src/PMG/LDAPConfig.pm

   1 package PMG::LDAPConfig;
   2
   3 use strict;
   4 use warnings;
   5 use MIME::Base64;
   6 use Data::Dumper;
   7
   8 use PVE::Tools;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::INotify;
  11 use PVE::SectionConfig;
  12
  13 use base qw(PVE::SectionConfig);
  14
  15 my $inotify_file_id = 'pmg-ldap.conf';
  16 my $config_filename = '/etc/pmg/ldap.conf';
  17
  18 my $defaultData = {
  19     propertyList => {
  20         type => { description => "Section type." },
  21         profile => {
  22             description => "Profile ID.",
  23             type => 'string', format => 'pve-configid',
  24         },
  25     },
  26 };
  27
  28
  29 sub properties {
  30     return {
  31         disable => {
  32             description => "Flag to disable/deactivate the entry.",
  33             type => 'boolean',
  34             optional => 1,
  35         },
  36         comment => {
  37             description => "Description.",
  38             type => 'string',
  39             optional => 1,
  40             maxLength => 4096,
  41         },
  42         mode => {
  43             description => "LDAP protocol mode ('ldap', 'ldaps' or 'ldap+starttls').",
  44             type => 'string',
  45             enum => ['ldap', 'ldaps', 'ldap+starttls'],
  46             default => 'ldap',
  47         },
  48         verify => {
  49             description => "Verify server certificate. Only useful with ldaps or ldap+starttls.",
  50             type => 'boolean',
  51             default => 0,
  52             optional => 1,
  53         },
  54         cafile => {
  55             description => "Path to CA file. Only useful with option 'verify'",
  56             type => 'string',
  57             optional => 1,
  58         },
  59         server1 => {
  60             description => "Server address.",
  61             type => 'string', format => 'address',
  62             maxLength => 256,
  63         },
  64         server2 => {
  65             description => "Fallback server address. Userd when the first server is not available.",
  66             type => 'string', format => 'address',
  67             maxLength => 256,
  68         },
  69         port => {
  70             description => "Specify the port to connect to.",
  71             type => 'integer',
  72             minimum => 1,
  73             maximum => 65535,
  74         },
  75         binddn => {
  76             description => "Bind domain name.",
  77             type => 'string',
  78         },
  79         bindpw => {
  80             description => "Bind password.",
  81             type => 'string',
  82         },
  83         basedn => {
  84             description => "Base domain name.",
  85             type => 'string',
  86         },
  87         groupbasedn => {
  88             description => "Base domain name for groups.",
  89             type => 'string',
  90         },
  91         filter => {
  92             description => "LDAP filter.",
  93             type => 'string',
  94         },
  95         accountattr => {
  96             description => "Account attribute name name.",
  97             type => 'string', format => 'ldap-simple-attr-list',
  98             default => 'sAMAccountName, uid',
  99         },
 100         mailattr => {
 101             description => "List of mail attribute names.",
 102             type => 'string', format => 'ldap-simple-attr-list',
 103             default => "mail, userPrincipalName, proxyAddresses, othermailbox, mailAlternativeAddress",
 104         },
 105         groupclass => {
 106             description => "List of objectclasses for groups.",
 107             type => 'string', format => 'ldap-simple-attr-list',
 108             default => "group, univentionGroup, ipausergroup",
 109         },
 110     };
 111 }
 112
 113 sub options {
 114     return {
 115         disable => { optional => 1 },
 116         comment => { optional => 1 },
 117         server1 => {  optional => 0 },
 118         server2 => {  optional => 1 },
 119         port => { optional => 1 },
 120         mode => { optional => 1 },
 121         binddn => { optional => 1 },
 122         bindpw => { optional => 1 },
 123         basedn => { optional => 1 },
 124         groupbasedn => { optional => 1 },
 125         filter => { optional => 1 },
 126         accountattr => { optional => 1 },
 127         mailattr => { optional => 1 },
 128         groupclass => { optional => 1 },
 129         verify => { optional => 1 },
 130         cafile => { optional => 1 },
 131     };
 132 }
 133
 134 sub type {
 135     return 'ldap';
 136 }
 137
 138 sub private {
 139     return $defaultData;
 140 }
 141
 142 sub parse_section_header {
 143     my ($class, $line) = @_;
 144
 145     if ($line =~ m/^(\S+):\s*(\S+)\s*$/) {
 146         my ($type, $profileId) = ($1, $2);
 147         my $errmsg = undef; # set if you want to skip whole section
 148         eval { PVE::JSONSchema::pve_verify_configid($profileId); };
 149         $errmsg = $@ if $@;
 150         my $config = {}; # to return additional attributes
 151         return ($type, $profileId, $errmsg, $config);
 152     }
 153     return undef;
 154 }
 155
 156 sub parse_config {
 157     my ($class, $filename, $raw) = @_;
 158
 159     my $cfg = $class->SUPER::parse_config($filename, $raw);
 160
 161     foreach my $profile (keys %{$cfg->{ids}}) {
 162         my $data = $cfg->{ids}->{$profile};
 163
 164         $data->{comment} = PVE::Tools::decode_text($data->{comment})
 165             if defined($data->{comment});
 166
 167         $data->{bindpw} = decode_base64($data->{bindpw})
 168             if defined($data->{bindpw});
 169     }
 170
 171     return $cfg;
 172 }
 173
 174 sub write_config {
 175     my ($class, $filename, $cfg) = @_;
 176
 177     foreach my $profile (keys %{$cfg->{ids}}) {
 178         my $data = $cfg->{ids}->{$profile};
 179
 180         $data->{comment} = PVE::Tools::encode_text($data->{comment})
 181             if defined($data->{comment});
 182
 183         $data->{bindpw} = encode_base64($data->{bindpw}, '')
 184             if defined($data->{bindpw});
 185     }
 186
 187     $class->SUPER::write_config($filename, $cfg);
 188 }
 189
 190 sub new {
 191     my ($type) = @_;
 192
 193     my $class = ref($type) || $type;
 194
 195     my $cfg = PVE::INotify::read_file($inotify_file_id);
 196
 197     return bless $cfg, $class;
 198 }
 199
 200 sub write {
 201     my ($self) = @_;
 202
 203     PVE::INotify::write_file($inotify_file_id, $self);
 204 }
 205
 206 my $lockfile = "/var/lock/pmgldapconfig.lck";
 207
 208 sub lock_config {
 209     my ($code, $errmsg) = @_;
 210
 211     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
 212     if (my $err = $@) {
 213         $errmsg ? die "$errmsg: $err" : die $err;
 214     }
 215 }
 216
 217
 218 __PACKAGE__->register();
 219 __PACKAGE__->init();
 220
 221 sub read_pmg_ldap_conf {
 222     my ($filename, $fh) = @_;
 223
 224     my $raw = defined($fh) ? do { local $/ = undef; <$fh> } : '';
 225
 226     return __PACKAGE__->parse_config($filename, $raw);
 227 }
 228
 229 sub write_pmg_ldap_conf {
 230     my ($filename, $fh, $cfg) = @_;
 231
 232     my $raw = __PACKAGE__->write_config($filename, $cfg);
 233
 234     my $gid = getgrnam('www-data');
 235     chown(0, $gid, $fh);
 236     chmod(0640, $fh);
 237
 238     PVE::Tools::safe_print($filename, $fh, $raw);
 239 }
 240
 241 PVE::INotify::register_file($inotify_file_id, $config_filename,
 242                             \&read_pmg_ldap_conf,
 243                             \&write_pmg_ldap_conf,
 244                             undef,
 245                             always_call_parser => 1);
 246
 247
 248 1;