PMG/LDAPConfig.pm

   1 package PMG::LDAPConfig;
   2
   3 use strict;
   4 use warnings;
   5 use MIME::Base64;
   6 use Data::Dumper;
   7
   8 use PVE::Tools;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::INotify;
  11 use PVE::SectionConfig;
  12
  13 use base qw(PVE::SectionConfig);
  14
  15 my $defaultData = {
  16     propertyList => {
  17         type => { description => "Section type." },
  18         section => {
  19             description => "Secion ID.",
  20             type => 'string', format => 'pve-configid',
  21         },
  22     },
  23 };
  24
  25 sub properties {
  26     return {
  27         disable => {
  28             description => "Flag to disable/deactivate the entry.",
  29             type => 'boolean',
  30             optional => 1,
  31         },
  32         comment => {
  33             description => "Description.",
  34             type => 'string',
  35             optional => 1,
  36             maxLength => 4096,
  37         },
  38         mode => {
  39             description => "LDAP protocol mode ('ldap' or 'ldaps').",
  40             type => 'string',
  41             enum => ['ldap', 'ldaps'],
  42             default => 'ldap',
  43         },
  44         server1 => {
  45             description => "Server address.",
  46             type => 'string', format => 'address',
  47             maxLength => 256,
  48         },
  49         server2 => {
  50             description => "Fallback server address. Userd when the first server is not available.",
  51             type => 'string', format => 'address',
  52             maxLength => 256,
  53         },
  54         port => {
  55             description => "Specify the port to connect to.",
  56             type => 'integer',
  57             minimum => 1,
  58             maximum => 65535,
  59         },
  60         binddn => {
  61             description => "Bind domain name.",
  62             type => 'string',
  63         },
  64         bindpw => {
  65             description => "Bind password.",
  66             type => 'string',
  67         },
  68         basedn => {
  69             description => "Base domain name.",
  70             type => 'string',
  71         },
  72         groupbasedn => {
  73             description => "Base domain name for groups.",
  74             type => 'string',
  75         },
  76         filter => {
  77             description => "LDAP filter.",
  78             type => 'string',
  79         },
  80         accountattr => {
  81             description => "Account attribute name name.",
  82             type => 'string',
  83             pattern => '[a-zA-Z0-9]+',
  84             default => 'sAMAccountName',
  85         },
  86         mailattr => {
  87             description => "List of mail attribute names.",
  88             type => 'string', format => 'string-list',
  89             pattern => '[a-zA-Z0-9]+',
  90             default => "mail, userPrincipalName, proxyAddresses, othermailbox",
  91         },
  92     };
  93 }
  94
  95 sub options {
  96     return {
  97         comment => { optional => 1 },
  98         server1 => {  optional => 0 },
  99         server2 => {  optional => 1 },
 100         port => { optional => 1 },
 101         mode => { optional => 1 },
 102         binddn => { optional => 1 },
 103         bindpw => { optional => 1 },
 104         basedn => { optional => 1 },
 105         groupbasedn => { optional => 1 },
 106         filter => { optional => 1 },
 107         accountattr => { optional => 1 },
 108         mailattr => { optional => 1 },
 109     };
 110 }
 111
 112 sub type {
 113     return 'ldap';
 114 }
 115
 116 sub private {
 117     return $defaultData;
 118 }
 119
 120 sub parse_section_header {
 121     my ($class, $line) = @_;
 122
 123     if ($line =~ m/^(\S+):\s*(\S+)\s*$/) {
 124         my ($type, $sectionId) = ($1, $2);
 125         my $errmsg = undef; # set if you want to skip whole section
 126         eval { PVE::JSONSchema::pve_verify_configid($sectionId); };
 127         $errmsg = $@ if $@;
 128         my $config = {}; # to return additional attributes
 129         return ($type, $sectionId, $errmsg, $config);
 130     }
 131     return undef;
 132 }
 133
 134 sub parse_config {
 135     my ($class, $filename, $raw) = @_;
 136
 137     my $cfg = $class->SUPER::parse_config($filename, $raw);
 138
 139     foreach my $section (keys %{$cfg->{ids}}) {
 140         my $data = $cfg->{ids}->{$section};
 141
 142         $data->{comment} = PVE::Tools::decode_text($data->{comment})
 143             if defined($data->{comment});
 144
 145         $data->{bindpw} = decode_base64($data->{bindpw})
 146             if defined($data->{bindpw});
 147     }
 148
 149     return $cfg;
 150 }
 151
 152 sub write_config {
 153     my ($class, $filename, $cfg) = @_;
 154
 155     foreach my $section (keys %{$cfg->{ids}}) {
 156         my $data = $cfg->{ids}->{$section};
 157
 158         $data->{comment} = PVE::Tools::encode_text($data->{comment})
 159             if defined($data->{comment});
 160
 161         $data->{bindpw} = encode_base64($data->{bindpw}, '')
 162             if defined($data->{bindpw});
 163     }
 164
 165     $class->SUPER::write_config($filename, $cfg);
 166 }
 167
 168 my $lockfile = "/var/lock/pmgldapconfig.lck";
 169
 170 sub lock_config {
 171     my ($code, $errmsg) = @_;
 172
 173     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
 174     if (my $err = $@) {
 175         $errmsg ? die "$errmsg: $err" : die $err;
 176     }
 177 }
 178
 179
 180 __PACKAGE__->register();
 181 __PACKAGE__->init();
 182
 183 sub read_pmg_ldap_conf {
 184     my ($filename, $fh) = @_;
 185
 186     local $/ = undef; # slurp mode
 187
 188     my $raw = <$fh>;
 189
 190     return __PACKAGE__->parse_config($filename, $raw);
 191 }
 192
 193 sub write_pmg_ldap_conf {
 194     my ($filename, $fh, $cfg) = @_;
 195
 196     my $raw = __PACKAGE__->write_config($filename, $cfg);
 197
 198     chmod(0600, $fh);
 199
 200     PVE::Tools::safe_print($filename, $fh, $raw);
 201 }
 202
 203 PVE::INotify::register_file('pmg-ldap.conf', "/etc/pmg/ldap.conf",
 204                             \&read_pmg_ldap_conf,
 205                             \&write_pmg_ldap_conf);
 206
 207
 208 1;