public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* Re: [pve-devel] [PATCH] [PATCH pve-access-control] SSO feature: login with SAMLv2
@ 2021-06-01  8:12 Dietmar Maurer
  0 siblings, 0 replies; 5+ messages in thread
From: Dietmar Maurer @ 2021-06-01  8:12 UTC (permalink / raw)
  To: Proxmox VE development discussion, Julien BLAIS

I wonder why you want to store temporary data in /etc/pve/tmp/saml. Wouldn't it we good enough
to store that on the local file system?

> On 05/27/2021 11:55 PM Julien BLAIS <webmaster@jbsky.fr> wrote:
> 
>  
> Added a new endpoint usable by api2/html/access/saml?realm=$DOM
>   which allows to initiate a redirection to an IdP.
>   During initialization, the /etc/pve/tmp/saml file is filled with the format REALM:SAML_REQUEST_ID:TIME
> Modification of the endpoint /access/ticket to support SAMLResponse.
>   The information is extracted from the SAMLResponse variable in order to check
>   if the SAML_REQUEST_ID exists in /etc/pve/tmp/saml, we extract from this file the REALM used to initiate the SSO connection.




^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [pve-devel]  RE : RE :  [PATCH] [PATCH pve-access-control] SSO feature:login with SAMLv2
@ 2021-06-02 10:48 Dietmar Maurer
  2021-06-03  8:24 ` [pve-devel] " Victor Hooi
  0 siblings, 1 reply; 5+ messages in thread
From: Dietmar Maurer @ 2021-06-02 10:48 UTC (permalink / raw)
  To: wb, Proxmox VE development discussion


> On 06/02/2021 12:16 PM wb <webmaster@jbsky.fr> wrote:
> 
> 
> > I also wonder why SAML? Would it be an option to use OpenId connect instead?
> As I was able to use SAML, I know the functional part and therefore, if I used SAML, it is only by ease.
> 
> Switch to OpenID, why not. The time I set up a functional POC.
> 
> On the other hand, I would like to know your constraints.

Sorry, what do you want to know exactly?

> Do you still want to use Rust? 

Yes. But I am still searching for usable crates:

openidconnect: https://github.com/ramosbugs/openidconnect-rs

Seems promising, but I have not done any testing so far...

> If yes, I am curious to know how to bind perl to Rust? Do you have an example?

https://git.proxmox.com/?p=perlmod.git;a=summary

Hope the inline docs and examples are good enough to start...

> I noticed from our exchange :
> During an API call, if the user is not authenticated, do not pass in private and privileged the writing on /tmp/.

yes, unprivileged users should not be able to write anything.




^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [pve-devel] [PATCH] [PATCH pve-access-control] SSO feature: login with SAMLv2
@ 2021-06-01  9:04 Dietmar Maurer
  0 siblings, 0 replies; 5+ messages in thread
From: Dietmar Maurer @ 2021-06-01  9:04 UTC (permalink / raw)
  To: Proxmox VE development discussion, Julien BLAIS

Unfortunately, your code depends on code not packaged for Debian. Any idea 
how to replace that (cpanm Net::SAML2)?

Or better, is there a 'rust' implementaion for SAML2? If so, we could make perl bindings
for that and reuse the code with Proxmox Backup Server.

Other ideas?

> diff --git a/src/PVE/Auth/SAML.pm b/src/PVE/Auth/SAML.pm
> new file mode 100644
> index 0000000..4653cb7
> --- /dev/null
> +++ b/src/PVE/Auth/SAML.pm
> @@ -0,0 +1,248 @@
> +# Instructions for installation :
> +# apt-get install libxml2 make gcc libssl-dev libperl-dev git cpanminus
> +# cpanm Net::SAML2
> +# ln -s /usr/local/share/perl/5.28.1/Net/SAML2 /usr/share/perl/5.28.1/Net/SAML2
> +# ln -s /usr/local/share/perl/5.28.1/Net/SAML2 /usr/share/perl5/Net/SAML2




^ permalink raw reply	[flat|nested] 5+ messages in thread
* [pve-devel] [PATCH] [PATCH pve-access-control] SSO feature: login with SAMLv2
@ 2021-05-27 21:55 Julien BLAIS
  2021-05-28  7:38 ` Thomas Lamprecht
  0 siblings, 1 reply; 5+ messages in thread
From: Julien BLAIS @ 2021-05-27 21:55 UTC (permalink / raw)
  To: pve-devel; +Cc: Julien BLAIS

Added a new endpoint usable by api2/html/access/saml?realm=$DOM
  which allows to initiate a redirection to an IdP.
  During initialization, the /etc/pve/tmp/saml file is filled with the format REALM:SAML_REQUEST_ID:TIME
Modification of the endpoint /access/ticket to support SAMLResponse.
  The information is extracted from the SAMLResponse variable in order to check
  if the SAML_REQUEST_ID exists in /etc/pve/tmp/saml, we extract from this file the REALM used to initiate the SSO connection.
For the initialization and authentication part, I rely on the work available in the github repository by trying to apply the best recommendations.
  The TIME part of each record is tested with the time() function to ensure that each record does not exceed $timeout

Signed-off-by: Julien BLAIS <webmaster@jbsky.fr>
---
 src/PVE/API2/AccessControl.pm |  73 +++++++++-
 src/PVE/AccessControl.pm      |   2 +
 src/PVE/Auth/Makefile         |   1 +
 src/PVE/Auth/SAML.pm          | 248 ++++++++++++++++++++++++++++++++++
 4 files changed, 322 insertions(+), 2 deletions(-)
 create mode 100644 src/PVE/Auth/SAML.pm

diff --git a/src/PVE/API2/AccessControl.pm b/src/PVE/API2/AccessControl.pm
index a77694b..bd660c3 100644
--- a/src/PVE/API2/AccessControl.pm
+++ b/src/PVE/API2/AccessControl.pm
@@ -20,6 +20,7 @@ use PVE::API2::Group;
 use PVE::API2::Role;
 use PVE::API2::ACL;
 use PVE::Auth::Plugin;
+use PVE::Auth::SAML;
 use PVE::OTP;
 use PVE::Tools;
 
@@ -243,6 +244,7 @@ __PACKAGE__->register_method ({
 	    username => {
 	        description => "User name",
 	        type => 'string',
+	        optional => 1,
 	        maxLength => 64,
 	        completion => \&PVE::AccessControl::complete_username,
 	    },
@@ -254,6 +256,7 @@ __PACKAGE__->register_method ({
 	    password => {
 		description => "The secret password. This can also be a valid ticket.",
 		type => 'string',
+		optional => 1,
 	    },
 	    otp => {
 		description => "One-time password for Two-factor authentication.",
@@ -274,6 +277,11 @@ __PACKAGE__->register_method ({
 		optional => 1,
 		maxLength => 64,
 	    },
+	    SAMLResponse => {
+		description => "SAMLResponse.",
+		type => 'string',
+		optional => 1,
+	    },
 	}
     },
     returns => {
@@ -289,8 +297,21 @@ __PACKAGE__->register_method ({
     code => sub {
 	my ($param) = @_;
 
-	my $username = $param->{username};
-	$username .= "\@$param->{realm}" if $param->{realm};
+	my $username;
+	if(defined($param->{username})){
+	    $username = $param->{username};
+	    $username .= "\@$param->{realm}" if $param->{realm};
+	}
+	elsif(defined($param->{SAMLResponse})) {
+	    my $realm = PVE::Auth::SAML->get_realm($param->{SAMLResponse});
+	    $username = PVE::Auth::SAML->get_username($param->{SAMLResponse})."\@$realm" if $realm;
+
+	    # Prepare for PVE::Auth::SAML->authenticate_user()
+	    $param->{password}=$param->{SAMLResponse};
+	}
+	else {
+	    die PVE::Exception->new("authentication failure\n", code => 401);
+	}
 
 	$username = PVE::AccessControl::lookup_username($username);
 	my $rpcenv = PVE::RPCEnvironment::get();
@@ -719,4 +740,52 @@ __PACKAGE__->register_method({
 	return $res;
     }});
 
+__PACKAGE__->register_method ({
+    name => 'get_saml',
+    path => 'saml',
+    method => 'GET',
+    permissions => { user => 'world' },
+    protected => 1, # else we can't access shadow files
+    allowtoken => 0, # we don't want tokens to create tickets
+    description => "Init saml redirect to a login page.",
+    parameters => {
+	additionalProperties => 0,
+	properties => {
+	    realm => {
+		type => 'string',
+		description => "You must pass the realm using in this parameter.",
+	    }
+	}
+    },
+    returns => {
+	type => "object",
+	properties => {
+	    url => { type => 'string' },
+	    realm => { type => 'string'}
+	}
+    },
+    code => sub {
+	my ($param) = @_;
+
+	my $domain_cfg = cfs_read_file('domains.cfg');
+
+	my $rpcenv = PVE::RPCEnvironment::get();
+
+	my $url = "";
+
+	eval {
+	    $url = PVE::Auth::SAML->init_redirect($domain_cfg->{ids}->{$param->{realm}},$param->{realm});
+	};
+
+	if (my $err = $@) {
+	    my $clientip = $rpcenv->get_client_ip() || '';
+	    syslog('err', "Init saml redirect to a login page; rhost=$clientip msg=$err");
+	    die PVE::Exception->new("authentication failure\n", code => 401);
+	}
+
+	die PVE::Exception->new("authentication failure '$url'\n", code => 401) if ( $url eq "" );
+
+	return { realm => $param->{realm}, url => $url };
+    }});
+
 1;
diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index f7d4e78..61bc680 100644
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -22,6 +22,7 @@ use PVE::JSONSchema qw(register_standard_option get_standard_option);
 use PVE::Auth::Plugin;
 use PVE::Auth::AD;
 use PVE::Auth::LDAP;
+use PVE::Auth::SAML;
 use PVE::Auth::PVE;
 use PVE::Auth::PAM;
 
@@ -29,6 +30,7 @@ use PVE::Auth::PAM;
 
 PVE::Auth::AD->register();
 PVE::Auth::LDAP->register();
+PVE::Auth::SAML->register();
 PVE::Auth::PVE->register();
 PVE::Auth::PAM->register();
 PVE::Auth::Plugin->init();
diff --git a/src/PVE/Auth/Makefile b/src/PVE/Auth/Makefile
index 58ae362..8a4688e 100644
--- a/src/PVE/Auth/Makefile
+++ b/src/PVE/Auth/Makefile
@@ -3,6 +3,7 @@ AUTH_SOURCES= 		 	\
 	Plugin.pm 		\
 	PVE.pm		 	\
 	PAM.pm		 	\
+	SAML.pm		 	\
 	AD.pm		 	\
 	LDAP.pm
 
diff --git a/src/PVE/Auth/SAML.pm b/src/PVE/Auth/SAML.pm
new file mode 100644
index 0000000..4653cb7
--- /dev/null
+++ b/src/PVE/Auth/SAML.pm
@@ -0,0 +1,248 @@
+# Instructions for installation :
+# apt-get install libxml2 make gcc libssl-dev libperl-dev git cpanminus
+# cpanm Net::SAML2
+# ln -s /usr/local/share/perl/5.28.1/Net/SAML2 /usr/share/perl/5.28.1/Net/SAML2
+# ln -s /usr/local/share/perl/5.28.1/Net/SAML2 /usr/share/perl5/Net/SAML2
+
+package PVE::Auth::SAML;
+use POSIX;
+
+# base64 decode
+use MIME::Base64;
+
+use strict;
+use warnings;
+
+use Net::SAML2::IdP;
+use Net::SAML2::Protocol::Assertion;
+use Net::SAML2::Protocol::AuthnRequest;
+use Net::SAML2::Binding::Redirect;
+use PVE::JSONSchema;
+use PVE::Tools;
+use PVE::Auth::Plugin;
+
+use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file);
+
+use base qw(PVE::Auth::Plugin);
+
+my $samlrequestfile = 'tmp/saml';
+my $timeout = 60;
+
+cfs_register_file(
+    $samlrequestfile,
+    \&parse_saml_request,
+    \&write_saml_request);
+
+sub parse_saml_request {
+    my ($filename, $raw) = @_;
+
+    my $requests = {};
+
+    return $requests if !defined($raw);
+
+    while ($raw =~ /^\s*(.+?)\s*$/gm) {
+	my $line = $1;
+
+	if ($line !~ m/^\S+:\S+:\S+:$/) {
+	    warn "saml request: ignore invalid line $.\n";
+	    next;
+	}
+
+	my ($realm, $request, $time) = split (/:/, $line);
+	$requests->{realm}->{$realm}->{request}->{$request}->{time} = $time;
+    }
+
+    return $requests;
+}
+
+sub write_saml_request{
+    my ($filename, $saml_requests) = @_;
+
+    my $data='';
+    foreach my $realm (keys %{$saml_requests->{realm}}) {
+	foreach my $saml_request (keys %{$saml_requests->{realm}->{$realm}->{request}}) {
+	    if (time() - $saml_requests->{realm}->{$realm}->{request}->{$saml_request}->{time} < $timeout) {
+		$data .= "$realm:$saml_request:".$saml_requests->{realm}->{$realm}->{request}->{$saml_request}->{time}.":\n";
+	    }
+	}
+    }
+    return $data;
+}
+
+sub lock_saml_request {
+    my ($code, $errmsg) = @_;
+
+    cfs_lock_file($samlrequestfile, undef, $code);
+    my $err = $@;
+    if ($err) {
+	$errmsg ? die "$errmsg: $err" : die $err;
+    }
+}
+
+sub type {
+    return 'saml';
+}
+
+sub check_saml_request {
+    my ($request_id) = @_;
+
+    my $saml_requests = cfs_read_file($samlrequestfile);
+    my $found;
+    foreach my $realm (keys %{$saml_requests->{realm}}) {
+	foreach my $saml_request (keys %{$saml_requests->{realm}->{$realm}->{request}}) {
+	    if (time() - $saml_requests->{realm}->{$realm}->{request}->{$saml_request}->{time} < $timeout) {
+		if ($request_id eq $saml_request){
+		    $found = $saml_request;
+		    delete_request($realm, $saml_request);
+		}
+	    }
+	    else {
+		delete_request($realm, $saml_request);
+	    }
+	}
+    }
+    return $found;
+}
+
+sub properties {
+    return {
+	Identity_Provider_Entity_ID => {
+	    description => "Set the entity ID of the upstream identity provider."
+	    . "This will be provided by your IdP.",
+	    type => 'string',
+	},
+	Identity_Provider_Url_Metadata => {
+	    description => "Set the metadata Url of the identity provider.",
+	    type => 'string',
+	},
+	# TODO how to add a CAcert content instead of path?
+	Identity_Provider_x509_CA_Certificate => {
+	    description => "Paste the x509 CA certificate data from the"
+	    . "upstream identity provider. In most cases,"
+	    . "this will be provided by your IdP.",
+	    type => 'string',
+	},
+	# TODO how to add a private key content instead of path?
+	Service_Provider_Private_Key => {
+	    description => "Paste the Private key.",
+	    type => 'string',
+	},
+	Service_Provider_Entity_ID => {
+	    description => "Displays the service provider's entity ID."
+	    . "This is the entity ID you will need to provide to your IdP.",
+	    type => 'string',
+	}
+    };
+}
+
+sub options {
+    return {
+	Identity_Provider_Url_Metadata => {},
+	Identity_Provider_x509_CA_Certificate => {},
+	Identity_Provider_Entity_ID => {},
+	Service_Provider_Entity_ID => {},
+	Service_Provider_Private_Key => {},
+	comment => { optional => 1 },
+	default => { optional => 1 },
+    };
+}
+
+# used by GET SAML
+# Init a redirect and return Url
+sub init_redirect {
+    my ($class, $config, $realm) = @_;
+
+    my $url = $config->{Identity_Provider_Url_Metadata};
+    my $cacert = $config->{Identity_Provider_x509_CA_Certificate};
+    my $samlkey = $config->{Service_Provider_Private_Key};
+
+    my $idp = Net::SAML2::IdP->new_from_url(
+	url => $url,
+	cacert => $cacert
+    );
+    my $authnreq = Net::SAML2::Protocol::AuthnRequest->new(
+	issuer		=> $config->{Service_Provider_Entity_ID},
+	destination   => $idp->sso_url('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'),
+	provider_name => $config->{Identity_Provider_Entity_ID},
+    );
+
+    # Here, we need to store saml request id and check it on return from the IdP POST
+    # Is there a way to associate this saml request id with the session?
+    # If yes => TODO
+    lock_saml_request(sub {
+	my $requestfile = cfs_read_file($samlrequestfile);
+	$requestfile->{realm}->{$realm}->{request}->{$authnreq->id}->{time} = time();
+	cfs_write_file($samlrequestfile, $requestfile);
+    });
+
+    my $redirect = Net::SAML2::Binding::Redirect->new(
+	key => $samlkey,
+	cert => $idp->cert('signing'),
+	param => 'SAMLRequest',
+	# The ssl_url destination for redirect
+	url => $idp->sso_url('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'),
+    );
+
+    return $redirect->sign($authnreq->as_xml);
+}
+
+sub get_username {
+    my ($class, $SAMLResponse) = @_;
+
+    my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(
+	xml => decode_base64($SAMLResponse)
+    );
+
+    return $assertion->{nameid};
+}
+
+# TODO get saml_request_id from cookie instead of $SAMLResponse
+sub get_realm {
+    my ($class, $SAMLResponse) = @_;
+
+    my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(
+	xml => decode_base64($SAMLResponse)
+    );
+
+    my $saml_requests = cfs_read_file($samlrequestfile);
+    foreach my $realm (keys %{$saml_requests->{realm}}) {
+	foreach my $saml_request (keys %{$saml_requests->{realm}->{$realm}->{request}}) {
+	    if ($assertion->{in_response_to} eq $saml_request) {
+		return $realm;
+	    }
+	}
+    }
+    return undef;
+}
+
+sub authenticate_user {
+    my ($class, $config, $realm, $username, $SAMLResponse) = @_;
+
+    my $valid = 0;
+
+    my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(
+	xml => decode_base64($SAMLResponse)
+    );
+
+    my $issuer = $config->{Service_Provider_Entity_ID};
+
+    if (check_saml_request($assertion->{in_response_to})) {
+	$valid = $assertion->valid($issuer, $assertion->{in_response_to});
+    }
+
+    die 'saml login failed!' if ($valid != '1');
+
+    return 1;
+}
+
+sub delete_request {
+    my ($realm, $request) = @_;
+
+    lock_saml_request(sub {
+	my $saml_requests = cfs_read_file($samlrequestfile);
+	delete $saml_requests->{realm}->{$realm}->{request}->{$request};
+	cfs_write_file($samlrequestfile, $saml_requests);
+    });
+}
+
+1;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-06-03  8:34 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-01  8:12 [pve-devel] [PATCH] [PATCH pve-access-control] SSO feature: login with SAMLv2 Dietmar Maurer
  -- strict thread matches above, loose matches on Subject: below --
2021-06-02 10:48 [pve-devel] RE : RE : [PATCH] [PATCH pve-access-control] SSO feature:login " Dietmar Maurer
2021-06-03  8:24 ` [pve-devel] " Victor Hooi
2021-06-01  9:04 [pve-devel] [PATCH] [PATCH pve-access-control] SSO feature: login " Dietmar Maurer
2021-05-27 21:55 Julien BLAIS
2021-05-28  7:38 ` Thomas Lamprecht

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal