]>
git.proxmox.com Git - pmg-api.git/blob - PMG/LDAPConfig.pm
1 package PMG
::LDAPConfig
;
9 use PVE
::JSONSchema
qw(get_standard_option);
11 use PVE
::SectionConfig
;
13 use base
qw(PVE::SectionConfig);
15 PVE
::JSONSchema
::register_format
('ldap-simple-attr', \
&verify_ldap_simple_attr
);
16 sub verify_ldap_simple_attr
{
17 my ($attr, $noerr) = @_;
19 if ($attr =~ m/^[a-zA-Z0-9]+$/) {
23 die "value '$attr' does not look like a simple ldap attribute name\n" if !$noerr;
28 my $inotify_file_id = 'pmg-ldap.conf';
29 my $config_filename = '/etc/pmg/ldap.conf';
33 type
=> { description
=> "Section type." },
35 description
=> "Profile ID.",
36 type
=> 'string', format
=> 'pve-configid',
45 description
=> "Flag to disable/deactivate the entry.",
50 description
=> "Description.",
56 description
=> "LDAP protocol mode ('ldap', 'ldaps' or 'ldap+starttls').",
58 enum
=> ['ldap', 'ldaps', 'ldap+starttls'],
62 description
=> "Verify server certificate. Only useful with ldaps or ldap+starttls.",
68 description
=> "Path to CA file. Only useful with option 'verify'",
73 description
=> "Server address.",
74 type
=> 'string', format
=> 'address',
78 description
=> "Fallback server address. Userd when the first server is not available.",
79 type
=> 'string', format
=> 'address',
83 description
=> "Specify the port to connect to.",
89 description
=> "Bind domain name.",
93 description
=> "Bind password.",
97 description
=> "Base domain name.",
101 description
=> "Base domain name for groups.",
105 description
=> "LDAP filter.",
109 description
=> "Account attribute name name.",
110 type
=> 'string', format
=> 'ldap-simple-attr-list',
111 default => 'sAMAccountName, uid',
114 description
=> "List of mail attribute names.",
115 type
=> 'string', format
=> 'ldap-simple-attr-list',
116 default => "mail, userPrincipalName, proxyAddresses, othermailbox, mailAlternativeAddress",
119 description
=> "List of objectclasses for groups.",
120 type
=> 'string', format
=> 'ldap-simple-attr-list',
121 default => "group, univentionGroup, ipausergroup",
128 disable
=> { optional
=> 1 },
129 comment
=> { optional
=> 1 },
130 server1
=> { optional
=> 0 },
131 server2
=> { optional
=> 1 },
132 port
=> { optional
=> 1 },
133 mode
=> { optional
=> 1 },
134 binddn
=> { optional
=> 1 },
135 bindpw
=> { optional
=> 1 },
136 basedn
=> { optional
=> 1 },
137 groupbasedn
=> { optional
=> 1 },
138 filter
=> { optional
=> 1 },
139 accountattr
=> { optional
=> 1 },
140 mailattr
=> { optional
=> 1 },
141 groupclass
=> { optional
=> 1 },
142 verify
=> { optional
=> 1 },
143 cafile
=> { optional
=> 1 },
155 sub parse_section_header
{
156 my ($class, $line) = @_;
158 if ($line =~ m/^(\S+):\s*(\S+)\s*$/) {
159 my ($type, $profileId) = ($1, $2);
160 my $errmsg = undef; # set if you want to skip whole section
161 eval { PVE
::JSONSchema
::pve_verify_configid
($profileId); };
163 my $config = {}; # to return additional attributes
164 return ($type, $profileId, $errmsg, $config);
170 my ($class, $filename, $raw) = @_;
172 my $cfg = $class->SUPER::parse_config
($filename, $raw);
174 foreach my $profile (keys %{$cfg->{ids
}}) {
175 my $data = $cfg->{ids
}->{$profile};
177 $data->{comment
} = PVE
::Tools
::decode_text
($data->{comment
})
178 if defined($data->{comment
});
180 $data->{bindpw
} = decode_base64
($data->{bindpw
})
181 if defined($data->{bindpw
});
188 my ($class, $filename, $cfg) = @_;
190 foreach my $profile (keys %{$cfg->{ids
}}) {
191 my $data = $cfg->{ids
}->{$profile};
193 $data->{comment
} = PVE
::Tools
::encode_text
($data->{comment
})
194 if defined($data->{comment
});
196 $data->{bindpw
} = encode_base64
($data->{bindpw
}, '')
197 if defined($data->{bindpw
});
200 $class->SUPER::write_config
($filename, $cfg);
206 my $class = ref($type) || $type;
208 my $cfg = PVE
::INotify
::read_file
($inotify_file_id);
210 return bless $cfg, $class;
216 PVE
::INotify
::write_file
($inotify_file_id, $self);
219 my $lockfile = "/var/lock/pmgldapconfig.lck";
222 my ($code, $errmsg) = @_;
224 my $p = PVE
::Tools
::lock_file
($lockfile, undef, $code);
226 $errmsg ?
die "$errmsg: $err" : die $err;
231 __PACKAGE__-
>register();
234 sub read_pmg_ldap_conf
{
235 my ($filename, $fh) = @_;
237 local $/ = undef; # slurp mode
239 my $raw = defined($fh) ?
<$fh> : '';
241 return __PACKAGE__-
>parse_config($filename, $raw);
244 sub write_pmg_ldap_conf
{
245 my ($filename, $fh, $cfg) = @_;
247 my $raw = __PACKAGE__-
>write_config($filename, $cfg);
249 my $gid = getgrnam('www-data');
253 PVE
::Tools
::safe_print
($filename, $fh, $raw);
256 PVE
::INotify
::register_file
($inotify_file_id, $config_filename,
257 \
&read_pmg_ldap_conf
,
258 \
&write_pmg_ldap_conf
,
260 always_call_parser
=> 1);