[pdm-devel] [PATCH datacenter-manager/proxmox 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility

[pdm-devel] [PATCH datacenter-manager/proxmox 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility

[Christian Ebner]

This patches fix the ticket parsing when login to instances of PBS version 3
or lower. For this, the current pve_compat flags for `Login` and `Client`
are refactored to be an extendable enum variant instead, adding the ticket
parsing backwards compatibility. In that compatibility mode, response parsing
of the ticket does not interpret the presence of the `ticket-info` field as the
ticket being a `http-only` ticket and fallsback to the PBS version 3 and 4
compatible parsing, as the client never used `http-only` tickets.

Since this fixes token generation and ACLs setting via the remote add wizard,
revert the now outdated warning of PBS v4 minimum requirement.

proxmox:

Christian Ebner (3):
  proxmox-login: refactor PVE TFA compat mode
  proxmox-client: adapt to new compat mode introduced for proxmox-login
  proxmox-login: add compat mode to fallback to PBS3 ticket parsing

 proxmox-client/src/client.rs | 12 ++++----
 proxmox-client/src/lib.rs    |  2 +-
 proxmox-login/src/lib.rs     | 55 +++++++++++++++++++++++++-----------
 3 files changed, 45 insertions(+), 24 deletions(-)


datacenter-manager:

Christian Ebner (3):
  server: adapt to proxmox-client compat mode changes
  server: pbs-client: check and fallback to PBS v3 ticket compat mode
  Revert "ui: add wizard: note that login currently only works for PBS
    4"

 server/src/connection.rs           | 43 +++++++++++++++++-------------
 ui/src/remotes/wizard_page_info.rs | 15 -----------
 2 files changed, 25 insertions(+), 33 deletions(-)


Summary over all repositories:
  5 files changed, 70 insertions(+), 57 deletions(-)

-- 
Generated by git-murpp 0.8.1


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH proxmox 1/3] proxmox-login: refactor PVE TFA compat mode

[Christian Ebner]

In preparation for extending the compat mode by Proxmox Backup Server
version 3 API compatibility for login ticket parsing.

Instead of storing the compat mode as simple boolean flag and only
considering PVE, use a `CompatMode` enum instead. Further, make the
variable and method names more generic.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 proxmox-login/src/lib.rs | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/proxmox-login/src/lib.rs b/proxmox-login/src/lib.rs
index 4482f2e4..e7b8e023 100644
--- a/proxmox-login/src/lib.rs
+++ b/proxmox-login/src/lib.rs
@@ -49,7 +49,15 @@ pub struct Login {
     api_url: String,
     userid: String,
     password: Option<String>,
-    pve_compat: bool,
+    compat_mode: CompatMode,
+}
+
+/// Compatibility mode to use for login or ticket renewal.
+#[derive(Copy, Clone, Debug, Default, PartialEq)]
+pub enum CompatMode {
+    #[default]
+    Generic,
+    PveTfa,
 }
 
 fn normalize_url(mut api_url: String) -> String {
@@ -90,9 +98,14 @@ impl Login {
 
     /// Prepare a request given an already parsed ticket.
     pub fn renew_ticket(api_url: impl Into<String>, ticket: Ticket) -> Self {
+        let compat_mode = if ticket.product() == "PVE" {
+            CompatMode::PveTfa
+        } else {
+            CompatMode::default()
+        };
         Self {
             api_url: normalize_url(api_url.into()),
-            pve_compat: ticket.product() == "PVE",
+            compat_mode,
             userid: ticket.userid().to_string(),
             password: Some(ticket.into()),
         }
@@ -103,7 +116,7 @@ impl Login {
     pub fn renew_with_cookie(api_url: impl Into<String>, userid: impl Into<String>) -> Self {
         Self {
             api_url: normalize_url(api_url.into()),
-            pve_compat: false,
+            compat_mode: CompatMode::default(),
             userid: userid.into(),
             password: None,
         }
@@ -119,13 +132,13 @@ impl Login {
             api_url: normalize_url(api_url.into()),
             userid: userid.into(),
             password: Some(password.into()),
-            pve_compat: false,
+            compat_mode: CompatMode::default(),
         }
     }
 
     /// Set the Proxmox VE compatibility parameter for Two-Factor-Authentication support.
-    pub fn pve_compatibility(mut self, compatibility: bool) -> Self {
-        self.pve_compat = compatibility;
+    pub fn set_compatibility(mut self, compat_mode: CompatMode) -> Self {
+        self.compat_mode = compat_mode;
         self
     }
 
@@ -135,8 +148,13 @@ impl Login {
     /// [`response`](Login::response) method in order to extract the validated ticket or
     /// Two-Factor-Authentication challenge.
     pub fn request(&self) -> Request {
+        let new_format = if self.compat_mode == CompatMode::PveTfa {
+            Some(true)
+        } else {
+            None
+        };
         let request = api::CreateTicket {
-            new_format: self.pve_compat.then_some(true),
+            new_format,
             username: self.userid.clone(),
             password: self.password.clone(),
             ..Default::default()
@@ -225,7 +243,7 @@ impl Login {
             TicketResponse::Tfa(ticket, challenge) => {
                 TicketResult::TfaRequired(SecondFactorChallenge {
                     api_url: self.api_url.clone(),
-                    pve_compat: self.pve_compat,
+                    pve_compat: self.compat_mode == CompatMode::PveTfa,
                     userid: response.username,
                     ticket,
                     challenge,
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH proxmox 2/3] proxmox-client: adapt to new compat mode introduced for proxmox-login

[Christian Ebner]

The API for setting the compatibility changed to allow for easier
extension. Adapt the client to the new interface and expose the same
changes to the client.

Also, re-export the `CompatMode` so users do not need to directly
depend on the implementation in proxmox-login.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 proxmox-client/src/client.rs | 12 ++++++------
 proxmox-client/src/lib.rs    |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/proxmox-client/src/client.rs b/proxmox-client/src/client.rs
index da2c5c59..894d9216 100644
--- a/proxmox-client/src/client.rs
+++ b/proxmox-client/src/client.rs
@@ -17,7 +17,7 @@ use serde::Serialize;
 
 use proxmox_http::Body;
 use proxmox_login::ticket::Validity;
-use proxmox_login::{Login, SecondFactorChallenge, TicketResult};
+use proxmox_login::{CompatMode, Login, SecondFactorChallenge, TicketResult};
 
 use crate::auth::AuthenticationKind;
 use crate::error::ParseFingerprintError;
@@ -68,7 +68,7 @@ pub struct Client {
     api_url: Uri,
     auth: Mutex<Option<Arc<AuthenticationKind>>>,
     client: Arc<proxmox_http::client::Client>,
-    pve_compat: bool,
+    compat_mode: CompatMode,
     cookie_name: Option<String>,
 }
 
@@ -91,7 +91,7 @@ impl Client {
             api_url,
             auth: Mutex::new(None),
             client,
-            pve_compat: false,
+            compat_mode: CompatMode::default(),
             cookie_name: None,
         }
     }
@@ -181,8 +181,8 @@ impl Client {
 
     /// Enable Proxmox VE login API compatibility. This is required to support TFA authentication
     /// on Proxmox VE APIs which require the `new-format` option.
-    pub fn set_pve_compatibility(&mut self, compatibility: bool) {
-        self.pve_compat = compatibility;
+    pub fn set_compatibility(&mut self, compat_mode: CompatMode) {
+        self.compat_mode = compat_mode;
     }
 
     pub fn set_cookie_name(&mut self, cookie_name: &str) {
@@ -418,7 +418,7 @@ impl Client {
     /// If the authentication is complete, `None` is returned and the authentication state updated.
     /// If a 2nd factor is required, `Some` is returned.
     pub async fn login(&self, login: Login) -> Result<Option<SecondFactorChallenge>, Error> {
-        let login = login.pve_compatibility(self.pve_compat);
+        let login = login.set_compatibility(self.compat_mode);
 
         let (ticket, api_response) = self.do_login_request(login.request()).await?;
 
diff --git a/proxmox-client/src/lib.rs b/proxmox-client/src/lib.rs
index f1df1e1d..3bac1333 100644
--- a/proxmox-client/src/lib.rs
+++ b/proxmox-client/src/lib.rs
@@ -12,7 +12,7 @@ mod error;
 pub use error::Error;
 
 pub use proxmox_login::tfa::TfaChallenge;
-pub use proxmox_login::{Authentication, Ticket};
+pub use proxmox_login::{CompatMode, Authentication, Ticket};
 
 mod api_path_builder;
 pub use api_path_builder::ApiPathBuilder;
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH proxmox 3/3] proxmox-login: add compat mode to fallback to PBS3 ticket parsing

[Christian Ebner]

The ticket info field is present for Proxmox Backup Server version 3
login response data, the client however switches to http-only in this
case.

Allow to use the old authentication workflow instead by extending the
compat mode by `Pbs3Ticket`, resulting in a full ticket instead of
the http-only one.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 proxmox-login/src/lib.rs | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/proxmox-login/src/lib.rs b/proxmox-login/src/lib.rs
index e7b8e023..93d09a8c 100644
--- a/proxmox-login/src/lib.rs
+++ b/proxmox-login/src/lib.rs
@@ -58,6 +58,7 @@ pub enum CompatMode {
     #[default]
     Generic,
     PveTfa,
+    Pbs3Ticket,
 }
 
 fn normalize_url(mut api_url: String) -> String {
@@ -216,15 +217,17 @@ impl Login {
             ));
         }
 
-        // `ticket_info` is set when the server sets the ticket via an HttpOnly cookie. this also
-        // means we do not have access to the cookie itself which happens for example in a browser.
-        // assume that the cookie is handled properly by the context (browser) and don't worry
-        // about handling it ourselves.
-        if let Some(ref ticket) = response.ticket_info {
-            let ticket = ticket.parse()?;
-            return Ok(TicketResult::HttpOnly(
-                self.authentication_for(ticket, response)?,
-            ));
+        if self.compat_mode == CompatMode::Pbs3Ticket {
+            // `ticket_info` is set when the server sets the ticket via an HttpOnly cookie. this also
+            // means we do not have access to the cookie itself which happens for example in a browser.
+            // assume that the cookie is handled properly by the context (browser) and don't worry
+            // about handling it ourselves.
+            if let Some(ref ticket) = response.ticket_info {
+                let ticket = ticket.parse()?;
+                return Ok(TicketResult::HttpOnly(
+                    self.authentication_for(ticket, response)?,
+                ));
+            }
         }
 
         // old authentication flow where we needed to handle the ticket ourselves even in the
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

Re: [pdm-devel] [PATCH proxmox 3/3] proxmox-login: add compat mode to fallback to PBS3 ticket parsing

[Christian Ebner]

On 9/29/25 5:48 PM, Christian Ebner wrote:
> The ticket info field is present for Proxmox Backup Server version 3
> login response data, the client however switches to http-only in this
> case.
> 
> Allow to use the old authentication workflow instead by extending the
> compat mode by `Pbs3Ticket`, resulting in a full ticket instead of
> the http-only one.
> 
> Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
> ---
>   proxmox-login/src/lib.rs | 21 ++++++++++++---------
>   1 file changed, 12 insertions(+), 9 deletions(-)
> 
> diff --git a/proxmox-login/src/lib.rs b/proxmox-login/src/lib.rs
> index e7b8e023..93d09a8c 100644
> --- a/proxmox-login/src/lib.rs
> +++ b/proxmox-login/src/lib.rs
> @@ -58,6 +58,7 @@ pub enum CompatMode {
>       #[default]
>       Generic,
>       PveTfa,
> +    Pbs3Ticket,
>   }
>   
>   fn normalize_url(mut api_url: String) -> String {
> @@ -216,15 +217,17 @@ impl Login {
>               ));
>           }
>   
> -        // `ticket_info` is set when the server sets the ticket via an HttpOnly cookie. this also
> -        // means we do not have access to the cookie itself which happens for example in a browser.
> -        // assume that the cookie is handled properly by the context (browser) and don't worry
> -        // about handling it ourselves.
> -        if let Some(ref ticket) = response.ticket_info {
> -            let ticket = ticket.parse()?;
> -            return Ok(TicketResult::HttpOnly(
> -                self.authentication_for(ticket, response)?,
> -            ));
> +        if self.compat_mode == CompatMode::Pbs3Ticket {

This is wrong, should have been a check for !CompatMOde::Pbs3Ticket

Please disregard this series, I will send a v2..


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 1/3] server: adapt to proxmox-client compat mode changes

[Christian Ebner]

Adapt to the method name and type changes for setting the client
login compatibility mode.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 server/src/connection.rs | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/server/src/connection.rs b/server/src/connection.rs
index 2eda452..5530812 100644
--- a/server/src/connection.rs
+++ b/server/src/connection.rs
@@ -19,7 +19,9 @@ use openssl::x509::X509StoreContextRef;
 use serde::Serialize;
 
 use proxmox_acme_api::CertificateInfo;
-use proxmox_client::{Client, HttpApiClient, HttpApiResponse, HttpApiResponseStream, TlsOptions};
+use proxmox_client::{
+    Client, CompatMode, HttpApiClient, HttpApiResponse, HttpApiResponseStream, TlsOptions,
+};
 
 use pdm_api_types::remotes::{NodeUrl, Remote, RemoteType, TlsProbeOutcome};
 use pve_api_types::client::PveClientImpl;
@@ -32,21 +34,21 @@ static INSTANCE: OnceLock<Box<dyn ClientFactory + Send + Sync>> = OnceLock::new(
 struct ConnectInfo {
     prefix: String,
     perl_compat: bool,
-    pve_compat: bool,
+    compat_mode: CompatMode,
     default_port: u16,
 }
 
 impl ConnectInfo {
     fn for_remote(remote: &Remote) -> Self {
-        let (prefix, perl_compat, pve_compat) = match remote.ty {
-            RemoteType::Pve => ("PVEAPIToken".to_string(), true, true),
-            RemoteType::Pbs => ("PBSAPIToken".to_string(), false, false),
+        let (prefix, perl_compat, compat_mode) = match remote.ty {
+            RemoteType::Pve => ("PVEAPIToken".to_string(), true, CompatMode::PveTfa),
+            RemoteType::Pbs => ("PBSAPIToken".to_string(), false, CompatMode::Generic),
         };
 
         ConnectInfo {
             prefix,
             perl_compat,
-            pve_compat,
+            compat_mode,
             default_port: remote.ty.default_port(),
         }
     }
@@ -56,7 +58,7 @@ impl ConnectInfo {
 fn prepare_connect_client_to_node(
     node: &NodeUrl,
     default_port: u16,
-    pve_compat: bool,
+    compat_mode: CompatMode,
 ) -> Result<Client, Error> {
     let mut options = TlsOptions::default();
 
@@ -75,7 +77,7 @@ fn prepare_connect_client_to_node(
 
     let mut client =
         proxmox_client::Client::with_options(uri.clone(), options, Default::default())?;
-    client.set_pve_compatibility(pve_compat);
+    client.set_compatibility(compat_mode);
     Ok(client)
 }
 
@@ -99,7 +101,7 @@ fn prepare_connect_client(
 
     let info = ConnectInfo::for_remote(remote);
 
-    let client = prepare_connect_client_to_node(node, info.default_port, info.pve_compat)?;
+    let client = prepare_connect_client_to_node(node, info.default_port, info.compat_mode)?;
 
     Ok((client, info))
 }
@@ -135,7 +137,7 @@ fn prepare_connect_multi_client(remote: &Remote) -> Result<(MultiClient, Connect
             client: Arc::new(prepare_connect_client_to_node(
                 node,
                 info.default_port,
-                info.pve_compat,
+                info.compat_mode,
             )?),
             hostname: node.hostname.clone(),
         });
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 2/3] server: pbs-client: check and fallback to PBS v3 ticket compat mode

[Christian Ebner]

Since the proxmox-login ticket parsing assumes the ticket to be
http-only if it contains the ticket-info field, but the PBS v3 API
does return that in any case, signal the client to fallback to the
old authentication flow.

This is currently only used during adding of a new remote, namely to
scan the remote and login for PBS API token creation/setting of its
ACLs.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 server/src/connection.rs | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/server/src/connection.rs b/server/src/connection.rs
index 5530812..14f878e 100644
--- a/server/src/connection.rs
+++ b/server/src/connection.rs
@@ -179,14 +179,19 @@ async fn connect_or_login(
         connect(remote, target_endpoint)
     } else {
         let (client, _info) = prepare_connect_client(remote, target_endpoint)?;
-        match client
-            .login(proxmox_login::Login::new(
-                client.api_url().to_string(),
-                remote.authid.to_string(),
-                remote.token.to_string(),
-            ))
-            .await
-        {
+        let mut login = proxmox_login::Login::new(
+            client.api_url().to_string(),
+            remote.authid.to_string(),
+            remote.token.to_string(),
+        );
+
+        //FIXME: drop once PBS3 is EOL
+        if remote.ty == RemoteType::Pbs {
+            // Forces both, PBSv4 and PBSv3 to use the same logic (since no http-only for PBSv4)
+            login = login.set_compatibility(CompatMode::Pbs3Ticket);
+        }
+
+        match client.login(login).await {
             Ok(Some(_)) => bail!("two factor auth not supported"),
             Ok(None) => {}
             Err(err) => match err {
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 3/3] Revert "ui: add wizard: note that login currently only works for PBS 4"

[Christian Ebner]

This reverts commit f9b6ba357f52a2cfd122e1318dc547b742c88541.

By setting the `Pbs3Ticket` compat mode when login to PBS version 3
instances, the token creation and setting of permissions now works as
intended also for older versions.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 ui/src/remotes/wizard_page_info.rs | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/ui/src/remotes/wizard_page_info.rs b/ui/src/remotes/wizard_page_info.rs
index b6ad5b3..7fffdd1 100644
--- a/ui/src/remotes/wizard_page_info.rs
+++ b/ui/src/remotes/wizard_page_info.rs
@@ -379,21 +379,6 @@ impl Component for PdmWizardPageInfo {
         let content = Column::new()
             .class(FlexFit)
             .with_child(Row::new().with_child(input_panel))
-            .with_child(
-                Row::new()
-                    .padding(2)
-                    .gap(2)
-                    .class(css::AlignItems::Center)
-                    .with_optional_child(
-                        if props.remote_type == RemoteType::Pbs && self.user_mode {
-                            Some(tr!(
-                                "Note: Login currently requires Proxmox Backup Server version 4."
-                            ))
-                        } else {
-                            None
-                        },
-                    ),
-            )
             .with_child(
                 Row::new()
                     .padding(2)
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] superseded: [PATCH datacenter-manager/proxmox 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility

[Christian Ebner]

superseded-by version 2:
https://lore.proxmox.com/pdm-devel/20250930080207.111162-1-c.ebner@proxmox.com/T/


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel