From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id EE99471B5B for ; Wed, 30 Jun 2021 08:10:41 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id EA815160F9 for ; Wed, 30 Jun 2021 08:10:11 +0200 (CEST) Received: from dev7.proxmox.com (unknown [94.136.29.99]) by firstgate.proxmox.com (Proxmox) with ESMTP id 154F216073 for ; Wed, 30 Jun 2021 08:10:09 +0200 (CEST) Received: by dev7.proxmox.com (Postfix, from userid 0) id D31B180F3F; Wed, 30 Jun 2021 08:10:08 +0200 (CEST) From: Dietmar Maurer To: pve-devel@lists.proxmox.com Date: Wed, 30 Jun 2021 08:10:07 +0200 Message-Id: <20210630061007.3345396-6-dietmar@proxmox.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210630061007.3345396-1-dietmar@proxmox.com> References: <20210630061007.3345396-1-dietmar@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.568 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [openid.pm] Subject: [pve-devel] [PATCH pve-access-control v2 5/5] implement OpenID autocreate user feature X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Jun 2021 06:10:42 -0000 --- src/PVE/API2/OpenId.pm | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm index d0b29fc..8384729 100644 --- a/src/PVE/API2/OpenId.pm +++ b/src/PVE/API2/OpenId.pm @@ -9,9 +9,10 @@ use PVE::RS::OpenId; use PVE::Exception qw(raise raise_perm_exc raise_param_exc); use PVE::SafeSyslog; use PVE::RPCEnvironment; -use PVE::Cluster qw(cfs_read_file); +use PVE::Cluster qw(cfs_read_file cfs_write_file); use PVE::AccessControl; use PVE::JSONSchema qw(get_standard_option); +use PVE::Auth::Plugin; use PVE::RESTHandler; @@ -161,7 +162,7 @@ __PACKAGE__->register_method ({ die "missing openid claim 'sub'\n" if !defined($subject); my $unique_name = $subject; # default - if (defined(my $user_attr = $config->{'user-attr'})) { + if (defined(my $user_attr = $config->{'username-claim'})) { if ($user_attr eq 'subject') { $unique_name = $subject; } elsif ($user_attr eq 'username') { @@ -179,8 +180,34 @@ __PACKAGE__->register_method ({ my $username = "${unique_name}\@${realm}"; - # test if user exists and is enabled - $rpcenv->check_user_enabled($username); + # first, check if $username respects our naming conventions + PVE::Auth::Plugin::verify_username($username); + + if ($config->{'autocreate'} && !$rpcenv->check_user_exist($username, 1)) { + PVE::AccessControl::lock_user_config(sub { + my $usercfg = cfs_read_file("user.cfg"); + + die "user '$username' already exists\n" if $usercfg->{users}->{$username}; + + my $entry = { enable => 1 }; + if (defined(my $email = $info->{'email'})) { + $entry->{email} = $email; + } + if (defined(my $given_name = $info->{'given_name'})) { + $entry->{firstname} = $given_name; + } + if (defined(my $family_name = $info->{'family_name'})) { + $entry->{lastname} = $family_name; + } + + $usercfg->{users}->{$username} = $entry; + + cfs_write_file("user.cfg", $usercfg); + }, "autocreate openid user failed"); + } else { + # test if user exists and is enabled + $rpcenv->check_user_enabled($username); + } my $ticket = PVE::AccessControl::assemble_ticket($username); my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username); -- 2.30.2