public inbox for pdm-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM
@ 2025-10-17 13:57 Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 1/5] login_panel/realm_selector: use default realm provided by api Shannon Sterz
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:57 UTC (permalink / raw)
  To: pdm-devel

this series adds openid support to PDM. the implementation is based on
PBS' implementation with a some adaptions:

- small refactorings to use more data types instead of simply putting
  them together with serde_json::json!
- move variables into format strings where possible
- only support the HttpOnly variant of the authentication flow

when going through this i at first wanted to put most of the api
endpoints' logic into a proxmox-rs crate. however, after some discussion
off and on list i've decided to put this into pdm directly for now. we
can factor out these api endpoints plus some general realm management
logic into proxmox-access-control as a follow-up.

the first part of this series mostly concerns yew-comp and makes several
changes:

- allows integration with our default realm backend logic
- add support for openid login
- add an icon to the "OpenId Connect Server" menu option
- allow setting openid realms as default realms
- add a helper to detect and parse openid authorization parameters to
  the utils module

Changelog
---------

changes since v1 (thanks @ Fabian Grünbichler)

- fix `use` statement order grouping for the api endpoints
- add a schema to the redirect url parameter
- use proper CreateTicketResponse struct (from proxmox-auth-api) and use
  its API_SCHEMA definition

the first two patches where taken from a different series [1] and slightly
adapted:

- remove a useless log statement
- instead of referring to "openid authentication" correctly call it
  "openid authorization"
- remove a useless sort() call

[1]: https://lore.proxmox.com/all/20251008151936.386950-1-s.sterz@proxmox.com/


proxmox-yew-comp:

Shannon Sterz (5):
  login_panel/realm_selector: use default realm provided by api
  login_panel/realm_selector: add support for openid realm logins
  auth view: add openid icon to openid menu option
  auth edit openid: add a default realm checkbox
  utils/login panel: move openid redirection authorization helper to
    utils

 src/auth_edit_openid.rs |  11 +-
 src/auth_view.rs        |   2 +-
 src/login_panel.rs      | 312 +++++++++++++++++++++++++++++++---------
 src/realm_selector.rs   |  83 ++++++++++-
 src/utils.rs            |  32 +++++
 5 files changed, 357 insertions(+), 83 deletions(-)


proxmox-datacenter-manager:

Shannon Sterz (3):
  api-types: add default field to openid realm config
  server: api: add support for adding openid realms and openid logins
  ui: enable openid realms in realm panel

 Cargo.toml                             |   2 +-
 lib/pdm-api-types/src/openid.rs        |   3 +
 server/Cargo.toml                      |   1 +
 server/src/api/access/mod.rs           |   2 +
 server/src/api/access/openid.rs        | 284 ++++++++++++++++++++++++
 server/src/api/config/access/mod.rs    |   2 +
 server/src/api/config/access/openid.rs | 289 +++++++++++++++++++++++++
 server/src/auth/mod.rs                 |   6 +-
 ui/src/configuration/mod.rs            |   1 +
 9 files changed, 588 insertions(+), 2 deletions(-)
 create mode 100644 server/src/api/access/openid.rs
 create mode 100644 server/src/api/config/access/openid.rs


Summary over all repositories:
  14 files changed, 945 insertions(+), 85 deletions(-)

--
Generated by git-murpp 0.8.1


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH yew-comp v2 1/5] login_panel/realm_selector: use default realm provided by api
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
@ 2025-10-17 13:57 ` Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 2/5] login_panel/realm_selector: add support for openid realm logins Shannon Sterz
                   ` (6 subsequent siblings)
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:57 UTC (permalink / raw)
  To: pdm-devel

when a user has not previously safed their username and realm, use the
default realm provided via the api. if no realm has been specified at
all, still fall back to "pam".

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/login_panel.rs    | 10 +++----
 src/realm_selector.rs | 63 ++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 62 insertions(+), 11 deletions(-)

diff --git a/src/login_panel.rs b/src/login_panel.rs
index f958871..e182a5d 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -29,9 +29,9 @@ pub struct LoginPanel {
     pub on_login: Option<Callback<Authentication>>,
 
     /// Default realm.
-    #[prop_or(AttrValue::from("pam"))]
+    #[prop_or_default]
     #[builder]
-    pub default_realm: AttrValue,
+    pub default_realm: Option<AttrValue>,
 
     /// Mobile Layout
     ///
@@ -125,16 +125,16 @@ impl ProxmoxLoginPanel {
         });
     }
 
-    fn get_defaults(&self, props: &LoginPanel) -> (String, String) {
+    fn get_defaults(&self, props: &LoginPanel) -> (String, Option<AttrValue>) {
         let mut default_username = String::from("root");
-        let mut default_realm = props.default_realm.to_string();
+        let mut default_realm = props.default_realm.clone();
 
         if props.mobile || *self.save_username {
             let last_userid: String = (*self.last_username).to_string();
             if !last_userid.is_empty() {
                 if let Some((user, realm)) = last_userid.rsplit_once('@') {
                     default_username = user.to_owned();
-                    default_realm = realm.to_owned().into();
+                    default_realm = Some(AttrValue::from(realm.to_owned()));
                 }
             }
         }
diff --git a/src/realm_selector.rs b/src/realm_selector.rs
index 0c57bf6..a882e39 100644
--- a/src/realm_selector.rs
+++ b/src/realm_selector.rs
@@ -1,4 +1,4 @@
-use anyhow::format_err;
+use anyhow::{format_err, Error};
 use std::rc::Rc;
 
 use yew::html::IntoPropValue;
@@ -61,18 +61,36 @@ impl RealmSelector {
     }
 }
 
-pub struct ProxmoxRealmSelector {
+struct ProxmoxRealmSelector {
     store: Store<BasicRealmInfo>,
     validate: ValidateFn<(String, Store<BasicRealmInfo>)>,
     picker: RenderFn<SelectorRenderArgs<Store<BasicRealmInfo>>>,
+    loaded_default_realm: Option<AttrValue>,
+}
+
+impl ProxmoxRealmSelector {
+    async fn load_realms(url: AttrValue) -> Msg {
+        let response: Result<_, Error> = crate::http_get_full(url.to_string(), None).await;
+
+        match response {
+            Ok(data) => Msg::LoadComplete(data.data),
+            Err(_) => Msg::LoadFailed,
+        }
+    }
+}
+
+enum Msg {
+    LoadComplete(Vec<BasicRealmInfo>),
+    LoadFailed,
 }
 
 impl Component for ProxmoxRealmSelector {
-    type Message = ();
+    type Message = Msg;
     type Properties = RealmSelector;
 
     fn create(ctx: &Context<Self>) -> Self {
-        let store = Store::new().on_change(ctx.link().callback(|_| ())); // trigger redraw
+        let store = Store::new();
+        let url = ctx.props().path.clone();
 
         let validate = ValidateFn::new(|(realm, store): &(String, Store<BasicRealmInfo>)| {
             store
@@ -94,23 +112,56 @@ impl Component for ProxmoxRealmSelector {
                 .into()
         });
 
+        ctx.link().send_future(Self::load_realms(url));
+
         Self {
             store,
             validate,
             picker,
+            loaded_default_realm: None,
+        }
+    }
+
+    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Msg::LoadComplete(data) => {
+                let realm = ctx
+                    .props()
+                    .default
+                    .as_ref()
+                    .and_then(|d| data.iter().find(|r| &r.realm == d))
+                    .or_else(|| data.iter().find(|r| r.default.unwrap_or_default()))
+                    .or_else(|| data.iter().find(|r| r.ty == "pam"))
+                    .map(|r| AttrValue::from(r.realm.clone()));
+
+                self.loaded_default_realm = realm;
+                self.store.set_data(data);
+                true
+            }
+            // not much we can do here, so just don't re-render
+            Msg::LoadFailed => false,
         }
     }
 
     fn view(&self, ctx: &Context<Self>) -> Html {
         let props = ctx.props();
+        let store = self.store.clone();
+
+        let default = props
+            .default
+            .clone()
+            .or_else(|| self.loaded_default_realm.clone())
+            .unwrap_or(AttrValue::from("pam"));
 
         Selector::new(self.store.clone(), self.picker.clone())
             .with_std_props(&props.std_props)
             .with_input_props(&props.input_props)
             .required(true)
-            .default(props.default.as_deref().unwrap_or("pam").to_string())
-            .loader(props.path.clone())
+            .default(&default)
             .validate(self.validate.clone())
+            // force re-render of the selector after load; returning `true` in update does not
+            // re-render the selector by itself
+            .key(format!("realm-selector-{default}"))
             .into()
     }
 }
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH yew-comp v2 2/5] login_panel/realm_selector: add support for openid realm logins
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 1/5] login_panel/realm_selector: use default realm provided by api Shannon Sterz
@ 2025-10-17 13:57 ` Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 3/5] auth view: add openid icon to openid menu option Shannon Sterz
                   ` (5 subsequent siblings)
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:57 UTC (permalink / raw)
  To: pdm-devel

this commit adds support for the openid login flow. it also modifies
the realm selector so that the currently selected realm can be
communicated to the login panel, which can then only render the fields
necessary for an openid realm.

the future handling the openid login request is intentionally spawned
with `wasm_bindgen_futures::spawn_local` so that it does not get
aborted when the view is re-rendered by the CatalogueLoader. it is
also wrapped in a OnceLock to avoid making the call several times.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/login_panel.rs    | 328 +++++++++++++++++++++++++++++++++---------
 src/realm_selector.rs |  26 +++-
 2 files changed, 285 insertions(+), 69 deletions(-)

diff --git a/src/login_panel.rs b/src/login_panel.rs
index e182a5d..9d1d5d6 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -1,5 +1,9 @@
+use std::collections::HashMap;
 use std::rc::Rc;
+use std::sync::OnceLock;
 
+use proxmox_login::api::CreateTicketResponse;
+use pwt::css::ColorScheme;
 use pwt::props::PwtSpace;
 use pwt::state::PersistentState;
 use pwt::touch::{SnackBar, SnackBarContextExt};
@@ -11,12 +15,15 @@ use pwt::widget::form::{Checkbox, Field, Form, FormContext, InputType, ResetButt
 use pwt::widget::{Column, FieldLabel, InputPanel, LanguageSelector, Mask, Row};
 use pwt::{prelude::*, AsyncPool};
 
-use proxmox_login::{Authentication, SecondFactorChallenge, TicketResult};
+use proxmox_login::{Authentication, SecondFactorChallenge, Ticket, TicketResult};
 
+use crate::common_api_types::BasicRealmInfo;
 use crate::{tfa::TfaDialog, RealmSelector};
 
 use pwt_macros::builder;
 
+static OPENID_LOGIN: OnceLock<()> = OnceLock::new();
+
 /// Proxmox login panel
 ///
 /// Should support all proxmox product and TFA.
@@ -73,6 +80,9 @@ pub enum Msg {
     Yubico(String),
     RecoveryKey(String),
     WebAuthn(String),
+    UpdateRealm(BasicRealmInfo),
+    OpenIDLogin,
+    OpenIDAuthorization(HashMap<String, String>),
 }
 
 pub struct ProxmoxLoginPanel {
@@ -83,6 +93,7 @@ pub struct ProxmoxLoginPanel {
     save_username: PersistentState<bool>,
     last_username: PersistentState<String>,
     async_pool: AsyncPool,
+    selected_realm: Option<BasicRealmInfo>,
 }
 
 impl ProxmoxLoginPanel {
@@ -125,6 +136,121 @@ impl ProxmoxLoginPanel {
         });
     }
 
+    fn openid_redirect(&self, ctx: &Context<Self>) {
+        let link = ctx.link().clone();
+        let Some(realm) = self.selected_realm.as_ref() else {
+            return;
+        };
+        let Ok(location) = gloo_utils::window().location().origin() else {
+            return;
+        };
+
+        let data = serde_json::json!({
+            "realm": realm.realm,
+            "redirect-url": location,
+        });
+
+        self.async_pool.spawn(async move {
+            match crate::http_post::<String>("/access/openid/auth-url", Some(data)).await {
+                Ok(data) => {
+                    let _ = gloo_utils::window().location().assign(&data);
+                }
+                Err(err) => {
+                    link.send_message(Msg::LoginError(err.to_string()));
+                }
+            }
+        });
+    }
+
+    fn openid_redirection_authorization(ctx: &Context<Self>) {
+        let Ok(query_string) = gloo_utils::window().location().search() else {
+            return;
+        };
+
+        let mut auth = HashMap::new();
+        let query_parameters = query_string.split('&');
+
+        for param in query_parameters {
+            let mut key_value = param.split('=');
+
+            match (key_value.next(), key_value.next()) {
+                (Some("?code") | Some("code"), Some(value)) => {
+                    auth.insert("code".to_string(), value.to_string());
+                }
+                (Some("?state") | Some("state"), Some(value)) => {
+                    if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
+                        auth.insert("state".to_string(), decoded.to_string());
+                    }
+                }
+                _ => continue,
+            };
+        }
+
+        if auth.contains_key("code") && auth.contains_key("state") {
+            ctx.link().send_message(Msg::OpenIDAuthorization(auth));
+        }
+    }
+
+    fn openid_login(&self, ctx: &Context<Self>, mut auth: HashMap<String, String>) {
+        let link = ctx.link().clone();
+        let save_username = ctx.props().mobile || *self.save_username;
+        let Ok(origin) = gloo_utils::window().location().origin() else {
+            return;
+        };
+
+        auth.insert("redirect-url".into(), origin.clone());
+
+        let Ok(auth) = serde_json::to_value(auth) else {
+            return;
+        };
+
+        // run this only once, an openid state is only valid for one round trip. so resending it
+        // here will just fail. also use an unabortable future here for the same reason. otherwise
+        // we could be interrupted by, for example, the catalog loader needing to re-render the
+        // app.
+        OPENID_LOGIN.get_or_init(|| {
+            wasm_bindgen_futures::spawn_local(async move {
+                match crate::http_post::<CreateTicketResponse>("/access/openid/login", Some(auth))
+                    .await
+                {
+                    Ok(creds) => {
+                        let Some(ticket) = creds
+                            .ticket
+                            .or(creds.ticket_info)
+                            .and_then(|t| t.parse::<Ticket>().ok())
+                        else {
+                            log::error!("neither ticket nor ticket-info in openid login response!");
+                            return;
+                        };
+
+                        let Some(csrfprevention_token) = creds.csrfprevention_token else {
+                            log::error!("no CSRF prevention token in the openid login response!");
+                            return;
+                        };
+
+                        let auth = Authentication {
+                            api_url: "".to_string(),
+                            userid: creds.username,
+                            ticket,
+                            clustername: None,
+                            csrfprevention_token,
+                        };
+
+                        // update the authentication, set the realm and user for the next login and
+                        // reload without the query parameters.
+                        crate::http_set_auth(auth.clone());
+                        if save_username {
+                            PersistentState::<String>::new("ProxmoxLoginPanelUsername")
+                                .update(auth.userid.clone());
+                        }
+                        let _ = gloo_utils::window().location().assign(&origin);
+                    }
+                    Err(err) => link.send_message(Msg::LoginError(err.to_string())),
+                }
+            });
+        });
+    }
+
     fn get_defaults(&self, props: &LoginPanel) -> (String, Option<AttrValue>) {
         let mut default_username = String::from("root");
         let mut default_realm = props.default_realm.clone();
@@ -161,36 +287,64 @@ impl ProxmoxLoginPanel {
                 .on_webauthn(ctx.link().callback(Msg::WebAuthn))
         });
 
-        let form_panel = Column::new()
+        let mut form_panel = Column::new()
             .class(pwt::css::FlexFit)
             .padding(2)
-            .with_flex_spacer()
-            .with_child(
-                FieldLabel::new(tr!("User name"))
-                    .id(username_label_id.clone())
-                    .padding_bottom(PwtSpace::Em(0.25)),
-            )
-            .with_child(
-                Field::new()
-                    .name("username")
-                    .label_id(username_label_id)
-                    .default(default_username)
-                    .required(true)
-                    .autofocus(true),
-            )
-            .with_child(
-                FieldLabel::new(tr!("Password"))
-                    .id(password_label_id.clone())
-                    .padding_top(1)
-                    .padding_bottom(PwtSpace::Em(0.25)),
-            )
-            .with_child(
-                Field::new()
-                    .name("password")
-                    .label_id(password_label_id)
-                    .required(true)
-                    .input_type(InputType::Password),
-            )
+            .with_flex_spacer();
+
+        if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty != "openid")
+            .unwrap_or(true)
+        {
+            form_panel = form_panel
+                .with_child(
+                    FieldLabel::new(tr!("User name"))
+                        .id(username_label_id.clone())
+                        .padding_bottom(PwtSpace::Em(0.25)),
+                )
+                .with_child(
+                    Field::new()
+                        .name("username")
+                        .label_id(username_label_id)
+                        .default(default_username)
+                        .required(true)
+                        .autofocus(true),
+                )
+                .with_child(
+                    FieldLabel::new(tr!("Password"))
+                        .id(password_label_id.clone())
+                        .padding_top(1)
+                        .padding_bottom(PwtSpace::Em(0.25)),
+                )
+                .with_child(
+                    Field::new()
+                        .name("password")
+                        .label_id(password_label_id)
+                        .input_type(InputType::Password),
+                );
+        }
+
+        let submit_button = SubmitButton::new().class(ColorScheme::Primary).margin_y(4);
+
+        let submit_button = if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty == "openid")
+            .unwrap_or_default()
+        {
+            submit_button
+                .text(tr!("Login (OpenID redirect)"))
+                .check_dirty(false)
+                .on_submit(link.callback(move |_| Msg::OpenIDLogin))
+        } else {
+            submit_button
+                .text(tr!("Login"))
+                .on_submit(link.callback(move |_| Msg::Submit))
+        };
+
+        let form_panel = form_panel
             .with_child(
                 FieldLabel::new(tr!("Realm"))
                     .id(realm_label_id.clone())
@@ -202,15 +356,13 @@ impl ProxmoxLoginPanel {
                     .name("realm")
                     .label_id(realm_label_id)
                     .path(props.domain_path.clone())
+                    .on_change({
+                        let link = link.clone();
+                        move |r: BasicRealmInfo| link.send_message(Msg::UpdateRealm(r))
+                    })
                     .default(default_realm),
             )
-            .with_child(
-                SubmitButton::new()
-                    .class("pwt-scheme-primary")
-                    .margin_y(4)
-                    .text(tr!("Login"))
-                    .on_submit(link.callback(move |_| Msg::Submit)),
-            )
+            .with_child(submit_button)
             .with_optional_child(self.login_error.as_ref().map(|msg| {
                 let icon_class = classes!("fa-lg", "fa", "fa-align-center", "fa-exclamation-triangle");
                 let text = tr!("Login failed. Please try again ({0})", msg);
@@ -244,32 +396,46 @@ impl ProxmoxLoginPanel {
 
         let (default_username, default_realm) = self.get_defaults(props);
 
-        let input_panel = InputPanel::new()
+        let mut input_panel = InputPanel::new()
             .class(pwt::css::Overflow::Auto)
             .width("initial") // don't try to minimize size
-            .padding(4)
-            .with_field(
-                tr!("User name"),
-                Field::new()
-                    .name("username")
-                    .default(default_username)
-                    .required(true)
-                    .autofocus(true),
-            )
-            .with_field(
-                tr!("Password"),
-                Field::new()
-                    .name("password")
-                    .required(true)
-                    .input_type(InputType::Password),
-            )
-            .with_field(
-                tr!("Realm"),
-                RealmSelector::new()
-                    .name("realm")
-                    .path(props.domain_path.clone())
-                    .default(default_realm),
-            );
+            .padding(4);
+
+        if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty != "openid")
+            .unwrap_or(true)
+        {
+            input_panel = input_panel
+                .with_field(
+                    tr!("User name"),
+                    Field::new()
+                        .name("username")
+                        .default(default_username)
+                        .required(true)
+                        .autofocus(true),
+                )
+                .with_field(
+                    tr!("Password"),
+                    Field::new()
+                        .name("password")
+                        .required(true)
+                        .input_type(InputType::Password),
+                );
+        }
+
+        let input_panel = input_panel.with_field(
+            tr!("Realm"),
+            RealmSelector::new()
+                .name("realm")
+                .path(props.domain_path.clone())
+                .on_change({
+                    let link = link.clone();
+                    move |r: BasicRealmInfo| link.send_message(Msg::UpdateRealm(r))
+                })
+                .default(default_realm),
+        );
 
         let tfa_dialog = self.challenge.as_ref().map(|challenge| {
             TfaDialog::new(challenge.clone())
@@ -292,6 +458,24 @@ impl ProxmoxLoginPanel {
             .with_child(html! {<label id={save_username_label_id} style="user-select:none;">{tr!("Save User name")}</label>})
             .with_child(save_username_field);
 
+        let submit_button = SubmitButton::new().class(ColorScheme::Primary);
+
+        let submit_button = if self
+            .selected_realm
+            .as_ref()
+            .map(|r| r.ty == "openid")
+            .unwrap_or_default()
+        {
+            submit_button
+                .text(tr!("Login (OpenID redirect)"))
+                .check_dirty(false)
+                .on_submit(link.callback(move |_| Msg::OpenIDLogin))
+        } else {
+            submit_button
+                .text(tr!("Login"))
+                .on_submit(link.callback(move |_| Msg::Submit))
+        };
+
         let toolbar = Row::new()
             .padding(2)
             .gap(2)
@@ -301,12 +485,7 @@ impl ProxmoxLoginPanel {
             .with_flex_spacer()
             .with_child(save_username)
             .with_child(ResetButton::new())
-            .with_child(
-                SubmitButton::new()
-                    .class("pwt-scheme-primary")
-                    .text(tr!("Login"))
-                    .on_submit(link.callback(move |_| Msg::Submit)),
-            );
+            .with_child(submit_button);
 
         let form_panel = Column::new()
             .class(pwt::css::FlexFit)
@@ -342,6 +521,8 @@ impl Component for ProxmoxLoginPanel {
         let save_username = PersistentState::<bool>::new("ProxmoxLoginPanelSaveUsername");
         let last_username = PersistentState::<String>::new("ProxmoxLoginPanelUsername");
 
+        Self::openid_redirection_authorization(ctx);
+
         Self {
             form_ctx,
             loading: false,
@@ -350,6 +531,7 @@ impl Component for ProxmoxLoginPanel {
             save_username,
             last_username,
             async_pool: AsyncPool::new(),
+            selected_realm: None,
         }
     }
 
@@ -483,6 +665,20 @@ impl Component for ProxmoxLoginPanel {
                 }
                 true
             }
+            Msg::UpdateRealm(realm) => {
+                self.selected_realm = Some(realm);
+                true
+            }
+            Msg::OpenIDLogin => {
+                self.loading = true;
+                self.openid_redirect(ctx);
+                false
+            }
+            Msg::OpenIDAuthorization(auth) => {
+                self.loading = true;
+                self.openid_login(ctx, auth);
+                false
+            }
         }
     }
 
diff --git a/src/realm_selector.rs b/src/realm_selector.rs
index a882e39..305e544 100644
--- a/src/realm_selector.rs
+++ b/src/realm_selector.rs
@@ -1,4 +1,5 @@
 use anyhow::{format_err, Error};
+use html::IntoEventCallback;
 use std::rc::Rc;
 
 use yew::html::IntoPropValue;
@@ -47,6 +48,11 @@ pub struct RealmSelector {
     #[builder(IntoPropValue, into_prop_value)]
     #[prop_or("/access/domains".into())]
     pub path: AttrValue,
+
+    /// Change callback
+    #[builder_cb(IntoEventCallback, into_event_callback, BasicRealmInfo)]
+    #[prop_or_default]
+    pub on_change: Option<Callback<BasicRealmInfo>>,
 }
 
 impl Default for RealmSelector {
@@ -131,10 +137,15 @@ impl Component for ProxmoxRealmSelector {
                     .as_ref()
                     .and_then(|d| data.iter().find(|r| &r.realm == d))
                     .or_else(|| data.iter().find(|r| r.default.unwrap_or_default()))
-                    .or_else(|| data.iter().find(|r| r.ty == "pam"))
-                    .map(|r| AttrValue::from(r.realm.clone()));
+                    .or_else(|| data.iter().find(|r| r.ty == "pam"));
 
-                self.loaded_default_realm = realm;
+                if let Some(cb) = ctx.props().on_change.as_ref() {
+                    if let Some(realm) = realm {
+                        cb.emit(realm.clone());
+                    }
+                }
+
+                self.loaded_default_realm = realm.map(|r| AttrValue::from(r.realm.clone()));
                 self.store.set_data(data);
                 true
             }
@@ -153,12 +164,21 @@ impl Component for ProxmoxRealmSelector {
             .or_else(|| self.loaded_default_realm.clone())
             .unwrap_or(AttrValue::from("pam"));
 
+        let on_change = props.on_change.clone().map(|c| {
+            Callback::from(move |k| {
+                if let Some(realm) = store.read().lookup_record(&k) {
+                    c.emit(realm.clone());
+                }
+            })
+        });
+
         Selector::new(self.store.clone(), self.picker.clone())
             .with_std_props(&props.std_props)
             .with_input_props(&props.input_props)
             .required(true)
             .default(&default)
             .validate(self.validate.clone())
+            .on_change(on_change)
             // force re-render of the selector after load; returning `true` in update does not
             // re-render the selector by itself
             .key(format!("realm-selector-{default}"))
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH yew-comp v2 3/5] auth view: add openid icon to openid menu option
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 1/5] login_panel/realm_selector: use default realm provided by api Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 2/5] login_panel/realm_selector: add support for openid realm logins Shannon Sterz
@ 2025-10-17 13:57 ` Shannon Sterz
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 4/5] auth edit openid: add a default realm checkbox Shannon Sterz
                   ` (4 subsequent siblings)
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:57 UTC (permalink / raw)
  To: pdm-devel

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/auth_view.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/auth_view.rs b/src/auth_view.rs
index aac08e0..d6e5528 100644
--- a/src/auth_view.rs
+++ b/src/auth_view.rs
@@ -303,7 +303,7 @@ impl LoadableComponent for ProxmoxAuthView {
         if props.openid_base_url.is_some() {
             add_menu.add_item(
                 MenuItem::new(tr!("OpenId Connect Server"))
-                    //.icon_class("fa fa-fw fa-user-o")
+                    .icon_class("fa fa-fw fa-openid")
                     .on_select(
                         ctx.link()
                             .change_view_callback(|_| Some(ViewState::AddOpenID)),
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH yew-comp v2 4/5] auth edit openid: add a default realm checkbox
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
                   ` (2 preceding siblings ...)
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 3/5] auth view: add openid icon to openid menu option Shannon Sterz
@ 2025-10-17 13:57 ` Shannon Sterz
  2025-10-17 13:58 ` [pdm-devel] [PATCH yew-comp v2 5/5] utils/login panel: move openid redirection authorization helper to utils Shannon Sterz
                   ` (3 subsequent siblings)
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:57 UTC (permalink / raw)
  To: pdm-devel

so that openid realms can be set as default realms

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/auth_edit_openid.rs | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/auth_edit_openid.rs b/src/auth_edit_openid.rs
index 5c29e15..8968ea1 100644
--- a/src/auth_edit_openid.rs
+++ b/src/auth_edit_openid.rs
@@ -106,10 +106,7 @@ fn render_input_form(form_ctx: FormContext, props: AuthEditOpenID) -> Html {
                 .submit(!is_edit),
         )
         .with_right_field(tr!("Autocreate Users"), Checkbox::new().name("autocreate"))
-        .with_field(
-            tr!("Client ID"),
-            Field::new().name("client-id").required(true),
-        )
+        .with_field(tr!("Default Realm"), Checkbox::new().name("default"))
         .with_right_field(
             tr!("Username Claim"),
             Combobox::new()
@@ -120,13 +117,17 @@ fn render_input_form(form_ctx: FormContext, props: AuthEditOpenID) -> Html {
                 .placeholder(tr!("Default"))
                 .items(username_claim_items),
         )
-        .with_field(tr!("Client Key"), Field::new().name("client-key"))
+        .with_field(
+            tr!("Client ID"),
+            Field::new().name("client-id").required(true),
+        )
         .with_right_field(
             tr!("Scopes"),
             Field::new()
                 .name("scopes")
                 .placeholder(tr!("Default") + " (" + &tr!("email profile") + ")"),
         )
+        .with_field(tr!("Client Key"), Field::new().name("client-key"))
         .with_right_field(
             tr!("Prompt"),
             Combobox::new()
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH yew-comp v2 5/5] utils/login panel: move openid redirection authorization helper to utils
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
                   ` (3 preceding siblings ...)
  2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 4/5] auth edit openid: add a default realm checkbox Shannon Sterz
@ 2025-10-17 13:58 ` Shannon Sterz
  2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] api-types: add default field to openid realm config Shannon Sterz
                   ` (2 subsequent siblings)
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:58 UTC (permalink / raw)
  To: pdm-devel

this allows users of this crate to check whether url parameters for an
openid authorization request are present. allowing for minimal user
interaction for completing the login flow.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/login_panel.rs | 34 ++++------------------------------
 src/utils.rs       | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 30 deletions(-)

diff --git a/src/login_panel.rs b/src/login_panel.rs
index 9d1d5d6..75721f5 100644
--- a/src/login_panel.rs
+++ b/src/login_panel.rs
@@ -18,6 +18,7 @@ use pwt::{prelude::*, AsyncPool};
 use proxmox_login::{Authentication, SecondFactorChallenge, Ticket, TicketResult};
 
 use crate::common_api_types::BasicRealmInfo;
+use crate::utils;
 use crate::{tfa::TfaDialog, RealmSelector};
 
 use pwt_macros::builder;
@@ -162,35 +163,6 @@ impl ProxmoxLoginPanel {
         });
     }
 
-    fn openid_redirection_authorization(ctx: &Context<Self>) {
-        let Ok(query_string) = gloo_utils::window().location().search() else {
-            return;
-        };
-
-        let mut auth = HashMap::new();
-        let query_parameters = query_string.split('&');
-
-        for param in query_parameters {
-            let mut key_value = param.split('=');
-
-            match (key_value.next(), key_value.next()) {
-                (Some("?code") | Some("code"), Some(value)) => {
-                    auth.insert("code".to_string(), value.to_string());
-                }
-                (Some("?state") | Some("state"), Some(value)) => {
-                    if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
-                        auth.insert("state".to_string(), decoded.to_string());
-                    }
-                }
-                _ => continue,
-            };
-        }
-
-        if auth.contains_key("code") && auth.contains_key("state") {
-            ctx.link().send_message(Msg::OpenIDAuthorization(auth));
-        }
-    }
-
     fn openid_login(&self, ctx: &Context<Self>, mut auth: HashMap<String, String>) {
         let link = ctx.link().clone();
         let save_username = ctx.props().mobile || *self.save_username;
@@ -521,7 +493,9 @@ impl Component for ProxmoxLoginPanel {
         let save_username = PersistentState::<bool>::new("ProxmoxLoginPanelSaveUsername");
         let last_username = PersistentState::<String>::new("ProxmoxLoginPanelUsername");
 
-        Self::openid_redirection_authorization(ctx);
+        if let Some(auth) = utils::openid_redirection_authorization() {
+            ctx.link().send_message(Msg::OpenIDAuthorization(auth));
+        }
 
         Self {
             form_ctx,
diff --git a/src/utils.rs b/src/utils.rs
index 3dfc696..f1ea984 100644
--- a/src/utils.rs
+++ b/src/utils.rs
@@ -2,6 +2,7 @@ use std::collections::HashMap;
 use std::fmt::Display;
 use std::sync::Mutex;
 
+use percent_encoding::percent_decode;
 use serde_json::Value;
 use wasm_bindgen::JsCast;
 use yew::prelude::*;
@@ -462,3 +463,34 @@ pub fn register_pve_tasks() {
     register_task_description("zfscreate", (tr!("ZFS Storage"), tr!("Create")));
     register_task_description("zfsremove", ("ZFS Pool", tr!("Remove")));
 }
+
+pub fn openid_redirection_authorization() -> Option<HashMap<String, String>> {
+    let Ok(query_string) = gloo_utils::window().location().search() else {
+        return None;
+    };
+
+    let mut auth = HashMap::new();
+    let query_parameters = query_string.split('&');
+
+    for param in query_parameters {
+        let mut key_value = param.split('=');
+
+        match (key_value.next(), key_value.next()) {
+            (Some("?code") | Some("code"), Some(value)) => {
+                auth.insert("code".to_string(), value.to_string());
+            }
+            (Some("?state") | Some("state"), Some(value)) => {
+                if let Ok(decoded) = percent_decode(value.as_bytes()).decode_utf8() {
+                    auth.insert("state".to_string(), decoded.to_string());
+                }
+            }
+            _ => continue,
+        };
+    }
+
+    if auth.contains_key("code") && auth.contains_key("state") {
+        return Some(auth);
+    }
+
+    None
+}
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH datacenter-manager v2 1/3] api-types: add default field to openid realm config
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
                   ` (4 preceding siblings ...)
  2025-10-17 13:58 ` [pdm-devel] [PATCH yew-comp v2 5/5] utils/login panel: move openid redirection authorization helper to utils Shannon Sterz
@ 2025-10-17 13:58 ` Shannon Sterz
  2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 2/3] server: api: add support for adding openid realms and openid logins Shannon Sterz
  2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] ui: enable openid realms in realm panel Shannon Sterz
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:58 UTC (permalink / raw)
  To: pdm-devel

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 lib/pdm-api-types/src/openid.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/pdm-api-types/src/openid.rs b/lib/pdm-api-types/src/openid.rs
index 8893edc..c129d35 100644
--- a/lib/pdm-api-types/src/openid.rs
+++ b/lib/pdm-api-types/src/openid.rs
@@ -109,6 +109,9 @@ pub struct OpenIdRealmConfig {
     pub client_key: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub comment: Option<String>,
+    /// True if you want this to be the default realm selected on login.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<bool>,
     /// Automatically create users if they do not exist.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub autocreate: Option<bool>,
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH datacenter-manager v2 2/3] server: api: add support for adding openid realms and openid logins
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
                   ` (5 preceding siblings ...)
  2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] api-types: add default field to openid realm config Shannon Sterz
@ 2025-10-17 13:58 ` Shannon Sterz
  2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] ui: enable openid realms in realm panel Shannon Sterz
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:58 UTC (permalink / raw)
  To: pdm-devel

only supports the new HttpOnly authentication flow, as PDM does not
support non-HttpOnly authentication at the moment.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 Cargo.toml                             |   2 +-
 server/Cargo.toml                      |   1 +
 server/src/api/access/mod.rs           |   2 +
 server/src/api/access/openid.rs        | 284 ++++++++++++++++++++++++
 server/src/api/config/access/mod.rs    |   2 +
 server/src/api/config/access/openid.rs | 289 +++++++++++++++++++++++++
 server/src/auth/mod.rs                 |   6 +-
 7 files changed, 584 insertions(+), 2 deletions(-)
 create mode 100644 server/src/api/access/openid.rs
 create mode 100644 server/src/api/config/access/openid.rs

diff --git a/Cargo.toml b/Cargo.toml
index f820409..39a0b23 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ proxmox-uuid = "1"
 
 # other proxmox crates
 proxmox-acme = "0.5"
-proxmox-openid = "0.10"
+proxmox-openid = "1.0.2"
 
 # api implementation creates
 proxmox-config-digest = "1"
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 0dfcb6c..94420b4 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -44,6 +44,7 @@ proxmox-lang.workspace = true
 proxmox-ldap.workspace = true
 proxmox-log.workspace = true
 proxmox-login.workspace = true
+proxmox-openid.workspace = true
 proxmox-rest-server = { workspace = true, features = [ "templates" ] }
 proxmox-router = { workspace = true, features = [ "cli", "server"] }
 proxmox-rrd.workspace = true
diff --git a/server/src/api/access/mod.rs b/server/src/api/access/mod.rs
index 345b22f..a6874a5 100644
--- a/server/src/api/access/mod.rs
+++ b/server/src/api/access/mod.rs
@@ -14,6 +14,7 @@ use proxmox_sortable_macro::sortable;
 use pdm_api_types::{Authid, ACL_PATH_SCHEMA, PRIVILEGES, PRIV_ACCESS_AUDIT};
 
 mod domains;
+mod openid;
 mod tfa;
 mod users;
 
@@ -33,6 +34,7 @@ const SUBDIRS: SubdirMap = &sorted!([
             .post(&proxmox_auth_api::api::API_METHOD_CREATE_TICKET_HTTP_ONLY)
             .delete(&proxmox_auth_api::api::API_METHOD_LOGOUT),
     ),
+    ("openid", &openid::ROUTER),
     ("users", &users::ROUTER),
 ]);
 
diff --git a/server/src/api/access/openid.rs b/server/src/api/access/openid.rs
new file mode 100644
index 0000000..1dccb29
--- /dev/null
+++ b/server/src/api/access/openid.rs
@@ -0,0 +1,284 @@
+//! OpenID redirect/login API
+use anyhow::{bail, format_err, Error};
+use hyper::http::request::Parts;
+use hyper::Response;
+use serde_json::{json, Value};
+
+use proxmox_access_control::types::{User, EMAIL_SCHEMA, FIRST_NAME_SCHEMA, LAST_NAME_SCHEMA};
+use proxmox_access_control::CachedUserInfo;
+use proxmox_auth_api::api::{assemble_csrf_prevention_token, ApiTicket, AuthContext};
+use proxmox_auth_api::ticket::Ticket;
+use proxmox_auth_api::types::{CreateTicketResponse, Userid};
+use proxmox_lang::try_block;
+use proxmox_openid::{OpenIdAuthenticator, OpenIdConfig};
+use proxmox_router::{
+    http_err, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
+    Router, RpcEnvironment, SubdirMap,
+};
+use proxmox_schema::{api, ApiType, ObjectSchema, ParameterSchema, StringSchema};
+use proxmox_sortable_macro::sortable;
+
+use pdm_api_types::{
+    OpenIdRealmConfig, HTTP_URL_SCHEMA, OPENID_DEFAULT_SCOPE_LIST, REALM_ID_SCHEMA,
+};
+use pdm_buildcfg::PDM_RUN_DIR_M;
+
+use crate::auth;
+
+fn openid_authenticator(
+    realm_config: &OpenIdRealmConfig,
+    redirect_url: &str,
+) -> Result<OpenIdAuthenticator, Error> {
+    let scopes: Vec<String> = realm_config
+        .scopes
+        .as_deref()
+        .unwrap_or(OPENID_DEFAULT_SCOPE_LIST)
+        .split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+        .filter(|s| !s.is_empty())
+        .map(String::from)
+        .collect();
+
+    let mut acr_values = None;
+    if let Some(ref list) = realm_config.acr_values {
+        acr_values = Some(
+            list.split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+                .filter(|s| !s.is_empty())
+                .map(String::from)
+                .collect(),
+        );
+    }
+
+    let config = OpenIdConfig {
+        issuer_url: realm_config.issuer_url.clone(),
+        client_id: realm_config.client_id.clone(),
+        client_key: realm_config.client_key.clone(),
+        prompt: realm_config.prompt.clone(),
+        scopes: Some(scopes),
+        acr_values,
+    };
+    OpenIdAuthenticator::discover(&config, redirect_url)
+}
+
+#[sortable]
+pub const API_METHOD_OPENID_LOGIN: ApiMethod = ApiMethod::new_full(
+    &ApiHandler::AsyncHttpBodyParameters(&create_ticket_http_only),
+    ParameterSchema::Object(&ObjectSchema::new(
+        "Get a new ticket as an HttpOnly cookie. Supports tickets via cookies.",
+        &sorted!([
+            ("state", false, &StringSchema::new("OpenId state.").schema()),
+            (
+                "code",
+                false,
+                &StringSchema::new("OpenId authorization code.").schema(),
+            ),
+            (
+                "redirect-url",
+                false,
+                &StringSchema::new(
+                    "Redirection Url. The client should set this to used server url.",
+                )
+                .schema(),
+            ),
+        ]),
+    )),
+)
+.returns(::proxmox_schema::ReturnType::new(
+    false,
+    &CreateTicketResponse::API_SCHEMA,
+))
+.protected(true)
+.access(None, &Permission::World)
+.reload_timezone(true);
+
+fn create_ticket_http_only(
+    _parts: Parts,
+    param: Value,
+    _info: &ApiMethod,
+    rpcenv: Box<dyn RpcEnvironment>,
+) -> ApiResponseFuture {
+    Box::pin(async move {
+        use proxmox_rest_server::RestEnvironment;
+
+        let code = param["code"]
+            .as_str()
+            .ok_or_else(|| format_err!("missing non-optional parameter: code"))?
+            .to_owned();
+        let state = param["state"]
+            .as_str()
+            .ok_or_else(|| format_err!("missing non-optional parameter: state"))?
+            .to_owned();
+        let redirect_url = param["redirect-url"]
+            .as_str()
+            .ok_or_else(|| format_err!("missing non-optional parameter: redirect-url"))?
+            .to_owned();
+
+        let env: &RestEnvironment = rpcenv
+            .as_any()
+            .downcast_ref::<RestEnvironment>()
+            .ok_or_else(|| format_err!("detected wrong RpcEnvironment type"))?;
+
+        let user_info = CachedUserInfo::new()?;
+        let auth_context = auth::get_auth_context()
+            .ok_or_else(|| format_err!("could not get authentication context"))?;
+
+        let mut tested_username = None;
+
+        let result = try_block!({
+            let (realm, private_auth_state) =
+                OpenIdAuthenticator::verify_public_auth_state(PDM_RUN_DIR_M!(), &state)?;
+
+            let (domains, _digest) = pdm_config::domains::config()?;
+            let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+            let open_id = openid_authenticator(&config, &redirect_url)?;
+            let info = open_id.verify_authorization_code_simple(&code, &private_auth_state)?;
+            let name_attr = config.username_claim.as_deref().unwrap_or("sub");
+
+            // Try to be compatible with previous versions
+            let try_attr = match name_attr {
+                "subject" => Some("sub"),
+                "username" => Some("preferred_username"),
+                _ => None,
+            };
+
+            let unique_name = if let Some(name) = info[name_attr]
+                .as_str()
+                .or_else(|| try_attr.and_then(|att| info[att].as_str()))
+            {
+                name.to_owned()
+            } else {
+                bail!("missing claim '{name_attr}'");
+            };
+
+            let user_id = Userid::try_from(format!("{unique_name}@{realm}"))?;
+            tested_username = Some(unique_name);
+
+            if !user_info.is_active_user_id(&user_id) {
+                if config.autocreate.unwrap_or(false) {
+                    let _lock = proxmox_access_control::user::lock_config()?;
+                    let (mut user_config, _digest) = proxmox_access_control::user::config()?;
+
+                    if let Ok(old_user) = user_config.lookup::<User>("user", user_id.as_str()) {
+                        if let Some(false) = old_user.enable {
+                            bail!("user '{user_id}' is disabled.");
+                        } else {
+                            bail!("autocreate user failed - '{user_id}' already exists.");
+                        }
+                    }
+
+                    let firstname = info["given_name"]
+                        .as_str()
+                        .map(|n| n.to_string())
+                        .filter(|n| FIRST_NAME_SCHEMA.parse_simple_value(n).is_ok());
+
+                    let lastname = info["family_name"]
+                        .as_str()
+                        .map(|n| n.to_string())
+                        .filter(|n| LAST_NAME_SCHEMA.parse_simple_value(n).is_ok());
+
+                    let email = info["email"]
+                        .as_str()
+                        .map(|n| n.to_string())
+                        .filter(|n| EMAIL_SCHEMA.parse_simple_value(n).is_ok());
+
+                    let user = User {
+                        userid: user_id.clone(),
+                        comment: None,
+                        enable: None,
+                        expire: None,
+                        firstname,
+                        lastname,
+                        email,
+                    };
+
+                    user_config.set_data(user.userid.as_str(), "user", &user)?;
+                    proxmox_access_control::user::save_config(&user_config)?;
+                } else {
+                    bail!("user account '{user_id}' missing, disabled or expired.");
+                }
+            }
+
+            let api_ticket = ApiTicket::Full(user_id.clone());
+            let ticket = Ticket::new(auth_context.auth_prefix(), &api_ticket)?;
+            let token = assemble_csrf_prevention_token(auth_context.csrf_secret(), &user_id);
+            env.log_auth(user_id.as_str());
+
+            Ok((user_id, ticket, token))
+        });
+
+        let (user_id, mut ticket, token) = result.map_err(|err| {
+            let msg = err.to_string();
+            env.log_failed_auth(tested_username, &msg);
+            http_err!(UNAUTHORIZED, "{msg}")
+        })?;
+
+        let cookie = format!(
+            "{}={}; Secure; SameSite=Lax; HttpOnly; Path=/;",
+            auth_context.prefixed_auth_cookie_name(),
+            ticket.sign(auth_context.keyring(), None)?,
+        );
+
+        let response = Response::builder()
+            .header(hyper::http::header::CONTENT_TYPE, "application/json")
+            .header(hyper::header::SET_COOKIE, cookie);
+
+        let data = CreateTicketResponse {
+            csrfprevention_token: Some(token),
+            ticket: None,
+            ticket_info: Some(ticket.ticket_info()),
+            username: user_id,
+        };
+
+        Ok(response.body(
+            json!({"data": data, "status": 200, "success": true })
+                .to_string()
+                .into(),
+        )?)
+    })
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+            "redirect-url": {
+                schema: HTTP_URL_SCHEMA,
+            },
+        },
+    },
+    returns: {
+        description: "Redirection URL.",
+        type: String,
+    },
+    access: {
+        description: "Anyone can access this (before the user is authenticated).",
+        permission: &Permission::World,
+    },
+)]
+/// Create OpenID Redirect Session
+pub fn openid_auth_url(
+    realm: String,
+    redirect_url: String,
+    _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<String, Error> {
+    let (domains, _digest) = pdm_config::domains::config()?;
+    let config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+
+    let open_id = openid_authenticator(&config, &redirect_url)?;
+
+    let url = open_id.authorize_url(PDM_RUN_DIR_M!(), &realm)?;
+
+    Ok(url)
+}
+
+#[sortable]
+const SUBDIRS: SubdirMap = &sorted!([
+    ("login", &Router::new().post(&API_METHOD_OPENID_LOGIN)),
+    ("auth-url", &Router::new().post(&API_METHOD_OPENID_AUTH_URL)),
+]);
+
+pub const ROUTER: Router = Router::new()
+    .get(&list_subdirs_api_method!(SUBDIRS))
+    .subdirs(SUBDIRS);
diff --git a/server/src/api/config/access/mod.rs b/server/src/api/config/access/mod.rs
index 7454f53..5776152 100644
--- a/server/src/api/config/access/mod.rs
+++ b/server/src/api/config/access/mod.rs
@@ -4,12 +4,14 @@ use proxmox_sortable_macro::sortable;
 
 mod ad;
 mod ldap;
+mod openid;
 pub mod tfa;
 
 #[sortable]
 const SUBDIRS: SubdirMap = &sorted!([
     ("tfa", &tfa::ROUTER),
     ("ldap", &ldap::ROUTER),
+    ("openid", &openid::ROUTER),
     ("ad", &ad::ROUTER),
 ]);
 
diff --git a/server/src/api/config/access/openid.rs b/server/src/api/config/access/openid.rs
new file mode 100644
index 0000000..1832448
--- /dev/null
+++ b/server/src/api/config/access/openid.rs
@@ -0,0 +1,289 @@
+/// Configure OpenId realms
+use anyhow::Error;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
+use proxmox_schema::{api, param_bail};
+
+use pdm_api_types::ConfigDigest;
+use pdm_api_types::{
+    OpenIdRealmConfig, OpenIdRealmConfigUpdater, PRIV_REALM_ALLOCATE, PRIV_SYS_AUDIT,
+    REALM_ID_SCHEMA,
+};
+use pdm_config::domains;
+
+#[api(
+    input: {
+        properties: {},
+    },
+    returns: {
+        description: "List of configured OpenId realms.",
+        type: Array,
+        items: { type: OpenIdRealmConfig },
+    },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// List configured OpenId realms
+pub fn list_openid_realms(
+    _param: Value,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<Vec<OpenIdRealmConfig>, Error> {
+    let (config, digest) = domains::config()?;
+
+    let list = config.convert_to_typed_array("openid")?;
+
+    rpcenv["digest"] = hex::encode(digest).into();
+
+    Ok(list)
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            config: {
+                type: OpenIdRealmConfig,
+                flatten: true,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// Create a new OpenId realm
+pub fn create_openid_realm(config: OpenIdRealmConfig) -> Result<(), Error> {
+    let _lock = domains::lock_config()?;
+
+    let (mut domains, _digest) = domains::config()?;
+
+    if domains::exists(&domains, &config.realm) {
+        param_bail!("realm", "realm '{}' already exists.", config.realm);
+    }
+
+    if let Some(true) = config.default {
+        domains::unset_default_realm(&mut domains)?;
+    }
+
+    domains.set_data(&config.realm, "openid", &config)?;
+
+    domains::save_config(&domains)?;
+
+    Ok(())
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+            digest: {
+                optional: true,
+                type: ConfigDigest,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// Remove a OpenID realm configuration
+pub fn delete_openid_realm(
+    realm: String,
+    digest: Option<ConfigDigest>,
+    _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let _lock = domains::lock_config()?;
+
+    let (mut domains, expected_digest) = domains::config()?;
+    expected_digest.detect_modification(digest.as_ref())?;
+
+    if domains.sections.remove(&realm).is_none() {
+        http_bail!(NOT_FOUND, "realm '{realm}' does not exist.");
+    }
+
+    domains::save_config(&domains)?;
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+        },
+    },
+    returns:  { type: OpenIdRealmConfig },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_SYS_AUDIT, false),
+    },
+)]
+/// Read the OpenID realm configuration
+pub fn read_openid_realm(
+    realm: String,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<OpenIdRealmConfig, Error> {
+    let (domains, digest) = domains::config()?;
+
+    let config = domains.lookup("openid", &realm)?;
+    rpcenv["digest"] = hex::encode(digest).into();
+
+    Ok(config)
+}
+
+#[api()]
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+/// Deletable property name
+pub enum DeletableProperty {
+    /// Delete the client key.
+    ClientKey,
+    /// Delete the comment property.
+    Comment,
+    /// Delete the default property.
+    Default,
+    /// Delete the autocreate property
+    Autocreate,
+    /// Delete the scopes property
+    Scopes,
+    /// Delete the prompt property
+    Prompt,
+    /// Delete the acr_values property
+    AcrValues,
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            realm: {
+                schema: REALM_ID_SCHEMA,
+            },
+            update: {
+                type: OpenIdRealmConfigUpdater,
+                flatten: true,
+            },
+            delete: {
+                description: "List of properties to delete.",
+                type: Array,
+                optional: true,
+                items: {
+                    type: DeletableProperty,
+                }
+            },
+            digest: {
+                optional: true,
+                type: ConfigDigest,
+            },
+        },
+    },
+    returns:  { type: OpenIdRealmConfig },
+    access: {
+        permission: &Permission::Privilege(&["access", "domains"], PRIV_REALM_ALLOCATE, false),
+    },
+)]
+/// Update an OpenID realm configuration
+pub fn update_openid_realm(
+    realm: String,
+    update: OpenIdRealmConfigUpdater,
+    delete: Option<Vec<DeletableProperty>>,
+    digest: Option<ConfigDigest>,
+    _rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let _lock = domains::lock_config()?;
+
+    let (mut domains, expected_digest) = domains::config()?;
+    expected_digest.detect_modification(digest.as_ref())?;
+
+    let mut config: OpenIdRealmConfig = domains.lookup("openid", &realm)?;
+
+    if let Some(delete) = delete {
+        for delete_prop in delete {
+            match delete_prop {
+                DeletableProperty::ClientKey => {
+                    config.client_key = None;
+                }
+                DeletableProperty::Comment => {
+                    config.comment = None;
+                }
+                DeletableProperty::Default => {
+                    config.default = None;
+                }
+                DeletableProperty::Autocreate => {
+                    config.autocreate = None;
+                }
+                DeletableProperty::Scopes => {
+                    config.scopes = None;
+                }
+                DeletableProperty::Prompt => {
+                    config.prompt = None;
+                }
+                DeletableProperty::AcrValues => {
+                    config.acr_values = None;
+                }
+            }
+        }
+    }
+
+    if let Some(comment) = update.comment {
+        let comment = comment.trim().to_string();
+        if comment.is_empty() {
+            config.comment = None;
+        } else {
+            config.comment = Some(comment);
+        }
+    }
+
+    if let Some(true) = update.default {
+        domains::unset_default_realm(&mut domains)?;
+        config.default = Some(true);
+    } else {
+        config.default = None;
+    }
+
+    if let Some(issuer_url) = update.issuer_url {
+        config.issuer_url = issuer_url;
+    }
+    if let Some(client_id) = update.client_id {
+        config.client_id = client_id;
+    }
+
+    if update.client_key.is_some() {
+        config.client_key = update.client_key;
+    }
+    if update.autocreate.is_some() {
+        config.autocreate = update.autocreate;
+    }
+    if update.scopes.is_some() {
+        config.scopes = update.scopes;
+    }
+    if update.prompt.is_some() {
+        config.prompt = update.prompt;
+    }
+    if update.acr_values.is_some() {
+        config.acr_values = update.acr_values;
+    }
+
+    domains.set_data(&realm, "openid", &config)?;
+
+    domains::save_config(&domains)?;
+
+    Ok(())
+}
+
+const ITEM_ROUTER: Router = Router::new()
+    .get(&API_METHOD_READ_OPENID_REALM)
+    .put(&API_METHOD_UPDATE_OPENID_REALM)
+    .delete(&API_METHOD_DELETE_OPENID_REALM);
+
+pub const ROUTER: Router = Router::new()
+    .get(&API_METHOD_LIST_OPENID_REALMS)
+    .post(&API_METHOD_CREATE_OPENID_REALM)
+    .match_all("realm", &ITEM_ROUTER);
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 532350d..9413a83 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -81,7 +81,11 @@ fn setup_auth_context(use_private_key: bool) {
     proxmox_auth_api::set_auth_context(AUTH_CONTEXT.get().unwrap());
 }
 
-struct PdmAuthContext {
+pub(crate) fn get_auth_context() -> Option<&'static PdmAuthContext> {
+    AUTH_CONTEXT.get()
+}
+
+pub(crate) struct PdmAuthContext {
     keyring: Keyring,
     csrf_secret: &'static HMACKey,
 }
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [pdm-devel] [PATCH datacenter-manager v2 3/3] ui: enable openid realms in realm panel
  2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
                   ` (6 preceding siblings ...)
  2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 2/3] server: api: add support for adding openid realms and openid logins Shannon Sterz
@ 2025-10-17 13:58 ` Shannon Sterz
  7 siblings, 0 replies; 9+ messages in thread
From: Shannon Sterz @ 2025-10-17 13:58 UTC (permalink / raw)
  To: pdm-devel

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/configuration/mod.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/src/configuration/mod.rs b/ui/src/configuration/mod.rs
index 0a92796..2a0bbcc 100644
--- a/ui/src/configuration/mod.rs
+++ b/ui/src/configuration/mod.rs
@@ -112,6 +112,7 @@ pub fn access_control() -> Html {
                 AuthView::new()
                     .ldap_base_url("/config/access/ldap")
                     .ad_base_url("/config/access/ad")
+                    .openid_base_url("/config/access/openid")
                     .into()
             },
         );
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2025-10-17 13:58 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-17 13:57 [pdm-devel] [PATCH datacenter-manager/yew-comp v2 0/8] openid support for PDM Shannon Sterz
2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 1/5] login_panel/realm_selector: use default realm provided by api Shannon Sterz
2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 2/5] login_panel/realm_selector: add support for openid realm logins Shannon Sterz
2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 3/5] auth view: add openid icon to openid menu option Shannon Sterz
2025-10-17 13:57 ` [pdm-devel] [PATCH yew-comp v2 4/5] auth edit openid: add a default realm checkbox Shannon Sterz
2025-10-17 13:58 ` [pdm-devel] [PATCH yew-comp v2 5/5] utils/login panel: move openid redirection authorization helper to utils Shannon Sterz
2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 1/3] api-types: add default field to openid realm config Shannon Sterz
2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 2/3] server: api: add support for adding openid realms and openid logins Shannon Sterz
2025-10-17 13:58 ` [pdm-devel] [PATCH datacenter-manager v2 3/3] ui: enable openid realms in realm panel Shannon Sterz

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal