From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <d.csapak@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by lists.proxmox.com (Postfix) with ESMTPS id 7B1CE614E6
 for <pve-devel@lists.proxmox.com>; Fri,  4 Feb 2022 15:25:33 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
 by firstgate.proxmox.com (Proxmox) with ESMTP id 6B56D32F3A
 for <pve-devel@lists.proxmox.com>; Fri,  4 Feb 2022 15:25:03 +0100 (CET)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
 [94.136.29.106])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by firstgate.proxmox.com (Proxmox) with ESMTPS id 5164B32F1D
 for <pve-devel@lists.proxmox.com>; Fri,  4 Feb 2022 15:25:02 +0100 (CET)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
 by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 2B7B644BDB
 for <pve-devel@lists.proxmox.com>; Fri,  4 Feb 2022 15:25:02 +0100 (CET)
From: Dominik Csapak <d.csapak@proxmox.com>
To: pve-devel@lists.proxmox.com
Date: Fri,  4 Feb 2022 15:25:00 +0100
Message-Id: <20220204142501.1461441-3-d.csapak@proxmox.com>
X-Mailer: git-send-email 2.30.2
In-Reply-To: <20220204142501.1461441-1-d.csapak@proxmox.com>
References: <20220204142501.1461441-1-d.csapak@proxmox.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-SPAM-LEVEL: Spam detection results:  0
 AWL 0.160 Adjusted score from AWL reputation of From: address
 BAYES_00                 -1.9 Bayes spam probability is 0 to 1%
 KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
 SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
 SPF_PASS               -0.001 SPF: sender matches SPF record
 T_SCC_BODY_TEXT_LINE    -0.01 -
Subject: [pve-devel] [PATCH access-control v2 2/2] fix #3668: realm-sync:
 add mode 'sync'
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, 
 <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, 
 <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Fri, 04 Feb 2022 14:25:33 -0000

this mode behaves like the 'update' mode (so it updates users with
new data from the server, and adds new users), but also deletes
users and groups that do not exist anymore on the sync source.

this way, an admin can add custom data (e.g. keys) to the users in pve while
keeping only the users available at the source without having
to manage those attributes there

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 src/PVE/API2/Domains.pm | 6 ++++--
 src/PVE/Auth/Plugin.pm  | 3 ++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/PVE/API2/Domains.pm b/src/PVE/API2/Domains.pm
index 2f351ad..e1280c0 100644
--- a/src/PVE/API2/Domains.pm
+++ b/src/PVE/API2/Domains.pm
@@ -313,10 +313,12 @@ my $update_users = sub {
     my $users = $usercfg->{users};
 
     my $oldusers = {};
-    if ($opts->{mode} eq 'full') {
+    if ($opts->{mode} eq 'full' || $opts->{mode} eq 'sync') {
 	print "deleting outdated existing users first\n";
 	foreach my $userid (sort keys %$users) {
 	    next if $userid !~ m/\@$realm$/;
+	    # keep users (and their fields) in 'sync' mode
+	    next if $opts->{mode} eq 'sync' && defined($synced_users->{$userid});
 
 	    $oldusers->{$userid} = delete $users->{$userid};
 	    if ($opts->{'purge'} && !$synced_users->{$userid}) {
@@ -367,7 +369,7 @@ my $update_groups = sub {
     my $groups = $usercfg->{groups};
     my $oldgroups = {};
 
-    if ($opts->{mode} eq 'full') {
+    if ($opts->{mode} eq 'full' || $opts->{mode} eq 'sync') {
 	print "deleting outdated existing groups first\n";
 	foreach my $groupid (sort keys %$groups) {
 	    next if $groupid !~ m/\-$realm$/;
diff --git a/src/PVE/Auth/Plugin.pm b/src/PVE/Auth/Plugin.pm
index 8a60062..24c1865 100755
--- a/src/PVE/Auth/Plugin.pm
+++ b/src/PVE/Auth/Plugin.pm
@@ -58,11 +58,12 @@ my $realm_sync_options_desc = {
     },
     mode => {
 	description => "Update (Default): Only updates/adds fields/users returned by the server. "
+	    ."Sync: Updates/adds fields/users from the server and deletes vanished users. "
 	    ."Full: Removes any field/user that was not returned and overwrites all "
 	    ."existing users with information from the server. "
 	    ."If set, this parameter supersedes the parameter 'full'.",
 	type => 'string',
-	enum => [qw(update full)],
+	enum => [qw(update sync full)],
 	optional => '1',
     },
     # TODO check/rewrite in pve7to8, and remove with 8.0
-- 
2.30.2