From: "Fabian Grünbichler" <f.gruenbichler@proxmox.com>
To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>,
Thomas Lamprecht <t.lamprecht@proxmox.com>
Subject: Re: [pve-devel] [PATCH access-control] fix #3513: pass configured proxy to OpenID
Date: Mon, 06 Sep 2021 10:52:29 +0200 [thread overview]
Message-ID: <1630917949.olp1i1j6ub.astroid@nora.none> (raw)
In-Reply-To: <d35d4eec-1c08-cd14-0fde-d2a42a8288d0@proxmox.com>
On August 25, 2021 6:31 pm, Thomas Lamprecht wrote:
> On 13/07/2021 10:09, Fabian Grünbichler wrote:
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
>> ---
>> seemed like the easiest way to fix this - but we could also change the
>> proxmox-openid-rs API to take the proxy as parameter..
>>
>
> seems OK in general, but do we only want to set it in case it actually has
> a value? Not sure if non-existing and existing but empty makes any difference
> here - e.g., a behavior that one could possibly imagine is that it would override
> another source/default for a proxy to force no-proxy...
>
> Mostly just asking if you thought about that, it's probably just a very vague and
> theoretical issue..
Yeah I think this would be rather theoretical, as our API services run
without that env variable set by default, so a user would have to
edit/override the systemd unit to set the env variable instead of using
our built-in mechanism..
but alas,
local %ENV;
if (my $http_proxy = $dcconf->{http_proxy}) {
$ENV{all_proxy} = $http_proxy;
}
should work just as well but still preserve a fallback to pre-existing
env variable
>
>> src/PVE/API2/OpenId.pm | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
>> index 22423ba..9080865 100644
>> --- a/src/PVE/API2/OpenId.pm
>> +++ b/src/PVE/API2/OpenId.pm
>> @@ -97,6 +97,9 @@ __PACKAGE__->register_method ({
>> code => sub {
>> my ($param) = @_;
>>
>> + my $dcconf = PVE::Cluster::cfs_read_file('datacenter.cfg');
>> + local $ENV{all_proxy} = $dcconf->{http_proxy};
>> +
>> my $realm = extract_param($param, 'realm');
>> my $redirect_url = extract_param($param, 'redirect-url');
>>
>> @@ -149,6 +152,9 @@ __PACKAGE__->register_method ({
>>
>> my $res;
>> eval {
>> + my $dcconf = PVE::Cluster::cfs_read_file('datacenter.cfg');
>> + local $ENV{all_proxy} = $dcconf->{http_proxy};
>> +
>> my ($realm, $private_auth_state) = PVE::RS::OpenId::verify_public_auth_state(
>> $openid_state_path, $param->{'state'});
>>
>>
>
>
next prev parent reply other threads:[~2021-09-06 8:52 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-13 8:09 Fabian Grünbichler
2021-08-25 16:31 ` Thomas Lamprecht
2021-09-06 8:52 ` Fabian Grünbichler [this message]
2021-11-03 10:32 ` [pve-devel] applied: " Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1630917949.olp1i1j6ub.astroid@nora.none \
--to=f.gruenbichler@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=t.lamprecht@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox