From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 32E39757CC for ; Thu, 24 Jun 2021 10:18:13 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 23CE413F78 for ; Thu, 24 Jun 2021 10:18:13 +0200 (CEST) Received: from dev7.proxmox.com (unknown [94.136.29.99]) by firstgate.proxmox.com (Proxmox) with ESMTP id B4C1E13E98 for ; Thu, 24 Jun 2021 10:18:10 +0200 (CEST) Received: by dev7.proxmox.com (Postfix, from userid 0) id 7EFAB8041D; Thu, 24 Jun 2021 10:18:04 +0200 (CEST) From: Dietmar Maurer To: pve-devel@lists.proxmox.com Date: Thu, 24 Jun 2021 10:17:59 +0200 Message-Id: <20210624081802.2090614-2-dietmar@proxmox.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210624081802.2090614-1-dietmar@proxmox.com> References: <20210624081802.2090614-1-dietmar@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.607 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment PROLO_LEO2 0.1 Meta Catches all Leo drug variations so far RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH pve-manager] ui: implement OpenId login X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Jun 2021 08:18:13 -0000 --- PVE/HTTPServer.pm | 4 +- www/manager6/Utils.js | 8 +++ www/manager6/window/LoginWindow.js | 105 ++++++++++++++++++++++++++++- 3 files changed, 114 insertions(+), 3 deletions(-) diff --git a/PVE/HTTPServer.pm b/PVE/HTTPServer.pm index 636b562b..dabdf7f3 100755 --- a/PVE/HTTPServer.pm +++ b/PVE/HTTPServer.pm @@ -68,7 +68,9 @@ sub auth_handler { # explicitly allow some calls without auth if (($rel_uri eq '/access/domains' && $method eq 'GET') || - ($rel_uri eq '/access/ticket' && ($method eq 'GET' || $method eq 'POST'))) { + ($rel_uri eq '/access/ticket' && ($method eq 'GET' || $method eq 'POST')) || + ($rel_uri eq '/access/openid/login' && $method eq 'POST') || + ($rel_uri eq '/access/openid/auth-url' && $method eq 'POST')) { $require_auth = 0; } diff --git a/www/manager6/Utils.js b/www/manager6/Utils.js index 3415c9eb..c2d139f9 100644 --- a/www/manager6/Utils.js +++ b/www/manager6/Utils.js @@ -1742,6 +1742,14 @@ Ext.define('PVE.Utils', { return true; }, + + openid_login_param: function() { + let param = Ext.Object.fromQueryString(window.location.search); + if (param.state !== undefined && param.code !== undefined) { + return param; + } + return undefined; + }, }, singleton: true, diff --git a/www/manager6/window/LoginWindow.js b/www/manager6/window/LoginWindow.js index 72078080..5d3d06b8 100644 --- a/www/manager6/window/LoginWindow.js +++ b/www/manager6/window/LoginWindow.js @@ -2,6 +2,21 @@ Ext.define('PVE.window.LoginWindow', { extend: 'Ext.window.Window', + viewModel: { + data: { + openid: false, + }, + formulas: { + button_text: function(get) { + if (get("openid") === true) { + return gettext("Login (OpenID redirect)"); + } else { + return gettext("Login"); + } + }, + }, + }, + controller: { xclass: 'Ext.app.ViewController', @@ -18,6 +33,33 @@ Ext.define('PVE.window.LoginWindow', { return; } + let redirect_url = location.origin; + let params = form.getValues(); + + if (this.getViewModel().data.openid === true) { + let realm = params.realm; + Proxmox.Utils.API2Request({ + url: '/api2/extjs/access/openid/auth-url', + params: { + realm: realm, + "redirect-url": redirect_url, + }, + method: 'POST', + success: function(resp, opts) { + window.location = resp.result.data; + }, + failure: function(resp, opts) { + Proxmox.Utils.authClear(); + form.unmask(); + Ext.MessageBox.alert( + gettext('Error'), + gettext('OpenId redirect failed. Please try again
Error: ' + resp.htmlStatus), + ); + }, + }); + return; + } + view.el.mask(gettext('Please wait...'), 'x-mask-loading'); // set or clear username @@ -162,11 +204,21 @@ Ext.define('PVE.window.LoginWindow', { window.location.reload(); }, }, - 'button[reference=loginButton]': { + 'field[name=realm]': { + change: function(f, value) { + let record = f.store.getById(value); + if (record === undefined) return; + let data = record.data; + this.getViewModel().set("openid", data.type === "openid"); + }, + }, + 'button[reference=loginButton]': { click: 'onLogon', }, '#': { show: function() { + var me = this; + var sp = Ext.state.Manager.getProvider(); var checkboxField = this.lookupReference('saveunField'); var unField = this.lookupReference('usernameField'); @@ -180,6 +232,42 @@ Ext.define('PVE.window.LoginWindow', { var pwField = this.lookupReference('passwordField'); pwField.focus(); } + + let param = PVE.Utils.openid_login_param(); + if (param !== undefined) { + Proxmox.Utils.authClear(); + + let loginForm = this.lookupReference('loginForm'); + loginForm.mask(gettext('OpenID login - please wait...'), 'x-mask-loading'); + + let redirect_url = location.origin; + + Proxmox.Utils.API2Request({ + url: '/api2/extjs/access/openid/login', + params: { + state: param.state, + code: param.code, + "redirect-url": redirect_url, + }, + method: 'POST', + failure: function(response) { + loginForm.unmask(); + Ext.MessageBox.alert( + gettext('Error'), + gettext('Login failed. Please try again
Error: ' + response.htmlStatus), + function() { + window.location = redirect_url; + }, + ); + }, + success: function(response, options) { + loginForm.unmask(); + let data = response.result.data; + history.replaceState(null, '', redirect_url); + me.success(data); + }, + }); + } }, }, }, @@ -217,6 +305,10 @@ Ext.define('PVE.window.LoginWindow', { itemId: 'usernameField', reference: 'usernameField', stateId: 'login-username', + bind: { + visible: "{!openid}", + disabled: "{openid}", + }, }, { xtype: 'textfield', @@ -224,6 +316,10 @@ Ext.define('PVE.window.LoginWindow', { fieldLabel: gettext('Password'), name: 'password', reference: 'passwordField', + bind: { + visible: "{!openid}", + disabled: "{openid}", + }, }, { xtype: 'pmxRealmComboBox', @@ -248,9 +344,14 @@ Ext.define('PVE.window.LoginWindow', { labelWidth: 250, labelAlign: 'right', submitValue: false, + bind: { + visible: "{!openid}", + }, }, { - text: gettext('Login'), + bind: { + text: "{button_text}", + }, reference: 'loginButton', }, ], -- 2.30.2