From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id F22EB1FF38F for ; Mon, 24 Jun 2024 11:09:03 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 0BB7832545; Mon, 24 Jun 2024 11:09:10 +0200 (CEST) From: Markus Frank To: pmg-devel@lists.proxmox.com Date: Mon, 24 Jun 2024 11:08:49 +0200 Message-Id: <20240624090850.4683-8-m.frank@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240624090850.4683-1-m.frank@proxmox.com> References: <20240624090850.4683-1-m.frank@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.026 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pmg-devel] [PATCH pmg-gui v3 7/8] login: add OpenID realms X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pmg-devel-bounces@lists.proxmox.com Sender: "pmg-devel" By adding a viewModel with an oidc variable, the username & password fields are disabled/hidden when an OIDC realm is selected. Signed-off-by: Markus Frank --- js/LoginView.js | 200 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 153 insertions(+), 47 deletions(-) diff --git a/js/LoginView.js b/js/LoginView.js index b5da19a..87c013b 100644 --- a/js/LoginView.js +++ b/js/LoginView.js @@ -2,6 +2,21 @@ Ext.define('PMG.LoginView', { extend: 'Ext.container.Container', xtype: 'loginview', + viewModel: { + data: { + oidc: false, + }, + formulas: { + button_text: function(get) { + if (get("oidc") === true) { + return gettext("Login (OpenID Connect redirect)"); + } else { + return gettext("Login"); + } + }, + }, + }, + controller: { xclass: 'Ext.app.ViewController', @@ -45,51 +60,78 @@ Ext.define('PMG.LoginView', { }, submitForm: async function() { - let me = this; - let view = me.getView(); - let loginForm = me.lookupReference('loginForm'); - var unField = me.lookupReference('usernameField'); - var saveunField = me.lookupReference('saveunField'); - - if (loginForm.isValid()) { - if (loginForm.isVisible()) { - loginForm.mask(gettext('Please wait...'), 'x-mask-loading'); - } + var me = this; - // set or clear username for admin view - if (view.targetview !== 'quarantineview') { - var sp = Ext.state.Manager.getProvider(); - if (saveunField.getValue() === true) { - sp.set(unField.getStateId(), unField.getValue()); - } else { - sp.clear(unField.getStateId()); - } - sp.set(saveunField.getStateId(), saveunField.getValue()); + var loginForm = this.lookupReference('loginForm'); + var unField = this.lookupReference('usernameField'); + var saveunField = this.lookupReference('saveunField'); + var view = this.getView(); + + if (!loginForm.isValid()) { + return; + } + + if (loginForm.isVisible()) { + loginForm.mask(gettext('Please wait...'), 'x-mask-loading'); + } + + // set or clear username for admin view + if (view.targetview !== 'quarantineview') { + var sp = Ext.state.Manager.getProvider(); + if (saveunField.getValue() === true) { + sp.set(unField.getStateId(), unField.getValue()); + } else { + sp.clear(unField.getStateId()); } + sp.set(saveunField.getStateId(), saveunField.getValue()); + } - let creds = loginForm.getValues(); + let creds = loginForm.getValues(); - try { - let resp = await Proxmox.Async.api2({ - url: '/api2/extjs/access/ticket', - params: creds, - method: 'POST', - }); + if (this.getViewModel().data.oidc === true) { + const redirectURL = location.origin; + Proxmox.Utils.API2Request({ + url: '/api2/extjs/access/openid/auth-url', + params: { + realm: creds.realm, + "redirect-url": redirectURL, + }, + method: 'POST', + success: function(resp, opts) { + window.location = resp.result.data; + }, + failure: function(resp, opts) { + Proxmox.Utils.authClear(); + loginForm.unmask(); + Ext.MessageBox.alert( + gettext('Error'), + gettext('OpenID Connect redirect failed.') + `
${resp.htmlStatus}`, + ); + }, + }); + return; + } - let data = resp.result.data; - if (data.ticket.startsWith('PMG:!tfa!')) { - data = await me.performTFAChallenge(data); - } - PMG.Utils.updateLoginData(data); - PMG.app.changeView(view.targetview); - } catch (error) { - Proxmox.Utils.authClear(); - loginForm.unmask(); - Ext.MessageBox.alert( - gettext('Error'), - gettext('Login failed. Please try again'), - ); + try { + let resp = await Proxmox.Async.api2({ + url: '/api2/extjs/access/ticket', + params: creds, + method: 'POST', + }); + + let data = resp.result.data; + if (data.ticket.startsWith('PMG:!tfa!')) { + data = await me.performTFAChallenge(data); } + PMG.Utils.updateLoginData(data); + PMG.app.changeView(view.targetview); + } catch (error) { + Proxmox.Utils.authClear(); + loginForm.unmask(); + Ext.MessageBox.alert( + gettext('Error'), + gettext('Login failed. Please try again'), + ); } }, @@ -115,6 +157,15 @@ Ext.define('PMG.LoginView', { return resp.result.data; }, + success: function(data) { + var me = this; + var view = me.getView(); + var handler = view.handler || Ext.emptyFn; + handler.call(me, data); + PMG.Utils.updateLoginData(data); + PMG.app.changeView(view.targetview); + }, + openQuarantineLinkWindow: function() { let me = this; me.lookup('loginwindow').setVisible(false); @@ -150,6 +201,14 @@ Ext.define('PMG.LoginView', { window.location.reload(); }, }, + 'field[name=realm]': { + change: function(f, value) { + let record = f.store.getById(value); + if (record === undefined) return; + let data = record.data; + this.getViewModel().set("oidc", data.type === "oidc"); + }, + }, 'button[reference=quarantineButton]': { click: 'openQuarantineLinkWindow', }, @@ -174,6 +233,41 @@ Ext.define('PMG.LoginView', { var pwField = this.lookupReference('passwordField'); pwField.focus(); } + + let auth = Proxmox.Utils.getOpenIDRedirectionAuthorization(); + if (auth !== undefined) { + Proxmox.Utils.authClear(); + + let loginForm = this.lookupReference('loginForm'); + loginForm.mask(gettext('OpenID Connect login - please wait...'), 'x-mask-loading'); + + const redirectURL = location.origin; + + Proxmox.Utils.API2Request({ + url: '/api2/extjs/access/openid/login', + params: { + state: auth.state, + code: auth.code, + "redirect-url": redirectURL, + }, + method: 'POST', + failure: function(response) { + loginForm.unmask(); + let error = response.htmlStatus; + Ext.MessageBox.alert( + gettext('Error'), + gettext('OpenID Connect login failed, please try again') + `
${error}`, + () => { window.location = redirectURL; }, + ); + }, + success: function(response, options) { + loginForm.unmask(); + let data = response.result.data; + history.replaceState(null, '', redirectURL); + me.success(data); + }, + }); + } } }, }, @@ -250,6 +344,10 @@ Ext.define('PMG.LoginView', { reference: 'usernameField', stateId: 'login-username', inputAttrTpl: 'autocomplete=username', + bind: { + visible: "{!oidc}", + disabled: "{oidc}", + }, }, { xtype: 'textfield', @@ -258,6 +356,16 @@ Ext.define('PMG.LoginView', { name: 'password', reference: 'passwordField', inputAttrTpl: 'autocomplete=current-password', + bind: { + visible: "{!oidc}", + disabled: "{oidc}", + }, + }, + { + xtype: 'pmxRealmComboBox', + reference: 'realmfield', + name: 'realm', + value: 'pam', }, { xtype: 'proxmoxLanguageSelector', @@ -266,12 +374,6 @@ Ext.define('PMG.LoginView', { name: 'lang', submitValue: false, }, - { - xtype: 'hiddenfield', - reference: 'realmfield', - name: 'realm', - value: 'pmg', - }, ], buttons: [ { @@ -283,15 +385,19 @@ Ext.define('PMG.LoginView', { labelAlign: 'right', labelWidth: 150, submitValue: false, + bind: { + visible: "{!oidc}", + }, }, { text: gettext('Request Quarantine Link'), reference: 'quarantineButton', }, { - text: gettext('Login'), + bind: { + text: "{button_text}", + }, reference: 'loginButton', - formBind: true, }, ], }, -- 2.39.2 _______________________________________________ pmg-devel mailing list pmg-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel