PMG/LDAPConfig.pm

   1 package PMG::LDAPConfig;
   2
   3 use strict;
   4 use warnings;
   5 use MIME::Base64;
   6 use Data::Dumper;
   7
   8 use PVE::Tools;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::INotify;
  11 use PVE::SectionConfig;
  12
  13 use base qw(PVE::SectionConfig);
  14
  15 my $defaultData = {
  16     propertyList => {
  17         type => { description => "Section type." },
  18         section => {
  19             description => "Secion ID.",
  20             type => 'string', format => 'pve-configid',
  21         },
  22     },
  23 };
  24
  25 sub properties {
  26     return {
  27         mode => {
  28             description => "LDAP protocol mode ('ldap' or 'ldaps').",
  29             type => 'string',
  30             enum => ['ldap', 'ldaps'],
  31             default => 'ldap',
  32         },
  33         server1 => {
  34             description => "Server address.",
  35             type => 'string', format => 'address',
  36         },
  37         server2 => {
  38             description => "Fallback server address. Userd when the first server is not available.",
  39             type => 'string', format => 'address',
  40         },
  41         port => {
  42             description => "Specify the port to connect to.",
  43             type => 'integer',
  44             minimum => 1,
  45             maximum => 65535,
  46         },
  47         binddn => {
  48             description => "Bind domain name.",
  49             type => 'string',
  50         },
  51         bindpw => {
  52             description => "Bind password.",
  53             type => 'string',
  54         },
  55         basedn => {
  56             description => "Base domain name.",
  57             type => 'string',
  58         },
  59         groupbasedn => {
  60             description => "Base domain name for groups.",
  61             type => 'string',
  62         },
  63         filter => {
  64             description => "LDAP filter.",
  65             type => 'string',
  66         },
  67         accountattr => {
  68             description => "Account attribute name name.",
  69             type => 'string',
  70             pattern => '[a-zA-Z0-9]+',
  71             default => 'sAMAccountName',
  72         },
  73         mailattr => {
  74             description => "List of mail attribute names.",
  75             type => 'string', format => 'string-list',
  76             pattern => '[a-zA-Z0-9]+',
  77             default => "mail, userPrincipalName, proxyAddresses, othermailbox",
  78         },
  79     };
  80 }
  81
  82 sub options {
  83     return {
  84         server1 => {  optional => 0 },
  85         server2 => {  optional => 1 },
  86         port => { optional => 1 },
  87         mode => { optional => 1 },
  88         binddn => { optional => 1 },
  89         bindpw => { optional => 1 },
  90         basedn => { optional => 1 },
  91         groupbasedn => { optional => 1 },
  92         filter => { optional => 1 },
  93         accountattr => { optional => 1 },
  94         mailattr => { optional => 1 },
  95     };
  96 }
  97
  98 sub type {
  99     return 'ldap';
 100 }
 101
 102 sub private {
 103     return $defaultData;
 104 }
 105
 106 sub decode_value {
 107     my ($class, $type, $key, $value) = @_;
 108
 109     $value = decode_base64($value) if $key eq 'bindpw';
 110
 111     return $value;
 112 }
 113
 114 sub encode_value {
 115     my ($class, $type, $key, $value) = @_;
 116
 117     $value = encode_base64($value, '') if $key eq 'bindpw';
 118
 119     return $value;
 120 }
 121
 122 sub parse_section_header {
 123     my ($class, $line) = @_;
 124
 125     if ($line =~ m/^(\S+):\s*(\S+)\s*$/) {
 126         my ($type, $sectionId) = ($1, $2);
 127         my $errmsg = undef; # set if you want to skip whole section
 128         eval { PVE::JSONSchema::pve_verify_configid($sectionId); };
 129         $errmsg = $@ if $@;
 130         my $config = {}; # to return additional attributes
 131         return ($type, $sectionId, $errmsg, $config);
 132     }
 133     return undef;
 134 }
 135
 136 my $lockfile = "/var/lock/pmgldapconfig.lck";
 137
 138 sub lock_config {
 139     my ($code, $errmsg) = @_;
 140
 141     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
 142     if (my $err = $@) {
 143         $errmsg ? die "$errmsg: $err" : die $err;
 144     }
 145 }
 146
 147
 148 __PACKAGE__->register();
 149 __PACKAGE__->init();
 150
 151 sub read_pmg_ldap_conf {
 152     my ($filename, $fh) = @_;
 153
 154     local $/ = undef; # slurp mode
 155
 156     my $raw = <$fh>;
 157
 158     return __PACKAGE__->parse_config($filename, $raw);
 159 }
 160
 161 sub write_pmg_ldap_conf {
 162     my ($filename, $fh, $cfg) = @_;
 163
 164     my $raw = __PACKAGE__->write_config($filename, $cfg);
 165
 166     chmod(0600, $fh);
 167
 168     PVE::Tools::safe_print($filename, $fh, $raw);
 169 }
 170
 171 PVE::INotify::register_file('pmg-ldap.conf', "/etc/pmg/ldap.conf",
 172                             \&read_pmg_ldap_conf,
 173                             \&write_pmg_ldap_conf);
 174
 175
 176 1;