From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 7B1CE614E6 for ; Fri, 4 Feb 2022 15:25:33 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 6B56D32F3A for ; Fri, 4 Feb 2022 15:25:03 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 5164B32F1D for ; Fri, 4 Feb 2022 15:25:02 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 2B7B644BDB for ; Fri, 4 Feb 2022 15:25:02 +0100 (CET) From: Dominik Csapak To: pve-devel@lists.proxmox.com Date: Fri, 4 Feb 2022 15:25:00 +0100 Message-Id: <20220204142501.1461441-3-d.csapak@proxmox.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220204142501.1461441-1-d.csapak@proxmox.com> References: <20220204142501.1461441-1-d.csapak@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.160 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH access-control v2 2/2] fix #3668: realm-sync: add mode 'sync' X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 14:25:33 -0000 this mode behaves like the 'update' mode (so it updates users with new data from the server, and adds new users), but also deletes users and groups that do not exist anymore on the sync source. this way, an admin can add custom data (e.g. keys) to the users in pve while keeping only the users available at the source without having to manage those attributes there Signed-off-by: Dominik Csapak --- src/PVE/API2/Domains.pm | 6 ++++-- src/PVE/Auth/Plugin.pm | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/PVE/API2/Domains.pm b/src/PVE/API2/Domains.pm index 2f351ad..e1280c0 100644 --- a/src/PVE/API2/Domains.pm +++ b/src/PVE/API2/Domains.pm @@ -313,10 +313,12 @@ my $update_users = sub { my $users = $usercfg->{users}; my $oldusers = {}; - if ($opts->{mode} eq 'full') { + if ($opts->{mode} eq 'full' || $opts->{mode} eq 'sync') { print "deleting outdated existing users first\n"; foreach my $userid (sort keys %$users) { next if $userid !~ m/\@$realm$/; + # keep users (and their fields) in 'sync' mode + next if $opts->{mode} eq 'sync' && defined($synced_users->{$userid}); $oldusers->{$userid} = delete $users->{$userid}; if ($opts->{'purge'} && !$synced_users->{$userid}) { @@ -367,7 +369,7 @@ my $update_groups = sub { my $groups = $usercfg->{groups}; my $oldgroups = {}; - if ($opts->{mode} eq 'full') { + if ($opts->{mode} eq 'full' || $opts->{mode} eq 'sync') { print "deleting outdated existing groups first\n"; foreach my $groupid (sort keys %$groups) { next if $groupid !~ m/\-$realm$/; diff --git a/src/PVE/Auth/Plugin.pm b/src/PVE/Auth/Plugin.pm index 8a60062..24c1865 100755 --- a/src/PVE/Auth/Plugin.pm +++ b/src/PVE/Auth/Plugin.pm @@ -58,11 +58,12 @@ my $realm_sync_options_desc = { }, mode => { description => "Update (Default): Only updates/adds fields/users returned by the server. " + ."Sync: Updates/adds fields/users from the server and deletes vanished users. " ."Full: Removes any field/user that was not returned and overwrites all " ."existing users with information from the server. " ."If set, this parameter supersedes the parameter 'full'.", type => 'string', - enum => [qw(update full)], + enum => [qw(update sync full)], optional => '1', }, # TODO check/rewrite in pve7to8, and remove with 8.0 -- 2.30.2