public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* [pve-devel] [PATCH common/access-control 0/5] improve LDAP DN and bind creds checking on creation/change
@ 2023-07-19 15:51 Christoph Heiss
  2023-07-19 15:51 ` [pve-devel] [PATCH common 1/5] schema: add `ldap-dn` format for validating LDAP distinguished names Christoph Heiss
                   ` (5 more replies)
  0 siblings, 6 replies; 8+ messages in thread
From: Christoph Heiss @ 2023-07-19 15:51 UTC (permalink / raw)
  To: pve-devel

tl;dr implements the result of the discussion in [0].

First, this removes the dreaded LDAP DN regex, replacing it instead with
a proper schema format, which does validation using
Net::LDAP::Util::canonical_dn().

Further, upon saving a LDAP realm in the UI, it tries to connect & bind
using the provided credentials, providing the user with immediate
feedback whether they are valid or not.

The same approach is already implemented in PBS [1].

Changes was done against slapd 2.5.13+dfsg-5.

[0] https://lists.proxmox.com/pipermail/pve-devel/2023-May/056839.html
[1] https://git.proxmox.com/?p=proxmox-backup.git;a=commitdiff;h=5210f3b5
[1] https://lists.proxmox.com/pipermail/pbs-devel/2023-June/006237.html

pve-common:

Christoph Heiss (3):
  schema: add `ldap-dn` format for validating LDAP distinguished names
  test: add test cases for new 'ldap-dn' schema format
  ldap: handle errors explicitly everywhere instead of simply `die`ing

 debian/control              |  2 ++
 src/PVE/JSONSchema.pm       | 12 +++++++++
 src/PVE/LDAP.pm             | 11 ++++----
 test/Makefile               |  9 +++++++
 test/ldap_dn_format_test.pl | 54 +++++++++++++++++++++++++++++++++++++
 5 files changed, 83 insertions(+), 5 deletions(-)

pve-access-control:

Christoph Heiss (2):
  ldap: validate LDAP DNs using the `ldap-dn` schema format
  ldap: check bind credentials with LDAP directory directly on change

 src/PVE/Auth/LDAP.pm | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

--
2.41.0





^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2023-07-20 13:30 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-19 15:51 [pve-devel] [PATCH common/access-control 0/5] improve LDAP DN and bind creds checking on creation/change Christoph Heiss
2023-07-19 15:51 ` [pve-devel] [PATCH common 1/5] schema: add `ldap-dn` format for validating LDAP distinguished names Christoph Heiss
2023-07-19 15:51 ` [pve-devel] [PATCH common 2/5] test: add test cases for new 'ldap-dn' schema format Christoph Heiss
2023-07-19 15:51 ` [pve-devel] [PATCH common 3/5] ldap: handle errors explicitly everywhere instead of simply `die`ing Christoph Heiss
2023-07-19 15:51 ` [pve-devel] [PATCH access-control 4/5] ldap: validate LDAP DNs using the `ldap-dn` schema format Christoph Heiss
2023-07-19 15:51 ` [pve-devel] [PATCH access-control 5/5] ldap: check bind credentials with LDAP directory directly on change Christoph Heiss
2023-07-20 12:42 ` [pve-devel] [PATCH common/access-control 0/5] improve LDAP DN and bind creds checking on creation/change Friedrich Weber
2023-07-20 13:30   ` Christoph Heiss

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal