fix bug #1625 - change default rule priorities

[pmg-api.git] / PMG / UserConfig.pm

diff --git a/PMG/UserConfig.pm b/PMG/UserConfig.pm
index 4dc9eb2ac491a8510879526c8cdac9b22895cc8f..f1134e4aac9e8ee7a7b62f8f47d03b1f54ba0123 100644 (file)
--- a/PMG/UserConfig.pm
+++ b/PMG/UserConfig.pm
@@ -1,6 +1,5 @@
 package PMG::UserConfig;
 
-
 use strict;
 use warnings;
 use Data::Dumper;
@@ -43,10 +42,18 @@ sub lock_config {
     }
 }
 
-our $schema = {
+my $schema = {
     additionalProperties => 0,
     properties => {
        userid => get_standard_option('userid'),
+       username => get_standard_option('username', { optional => 1 }),
+       realm => {
+           description => "Authentication realm.",
+           type => 'string',
+           enum => ['pam', 'pmg'],
+           default => 'pmg',
+           optional => 1,
+       },
        email => {
            description => "Users E-Mail address.",
            type => 'string', format => 'email',
@@ -72,9 +79,9 @@ our $schema = {
            optional => 1,
        },
        role => {
-           description => "User role.",
+           description => "User role. Role 'root' is reseved for the Unix Superuser.",
            type => 'string',
-           enum => ['root', 'admin', 'qmanager', 'quser', 'audit'],
+           enum => ['root', 'admin', 'qmanager', 'audit'],
        },
        firstname => {
            description => "First name.",
@@ -102,7 +109,18 @@ our $schema = {
     },
 };
 
-our $update_schema = clone($schema);
+our $create_schema = clone($schema);
+delete $create_schema->{properties}->{username};
+delete $create_schema->{properties}->{realm};
+$create_schema->{properties}->{password} = {
+    description => "Password",
+    type => 'string',
+    maxLength => 32,
+    minLength => 5,
+    optional => 1,
+};
+
+our $update_schema = clone($create_schema);
 $update_schema->{properties}->{role}->{optional} = 1;
 $update_schema->{properties}->{delete} = {
     type => 'string', format => 'pve-configid-list',
@@ -125,6 +143,8 @@ my $fixup_root_properties = sub {
     my ($cfg) = @_;
 
     $cfg->{'root@pam'}->{userid} = 'root@pam';
+    $cfg->{'root@pam'}->{username} = 'root';
+    $cfg->{'root@pam'}->{realm} = 'pam';
     $cfg->{'root@pam'}->{enable} = 1;
     $cfg->{'root@pam'}->{expire} = 0;
     $cfg->{'root@pam'}->{comment} = 'Unix Superuser';
@@ -161,7 +181,9 @@ sub read_user_conf {
                $/x
            ) {
                my $d = {
+                   username => $+{userid},
                    userid => $+{userid} . '@pmg',
+                   realm => 'pmg',
                    enable => $+{enable} || 0,
                    expire => $+{expire} || 0,
                    role => $+{role},
@@ -174,6 +196,8 @@ sub read_user_conf {
                eval {
                    $verity_entry->($d);
                    $cfg->{$d->{userid}} = $d;
+                   die "role 'root' is reserved\n"
+                       if $d->{role} eq 'root' && $d->{userid} ne 'root@pmg';
                };
                if (my $err = $@) {
                    warn "$filename: $err";
@@ -212,6 +236,12 @@ sub write_user_conf {
        eval {
            $verity_entry->($d);
            $cfg->{$d->{userid}} = $d;
+
+           if ($d->{userid} ne 'root@pam') {
+               die "role 'root' is reserved\n" if $d->{role} eq 'root';
+               die "unable to add users for realm '$d->{realm}'\n"
+                   if $d->{realm} && $d->{realm} ne 'pmg';
+           }
        };
        if (my $err = $@) {
            die $err;
@@ -239,6 +269,10 @@ sub write_user_conf {
        $raw .= $line . "\n";
     }
 
+    my $gid = getgrnam('www-data');
+    chown(0, $gid, $fh);
+    chmod(0640, $fh);
+
     PVE::Tools::safe_print($filename, $fh, $raw);
 }
 
@@ -280,13 +314,13 @@ sub authenticate_user {
     return 1;
 }
 
-sub set_password {
+sub set_user_password {
     my ($class, $username, $password) = @_;
 
     lock_config(sub {
        my $cfg = $class->new();
        my $data = $cfg->lookup_user_data($username); # user exists
-       my $epw = PMG::Utils::encrypt_pw($password);
+       my $epw = PVE::Tools::encrypt_pw($password);
        $data->{crypt_pass} = $epw;
        $cfg->write();
     });