From: Dietmar Maurer <dietmar@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH pve-access-control v2 5/5] implement OpenID autocreate user feature
Date: Wed, 30 Jun 2021 08:10:07 +0200 [thread overview]
Message-ID: <20210630061007.3345396-6-dietmar@proxmox.com> (raw)
In-Reply-To: <20210630061007.3345396-1-dietmar@proxmox.com>
---
src/PVE/API2/OpenId.pm | 35 +++++++++++++++++++++++++++++++----
1 file changed, 31 insertions(+), 4 deletions(-)
diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index d0b29fc..8384729 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -9,9 +9,10 @@ use PVE::RS::OpenId;
use PVE::Exception qw(raise raise_perm_exc raise_param_exc);
use PVE::SafeSyslog;
use PVE::RPCEnvironment;
-use PVE::Cluster qw(cfs_read_file);
+use PVE::Cluster qw(cfs_read_file cfs_write_file);
use PVE::AccessControl;
use PVE::JSONSchema qw(get_standard_option);
+use PVE::Auth::Plugin;
use PVE::RESTHandler;
@@ -161,7 +162,7 @@ __PACKAGE__->register_method ({
die "missing openid claim 'sub'\n" if !defined($subject);
my $unique_name = $subject; # default
- if (defined(my $user_attr = $config->{'user-attr'})) {
+ if (defined(my $user_attr = $config->{'username-claim'})) {
if ($user_attr eq 'subject') {
$unique_name = $subject;
} elsif ($user_attr eq 'username') {
@@ -179,8 +180,34 @@ __PACKAGE__->register_method ({
my $username = "${unique_name}\@${realm}";
- # test if user exists and is enabled
- $rpcenv->check_user_enabled($username);
+ # first, check if $username respects our naming conventions
+ PVE::Auth::Plugin::verify_username($username);
+
+ if ($config->{'autocreate'} && !$rpcenv->check_user_exist($username, 1)) {
+ PVE::AccessControl::lock_user_config(sub {
+ my $usercfg = cfs_read_file("user.cfg");
+
+ die "user '$username' already exists\n" if $usercfg->{users}->{$username};
+
+ my $entry = { enable => 1 };
+ if (defined(my $email = $info->{'email'})) {
+ $entry->{email} = $email;
+ }
+ if (defined(my $given_name = $info->{'given_name'})) {
+ $entry->{firstname} = $given_name;
+ }
+ if (defined(my $family_name = $info->{'family_name'})) {
+ $entry->{lastname} = $family_name;
+ }
+
+ $usercfg->{users}->{$username} = $entry;
+
+ cfs_write_file("user.cfg", $usercfg);
+ }, "autocreate openid user failed");
+ } else {
+ # test if user exists and is enabled
+ $rpcenv->check_user_enabled($username);
+ }
my $ticket = PVE::AccessControl::assemble_ticket($username);
my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username);
--
2.30.2
next prev parent reply other threads:[~2021-06-30 6:10 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-30 6:10 [pve-devel] [PATCH pve-access-control v2 0/5] add OpenId realms Dietmar Maurer
2021-06-30 6:10 ` [pve-devel] [PATCH pve-access-control v2 1/5] check_user_enabled: also check if user is expired Dietmar Maurer
2021-06-30 7:28 ` Fabian Grünbichler
2021-06-30 6:10 ` [pve-devel] [PATCH pve-access-control v2 2/5] add OpenId configuration Dietmar Maurer
2021-06-30 6:10 ` [pve-devel] [PATCH pve-access-control v2 3/5] depend on libpve-rs-perl Dietmar Maurer
2021-06-30 6:10 ` [pve-devel] [PATCH pve-access-control v2 4/5] api: implement openid API Dietmar Maurer
2021-06-30 6:10 ` Dietmar Maurer [this message]
2021-07-01 11:38 ` [pve-devel] applied: [PATCH pve-access-control v2 0/5] add OpenId realms Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210630061007.3345396-6-dietmar@proxmox.com \
--to=dietmar@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox