From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 77E78757E5 for ; Thu, 24 Jun 2021 10:18:42 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 6E03A13EE2 for ; Thu, 24 Jun 2021 10:18:12 +0200 (CEST) Received: from dev7.proxmox.com (unknown [94.136.29.99]) by firstgate.proxmox.com (Proxmox) with ESMTP id B894413E9C for ; Thu, 24 Jun 2021 10:18:10 +0200 (CEST) Received: by dev7.proxmox.com (Postfix, from userid 0) id 7D03E809C9; Thu, 24 Jun 2021 10:18:04 +0200 (CEST) From: Dietmar Maurer To: pve-devel@lists.proxmox.com Date: Thu, 24 Jun 2021 10:17:58 +0200 Message-Id: <20210624081802.2090614-1-dietmar@proxmox.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.661 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH pve-access-control 1/4] add OpenId configuration X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Jun 2021 08:18:42 -0000 --- src/PVE/AccessControl.pm | 2 ++ src/PVE/Auth/Makefile | 3 +- src/PVE/Auth/OpenId.pm | 67 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 71 insertions(+), 1 deletion(-) create mode 100755 src/PVE/Auth/OpenId.pm diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index 2569a35..8efb89d 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -24,6 +24,7 @@ use PVE::Auth::AD; use PVE::Auth::LDAP; use PVE::Auth::PVE; use PVE::Auth::PAM; +use PVE::Auth::OpenId; # load and initialize all plugins @@ -31,6 +32,7 @@ PVE::Auth::AD->register(); PVE::Auth::LDAP->register(); PVE::Auth::PVE->register(); PVE::Auth::PAM->register(); +PVE::Auth::OpenId->register(); PVE::Auth::Plugin->init(); # $authdir must be writable by root only! diff --git a/src/PVE/Auth/Makefile b/src/PVE/Auth/Makefile index 58ae362..be7bde3 100644 --- a/src/PVE/Auth/Makefile +++ b/src/PVE/Auth/Makefile @@ -4,7 +4,8 @@ AUTH_SOURCES= \ PVE.pm \ PAM.pm \ AD.pm \ - LDAP.pm + LDAP.pm \ + OpenId.pm .PHONY: install install: diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm new file mode 100755 index 0000000..8f35575 --- /dev/null +++ b/src/PVE/Auth/OpenId.pm @@ -0,0 +1,67 @@ +package PVE::Auth::OpenId; + +use strict; +use warnings; + +use PVE::Tools; +use PVE::Auth::Plugin; +use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file); + +use base qw(PVE::Auth::Plugin); + +sub type { + return 'openid'; +} + +sub properties { + return { + "issuer-url" => { + description => "OpenID Issuer Url", + type => 'string', + maxLength => 256, + }, + "client-id" => { + description => "OpenID Client ID", + type => 'string', + maxLength => 256, + }, + "client-key" => { + description => "OpenID Client Key", + type => 'string', + optional => 1, + maxLength => 256, + }, + autocreate => { + description => "Automatically create users if they do not exist.", + optional => 1, + type => 'boolean', + default => 0, + }, + "user-attr" => { + type => 'string', + enum => ['subject', 'username', 'email'], + optional => 1, + }, + }; +} + +sub options { + return { + "issuer-url" => {}, + "client-id" => {}, + "client-key" => { optional => 1 }, + autocreate => { optional => 1 }, + "user-attr" => { optional => 1, fixed => 1 }, + default => { optional => 1 }, + comment => { optional => 1 }, + }; +} + +sub authenticate_user { + my ($class, $config, $realm, $username, $password) = @_; + + die "OpenID realm does not allow password verification.\n"; +} + + +1; -- 2.30.2