public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* [pve-devel] [PATCH access-control/manager 0/2] ldap: check bind connection on realm add/update
@ 2023-07-27 13:33 Christoph Heiss
  2023-07-27 13:33 ` [pve-devel] [PATCH access-control 1/2] api: domains: add off-by-default `check-connection` parameter Christoph Heiss
  2023-07-27 13:33 ` [pve-devel] [PATCH manager 2/2] ui: ldap: add 'Check connection' checkbox as advanced option Christoph Heiss
  0 siblings, 2 replies; 7+ messages in thread
From: Christoph Heiss @ 2023-07-27 13:33 UTC (permalink / raw)
  To: pve-devel

First of, this removes the dreaded LDAP DN regex.

Further, upon saving a LDAP realm in the UI, it tries to connect & bind
using the provided credentials, providing the user with immediate
feedback whether they are valid or not.

The same approach is already implemented in PBS [0], and I'll plan to
implement the same for PMG too, if & when the PVE side is done.

Testing
-------
Changes were tested against slapd 2.5.13+dfsg-5, using both the web UI
and `pveum` to create and update realms with different combinations of
valid and invalid parameters, mixed with using new `check-connection`
parameter.

Prior art
---------
This completely supersedes the previous series [1].

This series is a complete new approach to it (also why this also isn't
marked as v3), which previously tried to solve this using a new schema
format by validated DNs using Net::LDAP::Util::canonical_dn(). But this
has the problem that it does not support AD-specific DN syntax.

After a off-list discussion with Lukas (summary [2]), it was decided to
rather implement it much like PBS does it - simply drop the explicit
validation of DN parameters, instead just trying to connect & bind to
the target server - although I'm always open for other/better
suggestions to tackle this.

[0] https://git.proxmox.com/?p=proxmox-backup.git;a=commitdiff;h=5210f3b5
[1] https://lists.proxmox.com/pipermail/pve-devel/2023-July/058392.html
[2] https://lists.proxmox.com/pipermail/pve-devel/2023-July/058540.html

--
2.41.0





^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2023-08-01  9:19 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-27 13:33 [pve-devel] [PATCH access-control/manager 0/2] ldap: check bind connection on realm add/update Christoph Heiss
2023-07-27 13:33 ` [pve-devel] [PATCH access-control 1/2] api: domains: add off-by-default `check-connection` parameter Christoph Heiss
2023-07-28  8:29   ` Lukas Wagner
2023-08-01  9:17     ` Christoph Heiss
2023-07-27 13:33 ` [pve-devel] [PATCH manager 2/2] ui: ldap: add 'Check connection' checkbox as advanced option Christoph Heiss
2023-07-28  8:37   ` Lukas Wagner
2023-08-01  9:18     ` Christoph Heiss

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal