From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 69D9F1FF0B7 for ; Fri, 16 Oct 2026 14:31:29 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 397B3214D7; Fri, 16 Oct 2026 14:31:28 +0200 (CEST) From: Dominik Csapak To: pmg-devel@lists.proxmox.com Subject: [PATCH proxmox 1/2] login: add option to allow arbitrary userids in tickets Date: Fri, 16 Oct 2026 14:31:07 +0200 Message-ID: <20261016123124.2970062-2-d.csapak@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261016123124.2970062-1-d.csapak@proxmox.com> References: <20261016123124.2970062-1-d.csapak@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.356 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: FEFWBT2M3K3Q6UY6AOGZIMDJKWIUGWN4 X-Message-ID-Hash: FEFWBT2M3K3Q6UY6AOGZIMDJKWIUGWN4 X-MailFrom: d.csapak@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: In some cases the ticket does not contain the userid given to the backend, but a different one. This happens for example in PMG's quarantine with LDAP login. There a user is allowed to enter an alias to his mail address, but the ticket still contains the primary e-mail as userid. To allow this, add an option to the `Login` struct to disable the userid check and expose a setter for that. With this, we can remove the `@quarantine` workaround here since we don't check the username at all anymore for the PMG quarantine. This should not have any impact on security, since the backend must not give out tickets to wrong users and any client could choose to ignore this anyway. Signed-off-by: Dominik Csapak --- proxmox-login/src/lib.rs | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/proxmox-login/src/lib.rs b/proxmox-login/src/lib.rs index 0b290d20..f460b48c 100644 --- a/proxmox-login/src/lib.rs +++ b/proxmox-login/src/lib.rs @@ -50,6 +50,7 @@ pub struct Login { userid: String, password: Option, pve_compat: bool, + ignore_userid: bool, } fn normalize_url(mut api_url: String) -> String { @@ -58,9 +59,7 @@ fn normalize_url(mut api_url: String) -> String { } fn check_ticket_userid(ticket_userid: &str, expected_userid: &str) -> Result<(), ResponseError> { - if ticket_userid.trim_end_matches("@quarantine") - != expected_userid.trim_end_matches("@quarantine") - { + if ticket_userid != expected_userid { return Err("returned ticket contained unexpected userid".into()); } Ok(()) @@ -90,6 +89,12 @@ impl Login { &self.api_url } + /// When calling this, the ticket check allows a different userid to be returned than + /// what was originally supplied. + pub fn ignore_userid(&mut self) { + self.ignore_userid = true; + } + /// Prepare a request given an already parsed ticket. pub fn renew_ticket(api_url: impl Into, ticket: Ticket) -> Self { Self { @@ -97,6 +102,7 @@ impl Login { pve_compat: ticket.product() == "PVE", userid: ticket.userid().to_string(), password: Some(ticket.into()), + ignore_userid: false, } } @@ -108,6 +114,7 @@ impl Login { pve_compat: false, userid: userid.into(), password: None, + ignore_userid: false, } } @@ -122,6 +129,7 @@ impl Login { userid: userid.into(), password: Some(password.into()), pve_compat: false, + ignore_userid: false, } } @@ -188,11 +196,11 @@ impl Login { let response: api::ApiResponse = serde_json::from_slice(body)?; let response = response.data.ok_or("missing response data")?; - check_ticket_userid(&response.username, &self.userid)?; + self.check_ticket_userid(&response.username)?; // if a ticket was provided via a cookie, use it like a normal ticket if let Some(ticket) = cookie_ticket { - check_ticket_userid(ticket.userid(), &self.userid)?; + self.check_ticket_userid(ticket.userid())?; return Ok(TicketResult::Full( self.authentication_for(ticket, response)?, )); @@ -220,7 +228,7 @@ impl Login { Ok(match ticket { TicketResponse::Full(ticket) => { - check_ticket_userid(ticket.userid(), &self.userid)?; + self.check_ticket_userid(ticket.userid())?; TicketResult::Full(self.authentication_for(ticket, response)?) } @@ -251,6 +259,13 @@ impl Login { ticket, }) } + + fn check_ticket_userid(&self, ticket_userid: &str) -> Result<(), ResponseError> { + if self.ignore_userid { + return Ok(()); + } + check_ticket_userid(ticket_userid, &self.userid) + } } /// This is the result of a ticket call. It will either yield a final ticket, or a TFA challenge. @@ -420,18 +435,6 @@ mod test { assert!(check_ticket_userid("root@pam", "root@pam").is_ok()); // trivially equal assert!(check_ticket_userid("root@pam", "test@pam").is_err()); // trivially non-equal - - // some special cases for PMG quarantine - assert!(check_ticket_userid("user@ldap@quarantine", "user@ldap@quarantine").is_ok()); - assert!(check_ticket_userid("user@ldap@quarantine", "user@ldap").is_ok()); - assert!(check_ticket_userid("user@ldap", "user@ldap@quarantine").is_ok()); - - // test odd realm name - assert!( - check_ticket_userid("user@quarantine@quarantine", "user@quarantine@quarantine").is_ok() - ); - assert!(check_ticket_userid("user@quarantine", "user@quarantine@quarantine").is_ok()); - assert!(check_ticket_userid("user@quarantine", "user@ldap@quarantine").is_err()); } #[test] -- 2.47.3