realm: add default-sync-options to config

[pve-access-control.git] / PVE / Auth / Plugin.pm

diff --git a/PVE/Auth/Plugin.pm b/PVE/Auth/Plugin.pm
index 0bffa2b123144a415c0beb2d724190dcd014598e..5272ef5c657a1416605bb2ff211f7e19cf606bc8 100755 (executable)
--- a/PVE/Auth/Plugin.pm
+++ b/PVE/Auth/Plugin.pm
@@ -27,7 +27,8 @@ sub lock_domain_config {
     }
 }
 
-my $realm_regex = qr/[A-Za-z][A-Za-z0-9\.\-_]+/;
+our $realm_regex = qr/[A-Za-z][A-Za-z0-9\.\-_]+/;
+our $user_regex = qr![^\s:/]+!;
 
 PVE::JSONSchema::register_format('pve-realm', \&pve_verify_realm);
 sub pve_verify_realm {
@@ -46,6 +47,37 @@ PVE::JSONSchema::register_standard_option('realm', {
     maxLength => 32,
 });
 
+my $realm_sync_options_desc = {
+    scope => {
+       description => "Select what to sync.",
+       type => 'string',
+       enum => [qw(users groups both)],
+       optional => '1',
+    },
+    full => {
+       description => "If set, uses the LDAP Directory as source of truth,"
+           ." deleting users or groups not returned from the sync. Otherwise"
+           ." only syncs information which is not already present, and does not"
+           ." deletes or modifies anything else.",
+       type => 'boolean',
+       optional => '1',
+    },
+    'enable-new' => {
+       description => "Enable newly synced users immediately.",
+       type => 'boolean',
+       default => '1',
+       optional => '1',
+    },
+    purge => {
+       description => "Remove ACLs for users or groups which were removed from"
+           ." the config during a sync.",
+       type => 'boolean',
+       optional => '1',
+    },
+};
+PVE::JSONSchema::register_standard_option('realm-sync-options', $realm_sync_options_desc);
+PVE::JSONSchema::register_format('realm-sync-options', $realm_sync_options_desc);
+
 PVE::JSONSchema::register_format('pve-userid', \&verify_username);
 sub verify_username {
     my ($username, $noerr) = @_;
@@ -66,7 +98,7 @@ sub verify_username {
     # colon separated lists)!
     # slash is not allowed because it is used as pve API delimiter
     # also see "man useradd"
-    if ($username =~ m!^([^\s:/]+)\@(${realm_regex})$!) {
+    if ($username =~ m!^(${user_regex})\@(${realm_regex})$!) {
        return wantarray ? ($username, $1, $2) : $username;
     }
 
@@ -76,21 +108,55 @@ sub verify_username {
 }
 
 PVE::JSONSchema::register_standard_option('userid', {
-    description => "User ID", title => "User ID",
+    description => "User ID",
     type => 'string', format => 'pve-userid',
     maxLength => 64,
 });
 
-PVE::JSONSchema::register_format('pve-tfa-config', \&verify_tfa_config);
-sub verify_tfa_config {
-    my ($value, $noerr) = @_;
-
-    return $value if parse_tfa_config($value);
-
-    return undef if $noerr;
+my $tfa_format = {
+    type => {
+        description => "The type of 2nd factor authentication.",
+        format_description => 'TFATYPE',
+        type => 'string',
+        enum => [qw(yubico oath)],
+    },
+    id => {
+        description => "Yubico API ID.",
+        format_description => 'ID',
+        type => 'string',
+        optional => 1,
+    },
+    key => {
+        description => "Yubico API Key.",
+        format_description => 'KEY',
+        type => 'string',
+        optional => 1,
+    },
+    url => {
+        description => "Yubico API URL.",
+        format_description => 'URL',
+        type => 'string',
+        optional => 1,
+    },
+    digits => {
+        description => "TOTP digits.",
+        format_description => 'COUNT',
+        type => 'integer',
+        minimum => 6, maximum => 8,
+        default => 6,
+        optional => 1,
+    },
+    step => {
+        description => "TOTP time period.",
+        format_description => 'SECONDS',
+        type => 'integer',
+        minimum => 10,
+        default => 30,
+        optional => 1,
+    },
+};
 
-    die "unable to parse tfa option\n";
-}
+PVE::JSONSchema::register_format('pve-tfa-config', $tfa_format);
 
 PVE::JSONSchema::register_standard_option('tfa', {
     description => "Use Two-factor authentication.",
@@ -102,30 +168,7 @@ PVE::JSONSchema::register_standard_option('tfa', {
 sub parse_tfa_config {
     my ($data) = @_;
 
-    my $res = {};
-
-    foreach my $kvp (split(/,/, $data)) {
-
-       if ($kvp =~ m/^type=(yubico|oath)$/) {
-           $res->{type} = $1;
-       } elsif ($kvp =~ m/^id=(\S+)$/) {
-           $res->{id} = $1;
-       } elsif ($kvp =~ m/^key=(\S+)$/) {
-           $res->{key} = $1;
-       } elsif ($kvp =~ m/^url=(\S+)$/) {
-           $res->{url} = $1;
-       } elsif ($kvp =~ m/^digits=([6|7|8])$/) {
-           $res->{digits} = $1;
-       } elsif ($kvp =~ m/^step=([1-9]\d+)$/) {
-           $res->{step} = $1;
-       } else {
-           return undef;
-       }
-    }
-
-    return undef if !$res->{type};
-
-    return $res;
+    return PVE::JSONSchema::parse_property_string($tfa_format, $data);
 }
 
 my $defaultData = {