[PATCH cluster/access-control/manager/docs/proxmox 0/9] fix #7805: add a datacenter-wide API token policy

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

Compliance rules like PCI DSS, SOC 2, or ISO 27001 often require
that credentials have a limited lifetime, but there is no central way
to enforce that for API tokens.

Add an optional token-policy option to datacenter.cfg to require an
expiration date, limit the maximum token lifetime, forbid changing
the expiration date of existing tokens, and require privilege
separation.

The policy is only checked when a token is created or updated, and
only for values that actually change, so existing tokens stay valid even
if their lifetime exceeds a newly configured maximum one.
Extending the expiration date within the limit stays possible, unless
the opt-in 'disallow-expiry-changes' switch is set (see [0] for the
rationale).

The web UI exposes these options under Datacenter -> Options and
adjusts the token dialogs to the policy. Changing the policy requires
Sys.Modify on '/', like any other datacenter option; an extra
auth-specific privilege check was skipped for now, for the current
built-in roles it would land in the same roles as Sys.Modify, adding new
built-in roles here is IMO scope creep and this can still be done later
(with some more thoughts on how to handle all these datacenter options).

FWIW, the first manager patch (4/9 overall) fixes a pre-existing issue
w.r.t. only submitting the expiration date when changed, which the
policy checks would expose more often, but it'd also make sense on its
own and could be applied independently already.

The last two patches port the backend part to the common rust stack, so
PBS and PDM can opt in through their AccessControlConfig, and to prepare
moving pve-access-control over to rust later. Only the expiry parts
apply there, tokens in the rust stack always use separate ACLs, i.e. no
sharing with the underlying users there.

Dependencies: access-control needs the cluster patch, manager needs
both, and building manager needs the pve-doc-generator with the new
online-help anchor from the docs patch (or ALLOW_MISSING=1), which is
why the docs patch comes before the manager ones; the proxmox patches
are independent. d/control needs the respective versioned dependency
bumps added on applying, and the generated datacenter option reference
in pve-docs needs the usual make update once the cluster side is
packaged.

[0]: https://bugzilla.proxmox.com/show_bug.cgi?id=7805

cluster:

Thomas Lamprecht (1):
  datacenter config: add token-policy option

 src/PVE/DataCenterConfig.pm   | 51 ++++++++++++++++++++++++++++++
 src/test/Makefile             |  6 +++-
 src/test/test_token_policy.pl | 72 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 128 insertions(+), 1 deletion(-)

access-control:

Thomas Lamprecht (1):
  fix #7805: api: token: enforce datacenter token policy

 src/PVE/API2/User.pm              |  32 +++++-
 src/PVE/AccessControl.pm          |  59 +++++++++++
 src/test/Makefile                 |   2 +
 src/test/token-policy-api-test.pl | 102 ++++++++++++++++++
 src/test/token-policy-test.pl     | 217 ++++++++++++++++++++++++++++++++++++++
 5 files changed, 409 insertions(+), 3 deletions(-)

docs:

Thomas Lamprecht (1):
  user management: document the API token policy

 pveum.adoc | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

manager:

Thomas Lamprecht (4):
  ui: token edit: only submit the expiration date when changed
  api: cluster options: return token-policy without Sys.Audit
  ui: dc options: allow editing the API token policy
  ui: token edit: adapt to the datacenter API token policy

 PVE/API2/Cluster.pm           |   2 +-
 www/manager6/UIOptions.js     |  14 ++++-
 www/manager6/dc/OptionView.js | 108 +++++++++++++++++++++++++++++++++
 www/manager6/dc/TokenEdit.js  | 136 +++++++++++++++++++++++++++++++++++++++++-
 www/manager6/dc/TokenView.js  |  36 ++++++-----
 5 files changed, 278 insertions(+), 18 deletions(-)

proxmox:

Thomas Lamprecht (2):
  access-control: add API token policy type with expiry checks
  access-control: enforce token policy on token create and update

 proxmox-access-control/src/api/tokens.rs |  17 +++
 proxmox-access-control/src/init.rs       |  15 ++
 proxmox-access-control/src/types.rs      | 227 +++++++++++++++++++++++++++++++
 3 files changed, 259 insertions(+)

-- 
2.47.3