PMG/LDAPConfig.pm

   1 package PMG::LDAPConfig;
   2
   3 use strict;
   4 use warnings;
   5 use MIME::Base64;
   6 use Data::Dumper;
   7
   8 use PVE::Tools;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::INotify;
  11 use PVE::SectionConfig;
  12
  13 use base qw(PVE::SectionConfig);
  14
  15 my $inotify_file_id = 'pmg-ldap.conf';
  16 my $config_filename = '/etc/pmg/ldap.conf';
  17
  18 my $defaultData = {
  19     propertyList => {
  20         type => { description => "Section type." },
  21         profile => {
  22             description => "Profile ID.",
  23             type => 'string', format => 'pve-configid',
  24         },
  25     },
  26 };
  27
  28 sub properties {
  29     return {
  30         disable => {
  31             description => "Flag to disable/deactivate the entry.",
  32             type => 'boolean',
  33             optional => 1,
  34         },
  35         comment => {
  36             description => "Description.",
  37             type => 'string',
  38             optional => 1,
  39             maxLength => 4096,
  40         },
  41         mode => {
  42             description => "LDAP protocol mode ('ldap' or 'ldaps').",
  43             type => 'string',
  44             enum => ['ldap', 'ldaps'],
  45             default => 'ldap',
  46         },
  47         server1 => {
  48             description => "Server address.",
  49             type => 'string', format => 'address',
  50             maxLength => 256,
  51         },
  52         server2 => {
  53             description => "Fallback server address. Userd when the first server is not available.",
  54             type => 'string', format => 'address',
  55             maxLength => 256,
  56         },
  57         port => {
  58             description => "Specify the port to connect to.",
  59             type => 'integer',
  60             minimum => 1,
  61             maximum => 65535,
  62         },
  63         binddn => {
  64             description => "Bind domain name.",
  65             type => 'string',
  66         },
  67         bindpw => {
  68             description => "Bind password.",
  69             type => 'string',
  70         },
  71         basedn => {
  72             description => "Base domain name.",
  73             type => 'string',
  74         },
  75         groupbasedn => {
  76             description => "Base domain name for groups.",
  77             type => 'string',
  78         },
  79         filter => {
  80             description => "LDAP filter.",
  81             type => 'string',
  82         },
  83         accountattr => {
  84             description => "Account attribute name name.",
  85             type => 'string', format => 'string-list',
  86             pattern => '[a-zA-Z0-9]+',
  87             default => 'sAMAccountName, uid',
  88         },
  89         mailattr => {
  90             description => "List of mail attribute names.",
  91             type => 'string', format => 'string-list',
  92             pattern => '[a-zA-Z0-9]+',
  93             default => "mail, userPrincipalName, proxyAddresses, othermailbox",
  94         },
  95         groupclass => {
  96             description => "List of objectclasses for groups.",
  97             type => 'string', format => 'string-list',
  98             default => "group, univentionGroup, ipausergroup",
  99         },
 100     };
 101 }
 102
 103 sub options {
 104     return {
 105         disable => { optional => 1 },
 106         comment => { optional => 1 },
 107         server1 => {  optional => 0 },
 108         server2 => {  optional => 1 },
 109         port => { optional => 1 },
 110         mode => { optional => 1 },
 111         binddn => { optional => 1 },
 112         bindpw => { optional => 1 },
 113         basedn => { optional => 1 },
 114         groupbasedn => { optional => 1 },
 115         filter => { optional => 1 },
 116         accountattr => { optional => 1 },
 117         mailattr => { optional => 1 },
 118         groupclass => { optional => 1 },
 119     };
 120 }
 121
 122 sub type {
 123     return 'ldap';
 124 }
 125
 126 sub private {
 127     return $defaultData;
 128 }
 129
 130 sub parse_section_header {
 131     my ($class, $line) = @_;
 132
 133     if ($line =~ m/^(\S+):\s*(\S+)\s*$/) {
 134         my ($type, $profileId) = ($1, $2);
 135         my $errmsg = undef; # set if you want to skip whole section
 136         eval { PVE::JSONSchema::pve_verify_configid($profileId); };
 137         $errmsg = $@ if $@;
 138         my $config = {}; # to return additional attributes
 139         return ($type, $profileId, $errmsg, $config);
 140     }
 141     return undef;
 142 }
 143
 144 sub parse_config {
 145     my ($class, $filename, $raw) = @_;
 146
 147     my $cfg = $class->SUPER::parse_config($filename, $raw);
 148
 149     foreach my $profile (keys %{$cfg->{ids}}) {
 150         my $data = $cfg->{ids}->{$profile};
 151
 152         $data->{comment} = PVE::Tools::decode_text($data->{comment})
 153             if defined($data->{comment});
 154
 155         $data->{bindpw} = decode_base64($data->{bindpw})
 156             if defined($data->{bindpw});
 157     }
 158
 159     return $cfg;
 160 }
 161
 162 sub write_config {
 163     my ($class, $filename, $cfg) = @_;
 164
 165     foreach my $profile (keys %{$cfg->{ids}}) {
 166         my $data = $cfg->{ids}->{$profile};
 167
 168         $data->{comment} = PVE::Tools::encode_text($data->{comment})
 169             if defined($data->{comment});
 170
 171         $data->{bindpw} = encode_base64($data->{bindpw}, '')
 172             if defined($data->{bindpw});
 173     }
 174
 175     $class->SUPER::write_config($filename, $cfg);
 176 }
 177
 178 sub new {
 179     my ($type) = @_;
 180
 181     my $class = ref($type) || $type;
 182
 183     my $cfg = PVE::INotify::read_file($inotify_file_id);
 184
 185     return bless $cfg, $class;
 186 }
 187
 188 sub write {
 189     my ($self) = @_;
 190
 191     PVE::INotify::write_file($inotify_file_id, $self);
 192 }
 193
 194 my $lockfile = "/var/lock/pmgldapconfig.lck";
 195
 196 sub lock_config {
 197     my ($code, $errmsg) = @_;
 198
 199     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
 200     if (my $err = $@) {
 201         $errmsg ? die "$errmsg: $err" : die $err;
 202     }
 203 }
 204
 205
 206 __PACKAGE__->register();
 207 __PACKAGE__->init();
 208
 209 sub read_pmg_ldap_conf {
 210     my ($filename, $fh) = @_;
 211
 212     local $/ = undef; # slurp mode
 213
 214     my $raw = defined($fh) ? <$fh> : '';
 215
 216     return __PACKAGE__->parse_config($filename, $raw);
 217 }
 218
 219 sub write_pmg_ldap_conf {
 220     my ($filename, $fh, $cfg) = @_;
 221
 222     my $raw = __PACKAGE__->write_config($filename, $cfg);
 223
 224     my $gid = getgrnam('www-data');
 225     chown(0, $gid, $fh);
 226     chmod(0640, $fh);
 227
 228     PVE::Tools::safe_print($filename, $fh, $raw);
 229 }
 230
 231 PVE::INotify::register_file($inotify_file_id, $config_filename,
 232                             \&read_pmg_ldap_conf,
 233                             \&write_pmg_ldap_conf,
 234                             undef,
 235                             always_call_parser => 1);
 236
 237
 238 1;