1 package PVE
::API2
::OpenId
;
6 use PVE
::Tools
qw(extract_param);
9 use PVE
::Exception
qw(raise raise_perm_exc raise_param_exc);
11 use PVE
::RPCEnvironment
;
12 use PVE
::Cluster
qw(cfs_read_file cfs_write_file);
13 use PVE
::AccessControl
;
14 use PVE
::JSONSchema
qw(get_standard_option);
15 use PVE
::Auth
::Plugin
;
19 use base
qw(PVE::RESTHandler);
21 my $openid_state_path = "/var/lib/pve-manager";
23 my $lookup_openid_auth = sub {
24 my ($realm, $redirect_url) = @_;
26 my $cfg = cfs_read_file
('domains.cfg');
27 my $ids = $cfg->{ids
};
29 die "authentication domain '$realm' does not exist\n" if !$ids->{$realm};
31 my $config = $ids->{$realm};
32 die "wrong realm type ($config->{type} != openid)\n" if $config->{type
} ne "openid";
35 issuer_url
=> $config->{'issuer-url'},
36 client_id
=> $config->{'client-id'},
37 client_key
=> $config->{'client-key'},
40 my $openid = PVE
::RS
::OpenId-
>discover($openid_config, $redirect_url);
41 return ($config, $openid);
44 __PACKAGE__-
>register_method ({
48 description
=> "Directory index.",
53 additionalProperties
=> 0,
61 subdir
=> { type
=> 'string' },
64 links
=> [ { rel
=> 'child', href
=> "{subdir}" } ],
70 { subdir
=> 'auth-url' },
71 { subdir
=> 'login' },
75 __PACKAGE__-
>register_method ({
80 description
=> "Get the OpenId Authorization Url for the specified realm.",
82 additionalProperties
=> 0,
84 realm
=> get_standard_option
('realm'),
86 description
=> "Redirection Url. The client should set this to the used server url (location.origin).",
94 description
=> "Redirection URL.",
96 permissions
=> { user
=> 'world' },
100 my $realm = extract_param
($param, 'realm');
101 my $redirect_url = extract_param
($param, 'redirect-url');
103 my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
104 my $url = $openid->authorize_url($openid_state_path , $realm);
109 __PACKAGE__-
>register_method ({
114 description
=> " Verify OpenID authorization code and create a ticket.",
116 additionalProperties
=> 0,
119 description
=> "OpenId state.",
124 description
=> "OpenId authorization code.",
129 description
=> "Redirection Url. The client should set this to the used server url (location.origin).",
137 username
=> { type
=> 'string' },
138 ticket
=> { type
=> 'string' },
139 CSRFPreventionToken
=> { type
=> 'string' },
140 cap
=> { type
=> 'object' }, # computed api permissions
141 clustername
=> { type
=> 'string', optional
=> 1 },
144 permissions
=> { user
=> 'world' },
148 my $rpcenv = PVE
::RPCEnvironment
::get
();
152 my ($realm, $private_auth_state) = PVE
::RS
::OpenId
::verify_public_auth_state
(
153 $openid_state_path, $param->{'state'});
155 my $redirect_url = extract_param
($param, 'redirect-url');
157 my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
159 my $info = $openid->verify_authorization_code($param->{code
}, $private_auth_state);
160 my $subject = $info->{'sub'};
162 die "missing openid claim 'sub'\n" if !defined($subject);
164 my $unique_name = $subject; # default
165 if (defined(my $user_attr = $config->{'username-claim'})) {
166 if ($user_attr eq 'subject') {
167 $unique_name = $subject;
168 } elsif ($user_attr eq 'username') {
169 my $username = $info->{'preferred_username'};
170 die "missing claim 'preferred_username'\n" if !defined($username);
171 $unique_name = $username;
172 } elsif ($user_attr eq 'email') {
173 my $email = $info->{'email'};
174 die "missing claim 'email'\n" if !defined($email);
175 $unique_name = $email;
177 die "got unexpected value for 'username-claim': '${user_attr}'\n";
181 my $username = "${unique_name}\@${realm}";
183 # first, check if $username respects our naming conventions
184 PVE
::Auth
::Plugin
::verify_username
($username);
186 if ($config->{'autocreate'} && !$rpcenv->check_user_exist($username, 1)) {
187 PVE
::AccessControl
::lock_user_config
(sub {
188 my $usercfg = cfs_read_file
("user.cfg");
190 die "user '$username' already exists\n" if $usercfg->{users
}->{$username};
192 my $entry = { enable
=> 1 };
193 if (defined(my $email = $info->{'email'})) {
194 $entry->{email
} = $email;
196 if (defined(my $given_name = $info->{'given_name'})) {
197 $entry->{firstname
} = $given_name;
199 if (defined(my $family_name = $info->{'family_name'})) {
200 $entry->{lastname
} = $family_name;
203 $usercfg->{users
}->{$username} = $entry;
205 cfs_write_file
("user.cfg", $usercfg);
206 }, "autocreate openid user failed");
208 # test if user exists and is enabled
209 $rpcenv->check_user_enabled($username);
212 my $ticket = PVE
::AccessControl
::assemble_ticket
($username);
213 my $csrftoken = PVE
::AccessControl
::assemble_csrf_prevention_token
($username);
214 my $cap = $rpcenv->compute_api_permission($username);
218 username
=> $username,
219 CSRFPreventionToken
=> $csrftoken,
223 my $clinfo = PVE
::Cluster
::get_clinfo
();
224 if ($clinfo->{cluster
}->{name
} && $rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
225 $res->{clustername
} = $clinfo->{cluster
}->{name
};
229 my $clientip = $rpcenv->get_client_ip() || '';
230 syslog
('err', "openid authentication failure; rhost=$clientip msg=$err");
231 # do not return any info to prevent user enumeration attacks
232 die PVE
::Exception-
>new("authentication failure\n", code
=> 401);
235 PVE
::Cluster
::log_msg
('info', 'root@pam', "successful openid auth for user '$res->{username}'");