From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 66198747F0 for ; Wed, 2 Jun 2021 12:16:24 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 56AE29D30 for ; Wed, 2 Jun 2021 12:16:24 +0200 (CEST) Received: from smtp.smtpout.orange.fr (smtp05.smtpout.orange.fr [80.12.242.127]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 3D2319D1C for ; Wed, 2 Jun 2021 12:16:23 +0200 (CEST) Received: from dovecot.localdomain ([90.118.15.232]) by mwinf5d25 with ME id CAGG2500450Qfqq03AGGeA; Wed, 02 Jun 2021 12:16:16 +0200 X-ME-Helo: dovecot.localdomain X-ME-Auth: anVsaWVuLmJsYWlzNUBvcmFuZ2UuZnI= X-ME-Date: Wed, 02 Jun 2021 12:16:16 +0200 X-ME-IP: 90.118.15.232 Message-ID: <03c89e70bbb303c3271c5ce9fab4e9cd@mwinf5d25.me-wanadoo.net> MIME-Version: 1.0 To: Dietmar Maurer , Proxmox VE development discussion From: wb Date: Wed, 2 Jun 2021 12:16:14 +0200 Importance: normal X-Priority: 3 In-Reply-To: <361453332.3258.1622624399545@webmail.proxmox.com> References: <361453332.3258.1622624399545@webmail.proxmox.com> X-SPAM-LEVEL: Spam detection results: 1 AWL 0.040 Adjusted score from AWL reputation of From: address HTML_MESSAGE 0.001 HTML included in message KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods KAM_NUMSUBJECT 0.5 Subject ends in numbers excluding current years RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: [pve-devel] =?utf-8?b?UkXCoDogUkXCoDogIFtQQVRDSF0gW1BBVENIIHB2?= =?utf-8?q?e-access-control=5D_SSO_feature=3Alogin_with_SAMLv2?= X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Jun 2021 10:16:24 -0000 > I also wonder why SAML? Would it be an option to use OpenId connect inste= ad? As I was able to use SAML, I know the functional part and therefore, if I u= sed SAML, it is only by ease. Switch to OpenID, why not. The time I set up a functional POC.=20 On the other hand, I would like to know your constraints. Do you still want to use Rust? If yes, I am curious to know how to bind per= l to Rust? Do you have an example? I noticed from our exchange : During an API call, if the user is not authenticated, do not pass in privat= e and privileged the writing on /tmp/. Waiting for your feedback, Sincerely, Julien Blais De=C2=A0: Dietmar Maurer Envoy=C3=A9 le=C2=A0:mercredi 2 juin 2021 11:00 =C3=80=C2=A0: wb; Proxmox VE development discussion Objet=C2=A0:Re: RE=C2=A0: [pve-devel] [PATCH] [PATCH pve-access-control] SS= O feature:login with SAMLv2 > > I wonder why you want to store temporary data in /etc/pve/tmp/saml. Wou= ldn't it we good enough > > to store that on the local file system? > On the one hand, I enjoyed reusing your work. > On the other hand, I think it is more secure to put this kind of data in = /etc/pve/tmp/saml than in /tmp/saml/ No, I consider this less secure. Especially if the write is triggered by un= authenticated request... > Then, yes, it is possible to store it on /tmp/saml for example, it is var= iable data. Nothing is fixed, you are free to do what you want. >=20 > > Unfortunately, your code depends on code not packaged for Debian. Any i= dea > > how to replace that (cpanm Net::SAML2)? >=20 > Since I'm not a perl specialist, I took what seemed to me the most standa= rd in this language. Have you considered cloning this repos available on Gi= tHub(https://github.com/perl-net-saml2/perl-Net-SAML2)? This module has way to much dependencies (Moose). I do not want to use that= . > > Or better, is there a 'rust' implementaion for SAML2? If so, we could m= ake perl bindings > > for that and reuse the code with Proxmox Backup Server. >=20 > Do you have a specific project or library in mind? >=20 > Unfortunately, I don't have any knowledge about rust and I'll have a hard= time accompanying you on this topic. However, it seems that there are proj= ects on github in opensource, for example https://github.com/njaremko/samae= l. All those SAML libs are basically unmaintained, without any large user base= . > I'll tell you again,nothing is fixed, you are free to do what you want. I also wonder why SAML? Would it be an option to use OpenId connect instead= ?