follouwp indentation fixup

[pmg-api.git] / PMG / AccessControl.pm

diff --git a/PMG/AccessControl.pm b/PMG/AccessControl.pm
index 2da795d3ca0a93f8473e43403b28667f40660411..693e5ef110d182f110cf4554f5c4ce51a2287bcf 100644 (file)
--- a/PMG/AccessControl.pm
+++ b/PMG/AccessControl.pm
@@ -6,8 +6,11 @@ use Authen::PAM;
 
 use PVE::Tools;
 use PVE::JSONSchema qw(get_standard_option);
+use PVE::Exception qw(raise raise_perm_exc);
 
 use PMG::UserConfig;
+use PMG::LDAPConfig;
+use PMG::LDAPSet;
 
 sub normalize_path {
     my $path = shift;
@@ -40,13 +43,21 @@ sub authenticate_user {
        die "invalid pam user (only root allowed)\n" if $ruid ne 'root';
        authenticate_pam_user($ruid, $password);
        return $username;
-    }
-
-    if ($realm eq 'pmg') {
+    } elsif ($realm eq 'pmg') {
        my $usercfg = PMG::UserConfig->new();
        $usercfg->authenticate_user($username, $password);
        return $username;
-     }
+    } elsif ($realm eq 'quarantine') {
+       my $ldap_cfg = PMG::LDAPConfig->new();
+       my $ldap = PMG::LDAPSet->new_from_ldap_cfg($ldap_cfg, 1);
+
+       if (my $ldapinfo = $ldap->account_info($ruid, $password)) {
+           my $pmail = $ldapinfo->{pmail};
+           return $pmail . '@quarantine';
+       } else {
+           die "ldap login failed\n";
+       }
+    }
 
     die "no such realm '$realm'\n";
 }
@@ -67,7 +78,7 @@ sub set_user_password {
 
        push @$cmd, '-p', $epw, $ruid;
 
-       run_command($cmd, errmsg => "change password for '$ruid' failed");
+       PVE::Tools::run_command($cmd, errmsg => "change password for '$ruid' failed");
 
     } elsif ($realm eq 'pmg') {
        PMG::UserConfig->set_user_password($username, $password);
@@ -77,8 +88,9 @@ sub set_user_password {
 }
 
 # test if user exists and is enabled
+# returns: role
 sub check_user_enabled {
-    my ($username, $noerr) = @_;
+    my ($usercfg, $username, $noerr) = @_;
 
     my ($ruid, $realm);
 
@@ -86,15 +98,17 @@ sub check_user_enabled {
 
     if ($realm && $ruid) {
        if ($realm eq 'pam') {
-           return 1 if $ruid eq 'root';
+           return 'root' if $ruid eq 'root';
        } elsif ($realm eq 'pmg') {
            my $usercfg = PMG::UserConfig->new();
            my $data = $usercfg->lookup_user_data($username, $noerr);
-           return 1 if $data && $data->{enable};
+           return $data->{role} if $data && $data->{enable};
+       } elsif ($realm eq 'quarantine') {
+           return 'quser';
        }
     }
 
-    die "user '$username' is disabled\n" if !$noerr;
+    raise_perm_exc("user '$username' is disabled") if !$noerr;
 
     return undef;
 }