From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
by lore.proxmox.com (Postfix) with ESMTPS id 4BD571FF162
for <inbox@lore.proxmox.com>; Sat, 8 Feb 2025 06:42:53 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 8763118685;
Sat, 8 Feb 2025 06:42:48 +0100 (CET)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1738993360; x=1739598160;
h=content-transfer-encoding:mime-version:references:in-reply-to
:message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to;
bh=QtTxTnEuJjh39h5bC5XJlJjm4fd7/QclgHMfOK11Bb0=;
b=HsoCTNuZSnB6/y0r42aAF0i2CyUl7a3XPm6y65m7c8sDYw8fPm2+27ZKspdiiEyv7S
PUeB5kZqfmWrLSSGw9SJPwH2cXEXX5vFfbBsSJs/uMqDkxBlFX3mG7VwDsTcMWocB+0I
kHj575HHDw6SGnJORiD3H0j8TenDDc+9YU2U9fZm1DeomHQe2WPLamKvZcJMwFRz1gcK
mylZXaQICNd3By8O1HfmRaSf8olAnxPiRMVzJHBPF4KKYAbzFxbgFyF5Wgt03B7H4p4Z
YqrRw8KHS/NRzzZbCtsGQULg9ora7GWlu012MugfqSEQTeMojlNUIMV4Qv5lZ48hwsSR
uyvw==
X-Gm-Message-State: AOJu0Yy6MektrhysCL1haq2TeP+Y9bRNuR6+AxHm2HAhPjAdX+OY169h
YxfhFb2bOMcVZl1rFy+aDXBSuGjSxuHjVdUOjUjMZVJRb5fvMALVMoz07A==
X-Gm-Gg: ASbGncvDDrNMcrEPNajFkz73+9wXkCMvrx74kcg17zZnA6xyaRxy9aFC14nUdjHyoZO
lm30c2BJgw6p8Lpo8395LxkpszcvtycjlNOIzHfKNHy9P+vRyzAR7x42kBsijA91/fgQjhYWc+X
v1ayWqbdWyKMx/AU10jhP6l/jG4G/Rbco2NsyIZ7+RLY1nNK4KYIZyDpsblLGmK8roXzLQHLQkm
Jp4zfG+4AGZDwOGHXd929DY2RqSooLc18O1r+BHmQpzurJdwoQoO2TwP0hZUJV6+z0AxuYPj1gl
0KnG1slgeA4Z72bhcJ6YQVVhm10IPFZRvJdmh7Gs38pQGEJYVKeHYu44PWgERuCFaj/7+QJGzVG
c80GQmVAP4ag2BGITL6yJXfWYoTcj
X-Google-Smtp-Source: AGHT+IGNKWdfJR7q0H77IaNkjxILRDtCiT6fKtq+iex9Gag/ITg1HL4ZOlV05hzluj7WUF969AzSqA==
X-Received: by 2002:a05:6902:1886:b0:e58:a918:fdd0 with SMTP id
3f1490d57ef6-e5b46178224mr5008071276.4.1738993359674;
Fri, 07 Feb 2025 21:42:39 -0800 (PST)
From: Thomas Skinner <thomas@atskinner.net>
To: pve-devel@lists.proxmox.com
Date: Fri, 7 Feb 2025 23:42:07 -0600
Message-Id: <20250208054209.598307-4-thomas@atskinner.net>
X-Mailer: git-send-email 2.39.5
In-Reply-To: <20250208054209.598307-1-thomas@atskinner.net>
References: <20250208054209.598307-1-thomas@atskinner.net>
MIME-Version: 1.0
X-SPAM-LEVEL: Spam detection results: 0
AWL -0.028 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
DMARC_MISSING 0.1 Missing DMARC policy
FREEMAIL_FORGED_FROMDOMAIN 0.001 2nd level domains in From and EnvelopeFrom
freemail headers are different
FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider
HEADER_FROM_DIFFERENT_DOMAINS 0.07 From and EnvelopeFrom 2nd level mail
domains are different
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/,
no trust RCVD_IN_MSPIKE_H2 0.001 Average reputation (+2)
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
Subject: [pve-devel] [PATCH access-control v3 1/1] fix #4234: add library
functions for openid optional userinfo request
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Cc: Thomas Skinner <thomas@atskinner.net>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: pve-devel-bounces@lists.proxmox.com
Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com>
Signed-off-by: Thomas Skinner <thomas@atskinner.net>
---
src/PVE/API2/OpenId.pm | 6 +++++-
src/PVE/Auth/OpenId.pm | 7 +++++++
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index 77410e6..456e96a 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -170,7 +170,11 @@ __PACKAGE__->register_method ({
my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
- my $info = $openid->verify_authorization_code($param->{code}, $private_auth_state);
+ my $info = $openid->verify_authorization_code(
+ $param->{code},
+ $private_auth_state,
+ $config->{'disable-userinfo'} // 0,
+ );
my $subject = $info->{'sub'};
my $unique_name;
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index c8e4db9..6efa696 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -63,6 +63,12 @@ sub properties {
pattern => '^[^\x00-\x1F\x7F <>#"]*$', # Prohibit characters not allowed in URI RFC 2396.
optional => 1,
},
+ "disable-userinfo" => {
+ description => "Prevents querying the userinfo endpoint for claims values.",
+ type => 'boolean',
+ default => 0,
+ optional => 1,
+ },
};
}
@@ -78,6 +84,7 @@ sub options {
"acr-values" => { optional => 1 },
default => { optional => 1 },
comment => { optional => 1 },
+ "disable-userinfo" => { optional => 1 },
};
}
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel