PMG/LDAPConfig.pm

   1 package PMG::LDAPConfig;
   2
   3 use strict;
   4 use warnings;
   5 use MIME::Base64;
   6 use Data::Dumper;
   7
   8 use PVE::Tools;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::INotify;
  11 use PVE::SectionConfig;
  12
  13 use base qw(PVE::SectionConfig);
  14
  15 my $defaultData = {
  16     propertyList => {
  17         type => { description => "Section type." },
  18         section => {
  19             description => "Secion ID.",
  20             type => 'string', format => 'pve-configid',
  21         },
  22     },
  23 };
  24
  25 sub properties {
  26     return {
  27         mode => {
  28             description => "LDAP protocol mode ('ldap' or 'ldaps').",
  29             type => 'string',
  30             enum => ['ldap', 'ldaps'],
  31             default => 'ldap',
  32         },
  33         server1 => {
  34             description => "Server address.",
  35             type => 'string', format => 'address',
  36         },
  37         server2 => {
  38             description => "Fallback server address. Userd when the first server is not available.",
  39             type => 'string', format => 'address',
  40         },
  41         port => {
  42             description => "Specify the port to connect to.",
  43             type => 'integer',
  44             minimum => 1,
  45             maximum => 65535,
  46         },
  47         binddn => {
  48             description => "Bind domain name.",
  49             type => 'string',
  50         },
  51         bindpw => {
  52             description => "Bind password.",
  53             type => 'string',
  54         },
  55         basedn => {
  56             description => "Base domain name.",
  57             type => 'string',
  58         },
  59         groupbasedn => {
  60             description => "Base domain name for groups.",
  61             type => 'string',
  62         },
  63         filter => {
  64             description => "LDAP filter.",
  65             type => 'string',
  66         },
  67         accountattr => {
  68             description => "Account attribute name name.",
  69             type => 'string',
  70             pattern => '[a-zA-Z0-9]+',
  71             default => 'sAMAccountName',
  72         },
  73         mailattr => {
  74             description => "List of mail attribute names.",
  75             type => 'string', format => 'string-list',
  76             pattern => '[a-zA-Z0-9]+',
  77             default => "mail, userPrincipalName, proxyAddresses, othermailbox",
  78         },
  79     };
  80 }
  81
  82 sub options {
  83     return {
  84         server1 => {  optional => 0 },
  85         server2 => {  optional => 1 },
  86         port => { optional => 1 },
  87         mode => { optional => 1 },
  88         binddn => { optional => 1 },
  89         bindpw => { optional => 1 },
  90         basedn => { optional => 1 },
  91         groupbasedn => { optional => 1 },
  92         filter => { optional => 1 },
  93         accountattr => { optional => 1 },
  94         mailattr => { optional => 1 },
  95     };
  96 }
  97
  98 sub type {
  99     return 'ldap';
 100 }
 101
 102 sub private {
 103     return $defaultData;
 104 }
 105
 106 sub decode_value {
 107     my ($class, $type, $key, $value) = @_;
 108
 109     $value = decode_base64($value) if $key eq 'bindpw';
 110
 111     return $value;
 112 }
 113
 114 sub encode_value {
 115     my ($class, $type, $key, $value) = @_;
 116
 117     $value = encode_base64($value, '') if $key eq 'bindpw';
 118
 119     return $value;
 120 }
 121
 122 my $lockfile = "/var/lock/pmgldapconfig.lck";
 123
 124 sub lock_config {
 125     my ($code, $errmsg) = @_;
 126
 127     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
 128     if (my $err = $@) {
 129         $errmsg ? die "$errmsg: $err" : die $err;
 130     }
 131 }
 132
 133
 134 __PACKAGE__->register();
 135 __PACKAGE__->init();
 136
 137 sub read_pmg_ldap_conf {
 138     my ($filename, $fh) = @_;
 139
 140     local $/ = undef; # slurp mode
 141
 142     my $raw = <$fh>;
 143
 144     return __PACKAGE__->parse_config($filename, $raw);
 145 }
 146
 147 sub write_pmg_ldap_conf {
 148     my ($filename, $fh, $cfg) = @_;
 149
 150     my $raw = __PACKAGE__->write_config($filename, $cfg);
 151
 152     chmod(0600, $fh);
 153
 154     PVE::Tools::safe_print($filename, $fh, $raw);
 155 }
 156
 157 PVE::INotify::register_file('pmg-ldap.conf', "/etc/proxmox/ldap.conf",
 158                             \&read_pmg_ldap_conf,
 159                             \&write_pmg_ldap_conf);
 160
 161
 162 1;