: realm_config.client_id.clone(),
+        client_key: realm_config.client_key.clone(),
+        prompt: realm_config.prompt.clone(),
+        scopes: Some(scopes),
+        acr_values,
+    };
+    OpenIdAuthenticator::discover(&config, redirect_url)
+}
+
+#[sortable]
+pub const API_METHOD_OPENID_LOGIN: ApiMethod = ApiMethod::new_full(
+    &ApiHandler::AsyncHttpBodyParameters(&create_ticket_http_only),
+    ParameterSchema::Object(&ObjectSchema::new(
+        "Get a new ticket as an HttpOnly cookie. Supports tickets via cookies.",
+        &sorted!([
+            ("state", false, &StringSchema::new("OpenId state.").schema()),
+            (
+                "code",
+                false,
+                &StringSchema::new("OpenId authorization code.").schema(),
+            ),
+            (
+                "redirect-url",
+                false,
+                &StringSchema::new(
+                    "Redirection Url. The client should set this to used server url.",
+                )
+                .schema(),
+            ),
+        ]),
+    )),
+)
+.returns(::proxmox_schema::ReturnType::new(
+    false,
+    &ObjectSchema::new(
+        "An authentication ticket with additional infos.",
+        &sorted!([
+            ("username", false, &StringSchema::new("User name.").schema()),
+            (
+                "ticket",
+                true,
+                &StringSchema::new(
+                    "Auth ticket, present if http-only was not provided or is false."
+                )
+                .schema()
+            ),
+            ("ticket-info",
+                true,
+                &StringSchema::new(
+                    "Informational ticket, can only be used to check if the ticket is expired. Present if http-only was true."
+                ).schema()),
+            (
+                "CSRFPreventionToken",
+                false,
+                &StringSchema::new("Cross Site Request Forgery Prevention Token.").schema(),
+            ),
+        ]),
+    )
+    .schema(),
+))
+.protected(true)
+.access(None, &Permission::World)
+.reload_timezone(true);
+
+fn create_ticket_http_only(
+    _parts: Parts,
+    param: Value,
+    _info: &ApiMethod,
+    rpcenv: Box<dyn RpcEnvironment>,
+) -> ApiResponseFuture {
+    Box::pin(async move {
+        use proxmox_rest_server::RestEnvironment;
+
+        let code = param["code"]
+            .as_str()
+            .ok_or_else(|| format_err!("missing non-optional parameter: code"))?
+            .to_owned();
+        let state = param["state"]
+            .as_str()
+            .ok_or_else(|| format_err!("missing non-optional parameter: state"))?
+            .to_owned();
+        let redirect_url = param["redirect-url"]
+            .as_str()
+            .ok_or_else(|| format_err!("missing non-optional parameter: redirect-url"))?
+            .to_owned();
+
+        let env: &RestEnvironment = rpcenv
+            .as_any()
+            .downcast_ref::<RestEnvironment>()
+            .ok_or_else(|| format_err!("detected wrong RpcEnvironment type"))?;
+
+        let user_info = CachedUserInfo::new()?;
+        let auth_context = auth::get_auth_context()
+            .ok_or_else(|| format_err!("could not get authentication context"))?;
+
+        let mut tested_username = None;
+
+        let result = (|| {
+            let (realm, private_auth_state) =
+                OpenIdAuthenticator::verify_public_auth_state(PDM_RUN_DIR_M!(), &state)?;
+
+            let (domains, _digest) = pdm_config::domains::config()?;
+            let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+            let open_id = openid_authenticator(&config, &redirect_url)?;
+            let info = open_id.verify_authorization_code_simple(&code, &private_auth_state)?;
+            let name_attr = config.username_claim.as_deref().unwrap_or("sub");
+
+            // Try to be compatible with previous versions
+            let try_attr = match name_attr {
+                "subject" => Some("sub"),
+                "username" => Some("preferred_username"),
+                _ => None,
+            };
+
+            let unique_name = if let Some(name) = info[name_attr]
+                .as_str()
+                .or_else(|| try_attr.and_then(|att| info[att].as_str()))
+            {
+                name.to_owned()
+            } else {
+                bail!("missing claim '{name_attr}'");
+            };
+
+            let user_id = Userid::try_from(format!("{unique_name}@{realm}"))?;
+            tested_username = Some(unique_name);
+
+            if !user_info.is_active_user_id(&user_id) {
+                if config.autocreate.unwrap_or(false) {
+                    let _lock = proxmox_access_control::user::lock_config()?;
+                    let (mut user_config, _digest) = proxmox_access_control::user::config()?;
+
+                    if let Ok(old_user) = user_config.lookup::<User>("user", user_id.as_str()) {
+                        if let Some(false) = old_user.enable {
+                            bail!("user '{user_id}' is disabled.");
+                        } else {
+                            bail!("autocreate user failed - '{user_id}' already exists.");
+                        }
+                    }
+
+                    let firstname = info["given_name"]
+                        .as_str()
+                        .map(|n| n.to_string())
+                        .filter(|n| FIRST_NAME_SCHEMA.parse_simple_value(n).is_ok());
+
+                    let lastname = info["family_name"]
+                        .as_str()
+                        .map(|n| n.to_string())
+                        .filter(|n| LAST_NAME_SCHEMA.parse_simple_value(n).is_ok());
+
+                    let email = info["email"]
+                        .as_str()
+                        .map(|n| n.to_string())
+                        .filter(|n| EMAIL_SCHEMA.parse_simple_value(n).is_ok());
+
+                    let user = User {
+                        userid: user_id.clone(),
+                        comment: None,
+                        enable: None,
+                        expire: None,
+                        firstname,
+                        lastname,
+                        email,
+                    };
+
+                    user_config.set_data(user.userid.as_str(), "user", &user)?;
+                    proxmox_access_control::user::save_config(&user_config)?;
+                } else {
+                    bail!("user account '{user_id}' missing, disabled or expired.");
+                }
+            }
+
+            let api_ticket = ApiTicket::Full(user_id.clone());
+            let ticket = Ticket::new(auth_context.auth_prefix(), &api_ticket)?;
+            let token = assemble_csrf_prevention_token(auth_context.csrf_secret(), &user_id);
+            env.log_auth(user_id.as_str());
+
+            Ok((user_id, ticket, token))
+        })();
+
+        let (user_id, mut ticket, token) = result.map_err(|err| {
+            let msg = err.to_string();
+            env.log_failed_auth(tested_username, &msg);
+            http_err!(UNAUTHORIZED, "{msg}")
+        })?;
+
+        let cookie = format!(
+            "{}={}; Secure; SameSite=Lax; HttpOnly; Path=/;",
+            auth_context.prefixed_auth_cookie_name(),
+            ticket.sign(auth_context.keyring(), None)?,
+        );
+
+        let response = Response::builder()
+            .header(hyper::http::header::CONTENT_TYPE, "application/json")
+            .header(hyper::header::SET_COOKIE, cookie);
+
+        let data = CreateTicketResponse {
+            csrfprevention_token: Some(token),
+            clustername: None,
+            ticket: None,
+            ticket_info: Some(ticket.ticket_info()),
+            username: user_id.to_string(),
+        };
+
+        Ok(response.body(
+            json!({"data": data, "status": 200, "success": true })
+                .to_string()
+                .into(),
+        )?)
+    })
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+            "redirect-url": {
+                description: "Redirection Url. The client should set this to used server url.",
+                type: String,
+            },
+        },
+    },
+    returns: {
+        description: "Redirection URL.",
+        type: String,
+    },
+    access: {
+        description: "Anyone can access this (before the user is authenticated).",
+        permission: &Permission::World,
+    },
+)]
+/// Create OpenID Redirect Session
+pub fn openid_auth_url(
+    realm: String,
+    redirect_url: String,
+    _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<String, Error> {
+    let (domains, _digest) = pdm_config::domains::config()?;
+    let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+
+    let open_id = openid_authenticator(&config, &redirect_url)?;
+
+    let url = open_id.authorize_url(PDM_RUN_DIR_M!(), &realm)?;
+
+    Ok(url)
+}
+
+#[sortable]
+const SUBDIRS: SubdirMap = &sorted!([
+    ("login", &Router::new().post(&API_METHOD_OPENID_LOGIN)),
+    ("auth-url", &Router::new().post(&API_METHOD_OPENID_AUTH_URL)),
+]);
+
+pub const ROUTER: Router = Router::new()
+    .get(&list_subdirs_api_method!(SUBDIRS))
+    .subdirs(SUBDIRS);
diff --git a/server/src/api/config/access/mod.rs b/server/src/api/config/access/mod.rs
index 7454f53..5776152 100644
--- a/server/src/api/config/access/mod.rs
+++ b/server/src/api/config/access/mod.rs
@@ -4,12 +4,14 @@ use proxmox_sortable_macro::sortable;
 
 mod ad;
 mod ldap;
+mod openid;
 pub mod tfa;
 
 #[sortable]
 const SUBDIRS: SubdirMap = &sorted!([
     ("tfa", &tfa::ROUTER),
     ("ldap", &ldap::ROUTER),
+    ("openid", &openid::ROUTER),
     ("ad", &ad::ROUTER),
 ]);
 
diff --git a/server/src/api/config/access/openid.rs b/server/src/api/config/access/openid.rs
new file mode 100644
index 0000000..555a1e1
--- /dev/null
+++ b/server/src/api/config/access/openid.rs
@@ -0,0 +1,290 @@
+use ::serde::{Deserialize, Serialize};
+/// Configure OpenId realms
+use anyhow::Error;
+use pdm_api_types::ConfigDigest;
+use serde_json::Value;
+
+use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
+use proxmox_schema::{api, param_bail};
+
+use pdm_api_types::{
+    OpenIdRealmConfig, OpenIdRealmConfigUpdater, PRIV_REALM_ALLOCATE, PRIV_SYS_AUDIT,
+    REALM_ID_SCHEMA,
+};
+
+use pdm_config::domains;
+
+#[api(
+    input: {
+        properties: {},
+    },
+    returns: {
+        description: "List of configured OpenId realms.",
+        type: Array,
+        items: { type: OpenIdRealmConfig },
+    },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// List configured OpenId realms
+pub fn list_openid_realms(
+    _param: Value,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<Vec<OpenIdRealmConfig>, Error> {
+    let (config, digest) = domains::config()?;
+
+    let list = config.convert_to_typed_array("openid")?;
+
+    rpcenv["digest"] = hex::encode(digest).into();
+
+    Ok(list)
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            config: {
+                type: OpenIdRealmConfig,
+                flatten: true,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// Create a new OpenId realm
+pub fn create_openid_realm(config: OpenIdRealmConfig) -> Result<(), Error> {
+    let _lock = domains::lock_config()?;
+
+    let (mut domains, _digest) = domains::config()?;
+
+    if domains::exists(&domains, &config.realm) {
+        param_bail!("realm", "realm '{}' already exists.", config.realm);
+    }
+
+    if let Some(true) = config.default {
+        domains::unset_default_realm(&mut domains)?;
+    }
+
+    domains.set_data(&config.realm, "openid", &config)?;
+
+    domains::save_config(&domains)?;
+
+    Ok(())
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+            digest: {
+                optional: true,
+                type: ConfigDigest,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// Remove a OpenID realm configuration
+pub fn delete_openid_realm(
+    realm: String,
+    digest: Option<ConfigDigest>,
+    _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let _lock = domains::lock_config()?;
+
+    let (mut domains, expected_digest) = domains::config()?;
+    expected_digest.detect_modification(digest.as_ref())?;
+
+    if domains.sections.remove(&realm).is_none() {
+        http_bail!(NOT_FOUND, "realm '{realm}' does not exist.");
+    }
+
+    domains::save_config(&domains)?;
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+        },
+    },
+    returns:  { type: OpenIdRealmConfig },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_SYS_AUDIT, false),
+    },
+)]
+/// Read the OpenID realm configuration
+pub fn read_openid_realm(
+    realm: String,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<OpenIdRealmConfig, Error> {
+    let (domains, digest) = domains::config()?;
+
+    let config = domains.lookup("openid", &realm)?;
+    rpcenv["digest"] = hex::encode(digest).into();
+
+    Ok(config)
+}
+
+#[api()]
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+/// Deletable property name
+pub enum DeletableProperty {
+    /// Delete the client key.
+    ClientKey,
+    /// Delete the comment property.
+    Comment,
+    /// Delete the default property.
+    Default,
+    /// Delete the autocreate property
+    Autocreate,
+    /// Delete the scopes property
+    Scopes,
+    /// Delete the prompt property
+    Prompt,
+    /// Delete the acr_values property
+    AcrValues,
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+            update: {
+                type: OpenIdRealmConfigUpdater,
+                flatten: true,
+            },
+            delete: {
+                description: "List of properties to delete.",
+                type: Array,
+                optional: true,
+                items: {
+                    type: DeletableProperty,
+                }
+            },
+            digest: {
+                optional: true,
+                type: ConfigDigest,
+            },
+        },
+    },
+    returns:  { type: OpenIdRealmConfig },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// Update an OpenID realm configuration
+pub fn update_openid_realm(
+    realm: String,
+    update: OpenIdRealmConfigUpdater,
+    delete: Option<Vec<DeletableProperty>>,
+    digest: Option<ConfigDigest>,
+    _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let _lock = domains::lock_config()?;
+
+    let (mut domains, expected_digest) = domains::config()?;
+    expected_digest.detect_modification(digest.as_ref())?;
+
+    let mut config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+
+    if let Some(delete) = delete {
+        for delete_prop in delete {
+            match delete_prop {
+                DeletableProperty::ClientKey => {
+                    config.client_key = None;
+                }
+                DeletableProperty::Comment => {
+                    config.comment = None;
+                }
+                DeletableProperty::Default => {
+                    config.default = None;
+                }
+                DeletableProperty::Autocreate => {
+                    config.autocreate = None;
+                }
+                DeletableProperty::Scopes => {
+                    config.scopes = None;
+                }
+                DeletableProperty::Prompt => {
+                    config.prompt = None;
+                }
+                DeletableProperty::AcrValues => {
+                    config.acr_values = None;
+                }
+            }
+        }
+    }
+
+    if let Some(comment) = update.comment {
+        let comment = comment.trim().to_string();
+        if comment.is_empty() {
+            config.comment = None;
+        } else {
+            config.comment = Some(comment);
+        }
+    }
+
+    if let Some(true) = update.default {
+        domains::unset_default_realm(&mut domains)?;
+        config.default = Some(true);
+    } else {
+        config.default = None;
+    }
+
+    if let Some(issuer_url) = update.issuer_url {
+        config.issuer_url = issuer_url;
+    }
+    if let Some(client_id) = update.client_id {
+        config.client_id = client_id;
+    }
+
+    if update.client_key.is_some() {
+        config.client_key = update.client_key;
+    }
+    if update.autocreate.is_some() {
+        config.autocreate = update.autocreate;
+    }
+    if update.scopes.is_some() {
+        config.scopes = update.scopes;
+    }
+    if update.prompt.is_some() {
+        config.prompt = update.prompt;
+    }
+    if update.acr_values.is_some() {
+        config.acr_values = update.acr_values;
+    }
+
+    domains.set_data(&realm, "openid", &config)?;
+
+    domains::save_config(&domains)?;
+
+    Ok(())
+}
+
+const ITEM_ROUTER: Router = Router::new()
+    .get(&API_METHOD_READ_OPENID_REALM)
+    .put(&API_METHOD_UPDATE_OPENID_REALM)
+    .delete(&API_METHOD_DELETE_OPENID_REALM);
+
+pub const ROUTER: Router = Router::new()
+    .get(&API_METHOD_LIST_OPENID_REALMS)
+    .post(&API_METHOD_CREATE_OPENID_REALM)
+    .match_all("realm", &ITEM_ROUTER);
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 532350d..9413a83 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -81,7 +81,11 @@ fn setup_auth_context(use_private_key: bool) {
     proxmox_auth_api::set_auth_context(AUTH_CONTEXT.get().unwrap());
 }
 
-struct PdmAuthContext {
+pub(crate) fn get_auth_context() -> Option<&'static PdmAuthContext> {
+    AUTH_CONTEXT.get()
+}
+
+pub(crate) struct PdmAuthContext {
     keyring: Keyring,
     csrf_secret: &'static HMACKey,
 }
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

Re: [pdm-devel] [PATCH datacenter-manager 2/3] server: api: add support for adding openid realms and openid logins

[Fabian Grünbichler]

On October 14, 2025 3:30 pm, Shannon Sterz wrote:
> only supports the new HttpOnly authentication flow, as PDM does not
> support non-HttpOnly authentication at the moment.
> 
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>  Cargo.toml                             |   2 +-
>  server/Cargo.toml                      |   1 +
>  server/src/api/access/mod.rs           |   2 +
>  server/src/api/access/openid.rs        | 311 +++++++++++++++++++++++++
>  server/src/api/config/access/mod.rs    |   2 +
>  server/src/api/config/access/openid.rs | 290 +++++++++++++++++++++++
>  server/src/auth/mod.rs                 |   6 +-
>  7 files changed, 612 insertions(+), 2 deletions(-)
>  create mode 100644 server/src/api/access/openid.rs
>  create mode 100644 server/src/api/config/access/openid.rs
> 
> diff --git a/Cargo.toml b/Cargo.toml
> index f820409..39a0b23 100644
> --- a/Cargo.toml
> +++ b/Cargo.toml
> @@ -68,7 +68,7 @@ proxmox-uuid = "1"
>  
>  # other proxmox crates
>  proxmox-acme = "0.5"
> -proxmox-openid = "0.10"
> +proxmox-openid = "1.0.2"
>  
>  # api implementation creates
>  proxmox-config-digest = "1"
> diff --git a/server/Cargo.toml b/server/Cargo.toml
> index 0dfcb6c..94420b4 100644
> --- a/server/Cargo.toml
> +++ b/server/Cargo.toml
> @@ -44,6 +44,7 @@ proxmox-lang.workspace = true
>  proxmox-ldap.workspace = true
>  proxmox-log.workspace = true
>  proxmox-login.workspace = true
> +proxmox-openid.workspace = true
>  proxmox-rest-server = { workspace = true, features = [ "templates" ] }
>  proxmox-router = { workspace = true, features = [ "cli", "server"] }
>  proxmox-rrd.workspace = true
> diff --git a/server/src/api/access/mod.rs b/server/src/api/access/mod.rs
> index 345b22f..a6874a5 100644
> --- a/server/src/api/access/mod.rs
> +++ b/server/src/api/access/mod.rs
> @@ -14,6 +14,7 @@ use proxmox_sortable_macro::sortable;
>  use pdm_api_types::{Authid, ACL_PATH_SCHEMA, PRIVILEGES, PRIV_ACCESS_AUDIT};
>  
>  mod domains;
> +mod openid;
>  mod tfa;
>  mod users;
>  
> @@ -33,6 +34,7 @@ const SUBDIRS: SubdirMap = &sorted!([
>              .post(&proxmox_auth_api::api::API_METHOD_CREATE_TICKET_HTTP_ONLY)
>              .delete(&proxmox_auth_api::api::API_METHOD_LOGOUT),
>      ),
> +    ("openid", &openid::ROUTER),
>      ("users", &users::ROUTER),
>  ]);
>  
> diff --git a/server/src/api/access/openid.rs b/server/src/api/access/openid.rs
> new file mode 100644
> index 0000000..5f662f0
> --- /dev/null
> +++ b/server/src/api/access/openid.rs
> @@ -0,0 +1,311 @@
> +//! OpenID redirect/login API
> +use anyhow::{bail, format_err, Error};
> +use hyper::http::request::Parts;
> +use hyper::Response;
> +use pdm_api_types::{OpenIdRealmConfig, OPENID_DEFAULT_SCOPE_LIST, REALM_ID_SCHEMA};
> +use pdm_buildcfg::PDM_RUN_DIR_M;

nit: these two should be listed last..

> +use proxmox_auth_api::api::ApiTicket;
> +use proxmox_login::api::CreateTicketResponse;

and these two below, but - this is the wrong CreateTicketResponse?

should be proxmox_auth_api::types::CreateTicketResponse..

> +use serde_json::{json, Value};
> +
> +use proxmox_auth_api::api::{assemble_csrf_prevention_token, AuthContext};
> +use proxmox_auth_api::ticket::Ticket;
> +use proxmox_router::{
> +    http_err, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
> +    Router, RpcEnvironment, SubdirMap,
> +};
> +use proxmox_schema::{api, BooleanSchema, ObjectSchema, ParameterSchema, StringSchema};

nit: BooleanSchema is not used..

> +use proxmox_sortable_macro::sortable;
> +
> +use proxmox_openid::{OpenIdAuthenticator, OpenIdConfig};
> +
> +use proxmox_access_control::types::{User, EMAIL_SCHEMA, FIRST_NAME_SCHEMA, LAST_NAME_SCHEMA};
> +use proxmox_auth_api::types::Userid;
> +
> +use proxmox_access_control::CachedUserInfo;

and those last five are not sorted

> +
> +use crate::auth;
> +
> +fn openid_authenticator(
> +    realm_config: &OpenIdRealmConfig,
> +    redirect_url: &str,
> +) -> Result<OpenIdAuthenticator, Error> {
> +    let scopes: Vec<String> = realm_config
> +        .scopes
> +        .as_deref()
> +        .unwrap_or(OPENID_DEFAULT_SCOPE_LIST)
> +        .split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
> +        .filter(|s| !s.is_empty())
> +        .map(String::from)
> +        .collect();
> +
> +    let mut acr_values = None;
> +    if let Some(ref list) = realm_config.acr_values {
> +        acr_values = Some(
> +            list.split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
> +                .filter(|s| !s.is_empty())
> +                .map(String::from)
> +                .collect(),
> +        );
> +    }
> +
> +    let config = OpenIdConfig {
> +        issuer_url: realm_config.issuer_url.clone(),
> +        client_id: realm_config.client_id.clone(),
> +        client_key: realm_config.client_key.clone(),
> +        prompt: realm_config.prompt.clone(),
> +        scopes: Some(scopes),
> +        acr_values,
> +    };
> +    OpenIdAuthenticator::discover(&config, redirect_url)
> +}
> +
> +#[sortable]
> +pub const API_METHOD_OPENID_LOGIN: ApiMethod = ApiMethod::new_full(
> +    &ApiHandler::AsyncHttpBodyParameters(&create_ticket_http_only),
> +    ParameterSchema::Object(&ObjectSchema::new(
> +        "Get a new ticket as an HttpOnly cookie. Supports tickets via cookies.",
> +        &sorted!([
> +            ("state", false, &StringSchema::new("OpenId state.").schema()),
> +            (
> +                "code",
> +                false,
> +                &StringSchema::new("OpenId authorization code.").schema(),
> +            ),
> +            (
> +                "redirect-url",
> +                false,
> +                &StringSchema::new(
> +                    "Redirection Url. The client should set this to used server url.",
> +                )
> +                .schema(),
> +            ),
> +        ]),
> +    )),
> +)
> +.returns(::proxmox_schema::ReturnType::new(
> +    false,
> +    &ObjectSchema::new(

and if we use the right CreateTicketResponse type above, we can use the
API_SCHEMA it already has here :)

> +        "An authentication ticket with additional infos.",
> +        &sorted!([
> +            ("username", false, &StringSchema::new("User name.").schema()),
> +            (
> +                "ticket",
> +                true,
> +                &StringSchema::new(
> +                    "Auth ticket, present if http-only was not provided or is false."
> +                )
> +                .schema()
> +            ),
> +            ("ticket-info",
> +                true,
> +                &StringSchema::new(
> +                    "Informational ticket, can only be used to check if the ticket is expired. Present if http-only was true."
> +                ).schema()),
> +            (
> +                "CSRFPreventionToken",
> +                false,
> +                &StringSchema::new("Cross Site Request Forgery Prevention Token.").schema(),
> +            ),
> +        ]),
> +    )
> +    .schema(),
> +))
> +.protected(true)
> +.access(None, &Permission::World)
> +.reload_timezone(true);
> +
> +fn create_ticket_http_only(
> +    _parts: Parts,
> +    param: Value,
> +    _info: &ApiMethod,
> +    rpcenv: Box<dyn RpcEnvironment>,
> +) -> ApiResponseFuture {
> +    Box::pin(async move {
> +        use proxmox_rest_server::RestEnvironment;
> +
> +        let code = param["code"]
> +            .as_str()
> +            .ok_or_else(|| format_err!("missing non-optional parameter: code"))?
> +            .to_owned();
> +        let state = param["state"]
> +            .as_str()
> +            .ok_or_else(|| format_err!("missing non-optional parameter: state"))?
> +            .to_owned();
> +        let redirect_url = param["redirect-url"]
> +            .as_str()
> +            .ok_or_else(|| format_err!("missing non-optional parameter: redirect-url"))?
> +            .to_owned();
> +
> +        let env: &RestEnvironment = rpcenv
> +            .as_any()
> +            .downcast_ref::<RestEnvironment>()
> +            .ok_or_else(|| format_err!("detected wrong RpcEnvironment type"))?;
> +
> +        let user_info = CachedUserInfo::new()?;
> +        let auth_context = auth::get_auth_context()
> +            .ok_or_else(|| format_err!("could not get authentication context"))?;
> +
> +        let mut tested_username = None;
> +
> +        let result = (|| {

is there a reason to not use try_block! for this, like in the rest of
our code base?

> +            let (realm, private_auth_state) =
> +                OpenIdAuthenticator::verify_public_auth_state(PDM_RUN_DIR_M!(), &state)?;
> +
> +            let (domains, _digest) = pdm_config::domains::config()?;
> +            let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
> +            let open_id = openid_authenticator(&config, &redirect_url)?;
> +            let info = open_id.verify_authorization_code_simple(&code, &private_auth_state)?;
> +            let name_attr = config.username_claim.as_deref().unwrap_or("sub");
> +
> +            // Try to be compatible with previous versions
> +            let try_attr = match name_attr {
> +                "subject" => Some("sub"),
> +                "username" => Some("preferred_username"),
> +                _ => None,
> +            };
> +
> +            let unique_name = if let Some(name) = info[name_attr]
> +                .as_str()
> +                .or_else(|| try_attr.and_then(|att| info[att].as_str()))
> +            {
> +                name.to_owned()
> +            } else {
> +                bail!("missing claim '{name_attr}'");
> +            };
> +
> +            let user_id = Userid::try_from(format!("{unique_name}@{realm}"))?;
> +            tested_username = Some(unique_name);
> +
> +            if !user_info.is_active_user_id(&user_id) {
> +                if config.autocreate.unwrap_or(false) {
> +                    let _lock = proxmox_access_control::user::lock_config()?;
> +                    let (mut user_config, _digest) = proxmox_access_control::user::config()?;
> +
> +                    if let Ok(old_user) = user_config.lookup::<User>("user", user_id.as_str()) {
> +                        if let Some(false) = old_user.enable {
> +                            bail!("user '{user_id}' is disabled.");
> +                        } else {
> +                            bail!("autocreate user failed - '{user_id}' already exists.");
> +                        }
> +                    }
> +
> +                    let firstname = info["given_name"]
> +                        .as_str()
> +                        .map(|n| n.to_string())
> +                        .filter(|n| FIRST_NAME_SCHEMA.parse_simple_value(n).is_ok());
> +
> +                    let lastname = info["family_name"]
> +                        .as_str()
> +                        .map(|n| n.to_string())
> +                        .filter(|n| LAST_NAME_SCHEMA.parse_simple_value(n).is_ok());
> +
> +                    let email = info["email"]
> +                        .as_str()
> +                        .map(|n| n.to_string())
> +                        .filter(|n| EMAIL_SCHEMA.parse_simple_value(n).is_ok());
> +
> +                    let user = User {
> +                        userid: user_id.clone(),
> +                        comment: None,
> +                        enable: None,
> +                        expire: None,
> +                        firstname,
> +                        lastname,
> +                        email,
> +                    };
> +
> +                    user_config.set_data(user.userid.as_str(), "user", &user)?;
> +                    proxmox_access_control::user::save_config(&user_config)?;
> +                } else {
> +                    bail!("user account '{user_id}' missing, disabled or expired.");
> +                }
> +            }
> +
> +            let api_ticket = ApiTicket::Full(user_id.clone());
> +            let ticket = Ticket::new(auth_context.auth_prefix(), &api_ticket)?;
> +            let token = assemble_csrf_prevention_token(auth_context.csrf_secret(), &user_id);
> +            env.log_auth(user_id.as_str());
> +
> +            Ok((user_id, ticket, token))
> +        })();
> +
> +        let (user_id, mut ticket, token) = result.map_err(|err| {
> +            let msg = err.to_string();
> +            env.log_failed_auth(tested_username, &msg);

this is copied over from PBS, but isn't this also kinda wrong? not every
error above is a failed auth.. at least if we compare error handling
here with the one in the regular ticket flow, this is inconsistent..

might rather be follow-up material after closer thought though, and
ensuring PBS and PDM behave the same afterwards..

> +            http_err!(UNAUTHORIZED, "{msg}")
> +        })?;
> +
> +        let cookie = format!(
> +            "{}={}; Secure; SameSite=Lax; HttpOnly; Path=/;",
> +            auth_context.prefixed_auth_cookie_name(),
> +            ticket.sign(auth_context.keyring(), None)?,
> +        );
> +
> +        let response = Response::builder()
> +            .header(hyper::http::header::CONTENT_TYPE, "application/json")
> +            .header(hyper::header::SET_COOKIE, cookie);
> +
> +        let data = CreateTicketResponse {
> +            csrfprevention_token: Some(token),
> +            clustername: None,

this is then removed

> +            ticket: None,
> +            ticket_info: Some(ticket.ticket_info()),
> +            username: user_id.to_string(),

as well as the to_string here

> +        };
> +
> +        Ok(response.body(
> +            json!({"data": data, "status": 200, "success": true })
> +                .to_string()
> +                .into(),
> +        )?)
> +    })
> +}
> +
> +#[api(
> +    protected: true,
> +    input: {
> +        properties: {
> +            realm: {
> +                schema: REALM_ID_SCHEMA,
> +            },
> +            "redirect-url": {
> +                description: "Redirection Url. The client should set this to used server url.",
> +                type: String,

String type without a schema :-/

> +            },
> +        },
> +    },
> +    returns: {
> +        description: "Redirection URL.",
> +        type: String,
> +    },
> +    access: {
> +        description: "Anyone can access this (before the user is authenticated).",
> +        permission: &Permission::World,
> +    },
> +)]
> +/// Create OpenID Redirect Session
> +pub fn openid_auth_url(
> +    realm: String,
> +    redirect_url: String,
> +    _rpcenv: &mut dyn RpcEnvironment,
> +) -> Result<String, Error> {
> +    let (domains, _digest) = pdm_config::domains::config()?;
> +    let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
> +
> +    let open_id = openid_authenticator(&config, &redirect_url)?;
> +
> +    let url = open_id.authorize_url(PDM_RUN_DIR_M!(), &realm)?;
> +
> +    Ok(url)
> +}
> +
> +#[sortable]
> +const SUBDIRS: SubdirMap = &sorted!([
> +    ("login", &Router::new().post(&API_METHOD_OPENID_LOGIN)),
> +    ("auth-url", &Router::new().post(&API_METHOD_OPENID_AUTH_URL)),
> +]);
> +
> +pub const ROUTER: Router = Router::new()
> +    .get(&list_subdirs_api_method!(SUBDIRS))
> +    .subdirs(SUBDIRS);
> diff --git a/server/src/api/config/access/mod.rs b/server/src/api/config/access/mod.rs
> index 7454f53..5776152 100644
> --- a/server/src/api/config/access/mod.rs
> +++ b/server/src/api/config/access/mod.rs
> @@ -4,12 +4,14 @@ use proxmox_sortable_macro::sortable;
>  
>  mod ad;
>  mod ldap;
> +mod openid;
>  pub mod tfa;
>  
>  #[sortable]
>  const SUBDIRS: SubdirMap = &sorted!([
>      ("tfa", &tfa::ROUTER),
>      ("ldap", &ldap::ROUTER),
> +    ("openid", &openid::ROUTER),
>      ("ad", &ad::ROUTER),
>  ]);
>  
> diff --git a/server/src/api/config/access/openid.rs b/server/src/api/config/access/openid.rs
> new file mode 100644
> index 0000000..555a1e1
> --- /dev/null
> +++ b/server/src/api/config/access/openid.rs
> @@ -0,0 +1,290 @@
> +use ::serde::{Deserialize, Serialize};
> +/// Configure OpenId realms
> +use anyhow::Error;
> +use pdm_api_types::ConfigDigest;

same here as for the other module

> +use serde_json::Value;
> +
> +use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
> +use proxmox_schema::{api, param_bail};
> +
> +use pdm_api_types::{
> +    OpenIdRealmConfig, OpenIdRealmConfigUpdater, PRIV_REALM_ALLOCATE, PRIV_SYS_AUDIT,
> +    REALM_ID_SCHEMA,
> +};
> +
> +use pdm_config::domains;
> +
> +#[api(
> +    input: {
> +        properties: {},
> +    },
> +    returns: {
> +        description: "List of configured OpenId realms.",
> +        type: Array,
> +        items: { type: OpenIdRealmConfig },
> +    },
> +    access: {
> +        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
> +    },
> +)]
> +/// List configured OpenId realms
> +pub fn list_openid_realms(
> +    _param: Value,
> +    rpcenv: &mut dyn RpcEnvironment,
> +) -> Result<Vec<OpenIdRealmConfig>, Error> {
> +    let (config, digest) = domains::config()?;
> +
> +    let list = config.convert_to_typed_array("openid")?;
> +
> +    rpcenv["digest"] = hex::encode(digest).into();
> +
> +    Ok(list)
> +}
> +
> +#[api(
> +    protected: true,
> +    input: {
> +        properties: {
> +            config: {
> +                type: OpenIdRealmConfig,
> +                flatten: true,
> +            },
> +        },
> +    },
> +    access: {
> +        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
> +    },
> +)]
> +/// Create a new OpenId realm
> +pub fn create_openid_realm(config: OpenIdRealmConfig) -> Result<(), Error> {
> +    let _lock = domains::lock_config()?;
> +
> +    let (mut domains, _digest) = domains::config()?;
> +
> +    if domains::exists(&domains, &config.realm) {
> +        param_bail!("realm", "realm '{}' already exists.", config.realm);
> +    }
> +
> +    if let Some(true) = config.default {
> +        domains::unset_default_realm(&mut domains)?;
> +    }
> +
> +    domains.set_data(&config.realm, "openid", &config)?;
> +
> +    domains::save_config(&domains)?;
> +
> +    Ok(())
> +}
> +
> +#[api(
> +    protected: true,
> +    input: {
> +        properties: {
> +            realm: {
> +                schema: REALM_ID_SCHEMA,
> +            },
> +            digest: {
> +                optional: true,
> +                type: ConfigDigest,
> +            },
> +        },
> +    },
> +    access: {
> +        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
> +    },
> +)]
> +/// Remove a OpenID realm configuration
> +pub fn delete_openid_realm(
> +    realm: String,
> +    digest: Option<ConfigDigest>,
> +    _rpcenv: &mut dyn RpcEnvironment,
> +) -> Result<(), Error> {
> +    let _lock = domains::lock_config()?;
> +
> +    let (mut domains, expected_digest) = domains::config()?;
> +    expected_digest.detect_modification(digest.as_ref())?;
> +
> +    if domains.sections.remove(&realm).is_none() {
> +        http_bail!(NOT_FOUND, "realm '{realm}' does not exist.");
> +    }
> +
> +    domains::save_config(&domains)?;
> +
> +    Ok(())
> +}
> +
> +#[api(
> +    input: {
> +        properties: {
> +            realm: {
> +                schema: REALM_ID_SCHEMA,
> +            },
> +        },
> +    },
> +    returns:  { type: OpenIdRealmConfig },
> +    access: {
> +        permission: &Permission::Privilege(&["access", "domains"], PRIV_SYS_AUDIT, false),
> +    },
> +)]
> +/// Read the OpenID realm configuration
> +pub fn read_openid_realm(
> +    realm: String,
> +    rpcenv: &mut dyn RpcEnvironment,
> +) -> Result<OpenIdRealmConfig, Error> {
> +    let (domains, digest) = domains::config()?;
> +
> +    let config = domains.lookup("openid", &realm)?;
> +    rpcenv["digest"] = hex::encode(digest).into();
> +
> +    Ok(config)
> +}
> +
> +#[api()]
> +#[derive(Serialize, Deserialize)]
> +#[serde(rename_all = "kebab-case")]
> +/// Deletable property name
> +pub enum DeletableProperty {
> +    /// Delete the client key.
> +    ClientKey,
> +    /// Delete the comment property.
> +    Comment,
> +    /// Delete the default property.
> +    Default,
> +    /// Delete the autocreate property
> +    Autocreate,
> +    /// Delete the scopes property
> +    Scopes,
> +    /// Delete the prompt property
> +    Prompt,
> +    /// Delete the acr_values property
> +    AcrValues,
> +}
> +
> +#[api(
> +    protected: true,
> +    input: {
> +        properties: {
> +            realm: {
> +                schema: REALM_ID_SCHEMA,
> +            },
> +            update: {
> +                type: OpenIdRealmConfigUpdater,
> +                flatten: true,
> +            },
> +            delete: {
> +                description: "List of properties to delete.",
> +                type: Array,
> +                optional: true,
> +                items: {
> +                    type: DeletableProperty,
> +                }
> +            },
> +            digest: {
> +                optional: true,
> +                type: ConfigDigest,
> +            },
> +        },
> +    },
> +    returns:  { type: OpenIdRealmConfig },
> +    access: {
> +        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
> +    },
> +)]
> +/// Update an OpenID realm configuration
> +pub fn update_openid_realm(
> +    realm: String,
> +    update: OpenIdRealmConfigUpdater,
> +    delete: Option<Vec<DeletableProperty>>,
> +    digest: Option<ConfigDigest>,
> +    _rpcenv: &mut dyn RpcEnvironment,
> +) -> Result<(), Error> {
> +    let _lock = domains::lock_config()?;
> +
> +    let (mut domains, expected_digest) = domains::config()?;
> +    expected_digest.detect_modification(digest.as_ref())?;
> +
> +    let mut config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
> +
> +    if let Some(delete) = delete {
> +        for delete_prop in delete {
> +            match delete_prop {
> +                DeletableProperty::ClientKey => {
> +                    config.client_key = None;
> +                }
> +                DeletableProperty::Comment => {
> +                    config.comment = None;
> +                }
> +                DeletableProperty::Default => {
> +                    config.default = None;
> +                }
> +                DeletableProperty::Autocreate => {
> +                    config.autocreate = None;
> +                }
> +                DeletableProperty::Scopes => {
> +                    config.scopes = None;
> +                }
> +                DeletableProperty::Prompt => {
> +                    config.prompt = None;
> +                }
> +                DeletableProperty::AcrValues => {
> +                    config.acr_values = None;
> +                }
> +            }
> +        }
> +    }
> +
> +    if let Some(comment) = update.comment {
> +        let comment = comment.trim().to_string();
> +        if comment.is_empty() {
> +            config.comment = None;
> +        } else {
> +            config.comment = Some(comment);
> +        }
> +    }
> +
> +    if let Some(true) = update.default {
> +        domains::unset_default_realm(&mut domains)?;
> +        config.default = Some(true);
> +    } else {
> +        config.default = None;
> +    }
> +
> +    if let Some(issuer_url) = update.issuer_url {
> +        config.issuer_url = issuer_url;
> +    }
> +    if let Some(client_id) = update.client_id {
> +        config.client_id = client_id;
> +    }
> +
> +    if update.client_key.is_some() {
> +        config.client_key = update.client_key;
> +    }
> +    if update.autocreate.is_some() {
> +        config.autocreate = update.autocreate;
> +    }
> +    if update.scopes.is_some() {
> +        config.scopes = update.scopes;
> +    }
> +    if update.prompt.is_some() {
> +        config.prompt = update.prompt;
> +    }
> +    if update.acr_values.is_some() {
> +        config.acr_values = update.acr_values;
> +    }
> +
> +    domains.set_data(&realm, "openid", &config)?;
> +
> +    domains::save_config(&domains)?;
> +
> +    Ok(())
> +}
> +
> +const ITEM_ROUTER: Router = Router::new()
> +    .get(&API_METHOD_READ_OPENID_REALM)
> +    .put(&API_METHOD_UPDATE_OPENID_REALM)
> +    .delete(&API_METHOD_DELETE_OPENID_REALM);
> +
> +pub const ROUTER: Router = Router::new()
> +    .get(&API_METHOD_LIST_OPENID_REALMS)
> +    .post(&API_METHOD_CREATE_OPENID_REALM)
> +    .match_all("realm", &ITEM_ROUTER);
> diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
> index 532350d..9413a83 100644
> --- a/server/src/auth/mod.rs
> +++ b/server/src/auth/mod.rs
> @@ -81,7 +81,11 @@ fn setup_auth_context(use_private_key: bool) {
>      proxmox_auth_api::set_auth_context(AUTH_CONTEXT.get().unwrap());
>  }
>  
> -struct PdmAuthContext {
> +pub(crate) fn get_auth_context() -> Option<&'static PdmAuthContext> {
> +    AUTH_CONTEXT.get()
> +}
> +
> +pub(crate) struct PdmAuthContext {
>      keyring: Keyring,
>      csrf_secret: &'static HMACKey,
>  }
> -- 
> 2.47.3
> 
> 
> 
> _______________________________________________
> pdm-devel mailing list
> pdm-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
> 
> 
> 


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

Re: [pdm-devel] [PATCH datacenter-manager 2/3] server: api: add support for adding openid realms and openid logins

[Shannon Sterz]

On Fri Oct 17, 2025 at 9:57 AM CEST, Fabian Grünbichler wrote:
> On October 14, 2025 3:30 pm, Shannon Sterz wrote:

-->8 snip 8<--

>> +            let (realm, private_auth_state) =
>> +                OpenIdAuthenticator::verify_public_auth_state(PDM_RUN_DIR_M!(), &state)?;
>> +
>> +            let (domains, _digest) = pdm_config::domains::config()?;
>> +            let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
>> +            let open_id = openid_authenticator(&config, &redirect_url)?;
>> +            let info = open_id.verify_authorization_code_simple(&code, &private_auth_state)?;
>> +            let name_attr = config.username_claim.as_deref().unwrap_or("sub");
>> +
>> +            // Try to be compatible with previous versions
>> +            let try_attr = match name_attr {
>> +                "subject" => Some("sub"),
>> +                "username" => Some("preferred_username"),
>> +                _ => None,
>> +            };
>> +
>> +            let unique_name = if let Some(name) = info[name_attr]
>> +                .as_str()
>> +                .or_else(|| try_attr.and_then(|att| info[att].as_str()))
>> +            {
>> +                name.to_owned()
>> +            } else {
>> +                bail!("missing claim '{name_attr}'");
>> +            };
>> +
>> +            let user_id = Userid::try_from(format!("{unique_name}@{realm}"))?;
>> +            tested_username = Some(unique_name);
>> +
>> +            if !user_info.is_active_user_id(&user_id) {
>> +                if config.autocreate.unwrap_or(false) {
>> +                    let _lock = proxmox_access_control::user::lock_config()?;
>> +                    let (mut user_config, _digest) = proxmox_access_control::user::config()?;
>> +
>> +                    if let Ok(old_user) = user_config.lookup::<User>("user", user_id.as_str()) {
>> +                        if let Some(false) = old_user.enable {
>> +                            bail!("user '{user_id}' is disabled.");
>> +                        } else {
>> +                            bail!("autocreate user failed - '{user_id}' already exists.");
>> +                        }
>> +                    }
>> +
>> +                    let firstname = info["given_name"]
>> +                        .as_str()
>> +                        .map(|n| n.to_string())
>> +                        .filter(|n| FIRST_NAME_SCHEMA.parse_simple_value(n).is_ok());
>> +
>> +                    let lastname = info["family_name"]
>> +                        .as_str()
>> +                        .map(|n| n.to_string())
>> +                        .filter(|n| LAST_NAME_SCHEMA.parse_simple_value(n).is_ok());
>> +
>> +                    let email = info["email"]
>> +                        .as_str()
>> +                        .map(|n| n.to_string())
>> +                        .filter(|n| EMAIL_SCHEMA.parse_simple_value(n).is_ok());
>> +
>> +                    let user = User {
>> +                        userid: user_id.clone(),
>> +                        comment: None,
>> +                        enable: None,
>> +                        expire: None,
>> +                        firstname,
>> +                        lastname,
>> +                        email,
>> +                    };
>> +
>> +                    user_config.set_data(user.userid.as_str(), "user", &user)?;
>> +                    proxmox_access_control::user::save_config(&user_config)?;
>> +                } else {
>> +                    bail!("user account '{user_id}' missing, disabled or expired.");
>> +                }
>> +            }
>> +
>> +            let api_ticket = ApiTicket::Full(user_id.clone());
>> +            let ticket = Ticket::new(auth_context.auth_prefix(), &api_ticket)?;
>> +            let token = assemble_csrf_prevention_token(auth_context.csrf_secret(), &user_id);
>> +            env.log_auth(user_id.as_str());
>> +
>> +            Ok((user_id, ticket, token))
>> +        })();
>> +
>> +        let (user_id, mut ticket, token) = result.map_err(|err| {
>> +            let msg = err.to_string();
>> +            env.log_failed_auth(tested_username, &msg);
>
> this is copied over from PBS, but isn't this also kinda wrong? not every
> error above is a failed auth.. at least if we compare error handling
> here with the one in the regular ticket flow, this is inconsistent..
>
> might rather be follow-up material after closer thought though, and
> ensuring PBS and PDM behave the same afterwards..


yes this requires some though as to whether will accidentally leak some
information here otherwise. for now i'd keep it in line with pbs.

incorporated the rest of the feedback here into a v2!


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 3/3] ui: enable openid realms in realm panel

[Shannon Sterz]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/configuration/mod.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/src/configuration/mod.rs b/ui/src/configuration/mod.rs
index 0a92796..2a0bbcc 100644
--- a/ui/src/configuration/mod.rs
+++ b/ui/src/configuration/mod.rs
@@ -112,6 +112,7 @@ pub fn access_control() -> Html {
                 AuthView::new()
                     .ldap_base_url("/config/access/ldap")
                     .ad_base_url("/config/access/ad")
+                    .openid_base_url("/config/access/openid")
                     .into()
             },
         );
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

Re: [pdm-devel] [PATCH datacenter-manager/yew-comp 0/8] openid support for PDM

[Fabian Grünbichler]

On October 14, 2025 3:30 pm, Shannon Sterz wrote:
> this series adds openid support to PDM. the implementation is based on
> PBS' implementation with a some adaptions:
> 
> - smaller refactorings to use more data types instead of simply putting
>   them together with serde_json::json!
> - move variables into format strings where possible
> - only support the HttpOnly variant of the authentication flow
> 
> when going through this i at first wanted to put most of the api
> endpoints' logic into a proxmox-rs crate. however, i decided against
> that as that would have created a couple of other problems. i'll outline
> different options below and why i decided against them:
> 
> - access-control: the login endpoint needs to be able to sign a ticket.
>   currently access-control does not have access to the keyring that
>   would be necessary for that. the keyring is available in auth-api, but
>   making it public there has possible other downsides. such as suddenly
>   making it very hard to audit which parts of our code have access to
>   the keyring through auth-api.

the keyring is technically public there already (else PDM couldn't sign
tickets using it as below ;)) - so I would not object in principle to
also using it in access-control, it's not like that is some random crate
that has no business being concerned with that.

I do get the point (raised off-list) that access-control parts could be
used in the front-end as well, but that can be solved by either
splitting it further or using feature guards where appropriate..

the main benefit of having this in access-control would be at some point
migrating PBS over as well, but that will surely cause more churn
anyway, so as long as it is kept in mind that there is code duplication
there (which is true for the whole auth stack anyway), it's not
something that needs to be solved now IMHO.

> - auth-api: the login endpoint would need access to the domains and user
>   configs. the first to setup the openid login against the correct host.
>   the latter for the auto-create feature when logging in users that have
>   no user information in the config yet.
>   the user config could be obtained by depending on access-control.
>   albeit, that would have required untangling some circular dependencies
>   between auth-api and access-control. the domain config, however, is
>   currently not in a proxmox-rs crate. so we would have needed to factor
>   that out first, which would create quite a bit of churn.
> - a new crate/openid crate: this mostly combines the drawbacks of the
>   previous two options. so i discarded that as an option too.
> 
> if we still want to move the code to a shared proxmox-rs crate, i can
> revise this series. however, i think this is a sensible approach for
> now.
> 
> the series also includes adaptions for proxmox-yew-comp to adapt to
> openid login flow and add some missing ui around default realms.
> 
> Changelog
> ---------
> 
> the first two patches where taken from a different series [1] and slightly
> adapted:
> 
> - remove a useless log statement
> - instead of referring to "openid authentication" correctly call it
>   "openid authorization"
> - remove a useless sort() call
> 
> [1]: https://lore.proxmox.com/all/20251008151936.386950-1-s.sterz@proxmox.com/
> 
> proxmox-yew-comp:
> 
> Shannon Sterz (5):
>   login_panel/realm_selector: use default realm provided by api
>   login_panel/realm_selector: add support for openid realm logins
>   auth view: add openid icon to openid menu option
>   auth edit openid: add a default realm checkbox
>   utils/login panel: move openid redirection authorization helper to
>     utils
> 
>  src/auth_edit_openid.rs |  11 +-
>  src/auth_view.rs        |   2 +-
>  src/login_panel.rs      | 312 +++++++++++++++++++++++++++++++---------
>  src/realm_selector.rs   |  83 ++++++++++-
>  src/utils.rs            |  32 +++++
>  5 files changed, 357 insertions(+), 83 deletions(-)
> 
> 
> proxmox-datacenter-manager:
> 
> Shannon Sterz (3):
>   api-types: add default field to openid realm config
>   server: api: add support for adding openid realms and openid logins
>   ui: enable openid realms in realm panel
> 
>  Cargo.toml                             |   2 +-
>  lib/pdm-api-types/src/openid.rs        |   3 +
>  server/Cargo.toml                      |   1 +
>  server/src/api/access/mod.rs           |   2 +
>  server/src/api/access/openid.rs        | 311 +++++++++++++++++++++++++
>  server/src/api/config/access/mod.rs    |   2 +
>  server/src/api/config/access/openid.rs | 290 +++++++++++++++++++++++
>  server/src/auth/mod.rs                 |   6 +-
>  ui/src/configuration/mod.rs            |   1 +
>  9 files changed, 616 insertions(+), 2 deletions(-)
>  create mode 100644 server/src/api/access/openid.rs
>  create mode 100644 server/src/api/config/access/openid.rs
> 
> 
> Summary over all repositories:
>   14 files changed, 973 insertions(+), 85 deletions(-)
> 
> --
> Generated by git-murpp 0.8.1
> 
> 
> _______________________________________________
> pdm-devel mailing list
> pdm-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
> 
> 
> 


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

Re: [pdm-devel] [PATCH datacenter-manager/yew-comp 0/8] openid support for PDM

[Shannon Sterz]

On Fri Oct 17, 2025 at 10:01 AM CEST, Fabian Grünbichler wrote:
> On October 14, 2025 3:30 pm, Shannon Sterz wrote:
>> this series adds openid support to PDM. the implementation is based on
>> PBS' implementation with a some adaptions:
>>
>> - smaller refactorings to use more data types instead of simply putting
>>   them together with serde_json::json!
>> - move variables into format strings where possible
>> - only support the HttpOnly variant of the authentication flow
>>
>> when going through this i at first wanted to put most of the api
>> endpoints' logic into a proxmox-rs crate. however, i decided against
>> that as that would have created a couple of other problems. i'll outline
>> different options below and why i decided against them:
>>
>> - access-control: the login endpoint needs to be able to sign a ticket.
>>   currently access-control does not have access to the keyring that
>>   would be necessary for that. the keyring is available in auth-api, but
>>   making it public there has possible other downsides. such as suddenly
>>   making it very hard to audit which parts of our code have access to
>>   the keyring through auth-api.
>
> the keyring is technically public there already (else PDM couldn't sign
> tickets using it as below ;)) - so I would not object in principle to
> also using it in access-control, it's not like that is some random crate
> that has no business being concerned with that.
>
> I do get the point (raised off-list) that access-control parts could be
> used in the front-end as well, but that can be solved by either
> splitting it further or using feature guards where appropriate..
>
> the main benefit of having this in access-control would be at some point
> migrating PBS over as well, but that will surely cause more churn
> anyway, so as long as it is kept in mind that there is code duplication
> there (which is true for the whole auth stack anyway), it's not
> something that needs to be solved now IMHO.
>

hm in that case i'd leave these api endpoints where they are for now and
would focus on factoring out more parts of the realm management + these
api endpoints into access-control later.


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] Superseded: Re: [PATCH datacenter-manager/yew-comp 0/8] openid support for PDM

[Shannon Sterz]

On Tue Oct 14, 2025 at 3:30 PM CEST, Shannon Sterz wrote:
> this series adds openid support to PDM. the implementation is based on
> PBS' implementation with a some adaptions:
>
> - smaller refactorings to use more data types instead of simply putting
>   them together with serde_json::json!
> - move variables into format strings where possible
> - only support the HttpOnly variant of the authentication flow
>
> when going through this i at first wanted to put most of the api
> endpoints' logic into a proxmox-rs crate. however, i decided against
> that as that would have created a couple of other problems. i'll outline
> different options below and why i decided against them:
>
> - access-control: the login endpoint needs to be able to sign a ticket.
>   currently access-control does not have access to the keyring that
>   would be necessary for that. the keyring is available in auth-api, but
>   making it public there has possible other downsides. such as suddenly
>   making it very hard to audit which parts of our code have access to
>   the keyring through auth-api.
> - auth-api: the login endpoint would need access to the domains and user
>   configs. the first to setup the openid login against the correct host.
>   the latter for the auto-create feature when logging in users that have
>   no user information in the config yet.
>   the user config could be obtained by depending on access-control.
>   albeit, that would have required untangling some circular dependencies
>   between auth-api and access-control. the domain config, however, is
>   currently not in a proxmox-rs crate. so we would have needed to factor
>   that out first, which would create quite a bit of churn.
> - a new crate/openid crate: this mostly combines the drawbacks of the
>   previous two options. so i discarded that as an option too.
>
> if we still want to move the code to a shared proxmox-rs crate, i can
> revise this series. however, i think this is a sensible approach for
> now.
>
> the series also includes adaptions for proxmox-yew-comp to adapt to
> openid login flow and add some missing ui around default realms.
>
> Changelog
> ---------
>
> the first two patches where taken from a different series [1] and slightly
> adapted:
>
> - remove a useless log statement
> - instead of referring to "openid authentication" correctly call it
>   "openid authorization"
> - remove a useless sort() call
>
> [1]: https://lore.proxmox.com/all/20251008151936.386950-1-s.sterz@proxmox.com/
>
> proxmox-yew-comp:
>
> Shannon Sterz (5):
>   login_panel/realm_selector: use default realm provided by api
>   login_panel/realm_selector: add support for openid realm logins
>   auth view: add openid icon to openid menu option
>   auth edit openid: add a default realm checkbox
>   utils/login panel: move openid redirection authorization helper to
>     utils
>
>  src/auth_edit_openid.rs |  11 +-
>  src/auth_view.rs        |   2 +-
>  src/login_panel.rs      | 312 +++++++++++++++++++++++++++++++---------
>  src/realm_selector.rs   |  83 ++++++++++-
>  src/utils.rs            |  32 +++++
>  5 files changed, 357 insertions(+), 83 deletions(-)
>
>
> proxmox-datacenter-manager:
>
> Shannon Sterz (3):
>   api-types: add default field to openid realm config
>   server: api: add support for adding openid realms and openid logins
>   ui: enable openid realms in realm panel
>
>  Cargo.toml                             |   2 +-
>  lib/pdm-api-types/src/openid.rs        |   3 +
>  server/Cargo.toml                      |   1 +
>  server/src/api/access/mod.rs           |   2 +
>  server/src/api/access/openid.rs        | 311 +++++++++++++++++++++++++
>  server/src/api/config/access/mod.rs    |   2 +
>  server/src/api/config/access/openid.rs | 290 +++++++++++++++++++++++
>  server/src/auth/mod.rs                 |   6 +-
>  ui/src/configuration/mod.rs            |   1 +
>  9 files changed, 616 insertions(+), 2 deletions(-)
>  create mode 100644 server/src/api/access/openid.rs
>  create mode 100644 server/src/api/config/access/openid.rs
>
>
> Summary over all repositories:
>   14 files changed, 973 insertions(+), 85 deletions(-)
>
> --
> Generated by git-murpp 0.8.1

Superseded-by: https://lore.proxmox.com/pdm-devel/20251017135802.363955-2-s.sterz@proxmox.com/T/#t


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel