From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <pmg-devel-bounces@lists.proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 9F8AB1FF165 for <inbox@lore.proxmox.com>; Wed, 26 Feb 2025 12:39:31 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 2DEC211576; Wed, 26 Feb 2025 12:39:31 +0100 (CET) From: Markus Frank <m.frank@proxmox.com> To: pmg-devel@lists.proxmox.com Date: Wed, 26 Feb 2025 12:38:36 +0100 Message-Id: <20250226113848.42829-1-m.frank@proxmox.com> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.014 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [userconfig.pm, mod.rs, oidc.pm, authrealm.pm, pam.pm, plugin.pm, accesscontrol.pm, utils.pm, restenvironment.pm, httpserver.pm, users.pm, pmg.pm] Subject: [pmg-devel] [PATCH perl-rs/pmg-api/widget-toolkit/pmg-gui v7 0/12] fix #3892: OpenID Connect X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion <pmg-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pmg-devel>, <mailto:pmg-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pmg-devel/> List-Post: <mailto:pmg-devel@lists.proxmox.com> List-Help: <mailto:pmg-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel>, <mailto:pmg-devel-request@lists.proxmox.com?subject=subscribe> Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pmg-devel-bounces@lists.proxmox.com Sender: "pmg-devel" <pmg-devel-bounces@lists.proxmox.com> Patch-series to enable OpenID Connect Login for PMG apply/compile order: proxmox-perl-rs: 1 move openid code from pve-rs to common 2 remove empty PMG::RS::OpenId package to avoid confusion pmg-api: 3 config: add plugin system for authentication realms 4 config: add oidc type authentication realm 5 api: add/update/remove authentication realms like in PVE 6 api: oidc login similar to PVE 7 api: users: create user with a specified realm proxmox-widget-toolkit: 8 fix: window: AuthEditBase: rename variable 'realm' to 'type' 9 fix: panel: AuthView: change API path in pmx-domains model 10 form: RealmComboBox: add option to change the API path pmg-gui: 11 login: add option to login with OIDC realm 12 add realms panel to user management I still need to add the option to create users for other realms than PMG in the WebUI. The autocreate option of the OIDC realm can be used instead for now. Also the autocreate-role option needs to be exposed to the WebUI. I will send these things as follow-up patches or in the next iteration if this series cannot be applied yet. v7: * removed "pve-common: add Schema package with auth module that contains realm sync options" patch * added "pmg-api: api: users: create user with a specified realm" patch * removed tfa related code * save realms after the username like in v5: username@realm v6: * renamed Realm to AuthRealm and renamed every domain variable to realm * changed realm API-path from access/domains to access/auth-realm v5: * renamed openid/OpenId variables, filenames and modules to oidc/OIDC wherever possible * renamed Authdomains to Realm v4: * split "config: add plugin system for realms & add openid type realms" patch into two patches * use the name 'OpenId' for filenames, but use 'OIDC' as realm type name * added autocreate-role option to set the role for automatically created users in a realm, but currently not exposed in GUI (needs a lot of changes in pmg-gui and proxmox-widget-toolkit) proxmox-perl-rs: Markus Frank (2): move openid code from pve-rs to common remove empty PMG::RS::OpenId package to avoid confusion common/pkg/Makefile | 1 + common/src/mod.rs | 1 + common/src/oidc/mod.rs | 63 ++++++++++++++++++++++++++++++++++++++++ pmg-rs/Cargo.toml | 1 + pmg-rs/Makefile | 1 - pmg-rs/debian/control | 1 + pve-rs/src/openid/mod.rs | 32 +++++--------------- 7 files changed, 75 insertions(+), 25 deletions(-) create mode 100644 common/src/oidc/mod.rs pmg-api: Markus Frank (5): config: add plugin system for authentication realms config: add oidc type authentication realm api: add/update/remove authentication realms like in PVE api: oidc login similar to PVE api: users: create user with a specified realm src/Makefile | 6 + src/PMG/API2/AccessControl.pm | 17 ++- src/PMG/API2/AuthRealm.pm | 264 ++++++++++++++++++++++++++++++++++ src/PMG/API2/OIDC.pm | 243 +++++++++++++++++++++++++++++++ src/PMG/API2/Users.pm | 4 + src/PMG/AccessControl.pm | 40 ++++++ src/PMG/Auth/OIDC.pm | 101 +++++++++++++ src/PMG/Auth/PAM.pm | 21 +++ src/PMG/Auth/PMG.pm | 37 +++++ src/PMG/Auth/Plugin.pm | 202 ++++++++++++++++++++++++++ src/PMG/HTTPServer.pm | 4 +- src/PMG/RESTEnvironment.pm | 14 ++ src/PMG/UserConfig.pm | 26 ++-- src/PMG/Utils.pm | 29 +++- 14 files changed, 989 insertions(+), 19 deletions(-) create mode 100644 src/PMG/API2/AuthRealm.pm create mode 100644 src/PMG/API2/OIDC.pm create mode 100755 src/PMG/Auth/OIDC.pm create mode 100755 src/PMG/Auth/PAM.pm create mode 100755 src/PMG/Auth/PMG.pm create mode 100755 src/PMG/Auth/Plugin.pm widget-toolkit: Markus Frank (3): fix: window: AuthEditBase: rename variable 'realm' to 'type' panel: AuthView: change API path in pmx-domains model form: RealmComboBox: add option to change the API path src/form/RealmComboBox.js | 2 ++ src/panel/AuthView.js | 21 +++++++++++++-------- src/window/AuthEditBase.js | 4 ++-- 3 files changed, 17 insertions(+), 10 deletions(-) pmg-gui: Markus Frank (2): login: add option to login with OIDC realm add realms panel to user management js/LoginView.js | 209 ++++++++++++++++++++++++++++++++----------- js/UserManagement.js | 8 ++ js/Utils.js | 16 ++++ 3 files changed, 182 insertions(+), 51 deletions(-) -- 2.39.5 _______________________________________________ pmg-devel mailing list pmg-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel