[PATCH proxmox 1/2] login: add option to allow arbitrary userids in tickets

[Dominik Csapak <d.csapak@proxmox.com>]

In some cases the ticket does not contain the userid given to the
backend, but a different one. This happens for example in PMG's
quarantine with LDAP login. There a user is allowed to enter an alias to
his mail address, but the ticket still contains the primary e-mail as
userid.

To allow this, add an option to the `Login` struct to disable the userid
check and expose a setter for that.

With this, we can remove the `@quarantine` workaround here since we
don't check the username at all anymore for the PMG quarantine.

This should not have any impact on security, since the backend must not
give out tickets to wrong users and any client could choose to ignore
this anyway.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 proxmox-login/src/lib.rs | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/proxmox-login/src/lib.rs b/proxmox-login/src/lib.rs
index 0b290d20..f460b48c 100644
--- a/proxmox-login/src/lib.rs
+++ b/proxmox-login/src/lib.rs
@@ -50,6 +50,7 @@ pub struct Login {
     userid: String,
     password: Option<String>,
     pve_compat: bool,
+    ignore_userid: bool,
 }
 
 fn normalize_url(mut api_url: String) -> String {
@@ -58,9 +59,7 @@ fn normalize_url(mut api_url: String) -> String {
 }
 
 fn check_ticket_userid(ticket_userid: &str, expected_userid: &str) -> Result<(), ResponseError> {
-    if ticket_userid.trim_end_matches("@quarantine")
-        != expected_userid.trim_end_matches("@quarantine")
-    {
+    if ticket_userid != expected_userid {
         return Err("returned ticket contained unexpected userid".into());
     }
     Ok(())
@@ -90,6 +89,12 @@ impl Login {
         &self.api_url
     }
 
+    /// When calling this, the ticket check allows a different userid to be returned than
+    /// what was originally supplied.
+    pub fn ignore_userid(&mut self) {
+        self.ignore_userid = true;
+    }
+
     /// Prepare a request given an already parsed ticket.
     pub fn renew_ticket(api_url: impl Into<String>, ticket: Ticket) -> Self {
         Self {
@@ -97,6 +102,7 @@ impl Login {
             pve_compat: ticket.product() == "PVE",
             userid: ticket.userid().to_string(),
             password: Some(ticket.into()),
+            ignore_userid: false,
         }
     }
 
@@ -108,6 +114,7 @@ impl Login {
             pve_compat: false,
             userid: userid.into(),
             password: None,
+            ignore_userid: false,
         }
     }
 
@@ -122,6 +129,7 @@ impl Login {
             userid: userid.into(),
             password: Some(password.into()),
             pve_compat: false,
+            ignore_userid: false,
         }
     }
 
@@ -188,11 +196,11 @@ impl Login {
         let response: api::ApiResponse<api::CreateTicketResponse> = serde_json::from_slice(body)?;
         let response = response.data.ok_or("missing response data")?;
 
-        check_ticket_userid(&response.username, &self.userid)?;
+        self.check_ticket_userid(&response.username)?;
 
         // if a ticket was provided via a cookie, use it like a normal ticket
         if let Some(ticket) = cookie_ticket {
-            check_ticket_userid(ticket.userid(), &self.userid)?;
+            self.check_ticket_userid(ticket.userid())?;
             return Ok(TicketResult::Full(
                 self.authentication_for(ticket, response)?,
             ));
@@ -220,7 +228,7 @@ impl Login {
 
         Ok(match ticket {
             TicketResponse::Full(ticket) => {
-                check_ticket_userid(ticket.userid(), &self.userid)?;
+                self.check_ticket_userid(ticket.userid())?;
                 TicketResult::Full(self.authentication_for(ticket, response)?)
             }
 
@@ -251,6 +259,13 @@ impl Login {
             ticket,
         })
     }
+
+    fn check_ticket_userid(&self, ticket_userid: &str) -> Result<(), ResponseError> {
+        if self.ignore_userid {
+            return Ok(());
+        }
+        check_ticket_userid(ticket_userid, &self.userid)
+    }
 }
 
 /// This is the result of a ticket call. It will either yield a final ticket, or a TFA challenge.
@@ -420,18 +435,6 @@ mod test {
         assert!(check_ticket_userid("root@pam", "root@pam").is_ok()); // trivially equal
 
         assert!(check_ticket_userid("root@pam", "test@pam").is_err()); // trivially non-equal
-
-        // some special cases for PMG quarantine
-        assert!(check_ticket_userid("user@ldap@quarantine", "user@ldap@quarantine").is_ok());
-        assert!(check_ticket_userid("user@ldap@quarantine", "user@ldap").is_ok());
-        assert!(check_ticket_userid("user@ldap", "user@ldap@quarantine").is_ok());
-
-        // test odd realm name
-        assert!(
-            check_ticket_userid("user@quarantine@quarantine", "user@quarantine@quarantine").is_ok()
-        );
-        assert!(check_ticket_userid("user@quarantine", "user@quarantine@quarantine").is_ok());
-        assert!(check_ticket_userid("user@quarantine", "user@ldap@quarantine").is_err());
     }
 
     #[test]
-- 
2.47.3