use serde::{Deserialize, Serialize};
-use proxmox_schema::{
- api, const_regex, ApiStringFormat, ApiType, ArraySchema, Schema, StringSchema, Updater,
-};
+use proxmox_schema::{api, ApiStringFormat, ApiType, ArraySchema, Schema, StringSchema, Updater};
use super::{REALM_ID_SCHEMA, SINGLE_LINE_COMMENT_SCHEMA};
Properties,
}
-macro_rules! DOMAIN_PART_REGEX {
- () => {
- r#"("[^"]+"|[^ ,+"/<>;=#][^,+"/<>;=]*[^ ,+"/<>;=]|[^ ,+"/<>;=#])"#
- };
-}
-
-const_regex! {
- pub LDAP_DOMAIN_REGEX = concat!(
- r#"^\w+="#,
- DOMAIN_PART_REGEX!(),
- r#"(,\s*\w+="#,
- DOMAIN_PART_REGEX!(),
- ")*$"
- );
-}
-
-pub const LDAP_DOMAIN_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&LDAP_DOMAIN_REGEX);
-
-pub const LDAP_DOMAIN_SCHEMA: Schema = StringSchema::new("LDAP Domain")
- .format(&LDAP_DOMAIN_FORMAT)
- .schema();
+pub const LDAP_DOMAIN_SCHEMA: Schema = StringSchema::new("LDAP Domain").schema();
pub const SYNC_DEFAULTS_STRING_SCHEMA: Schema = StringSchema::new("sync defaults options")
.format(&ApiStringFormat::PropertyString(
+use crate::auth::LdapAuthenticator;
use ::serde::{Deserialize, Serialize};
-use anyhow::Error;
+use anyhow::{format_err, Error};
use hex::FromHex;
use serde_json::Value;
+use proxmox_ldap::Connection;
use proxmox_router::{http_bail, Permission, Router, RpcEnvironment};
use proxmox_schema::{api, param_bail};
param_bail!("realm", "realm '{}' already exists.", config.realm);
}
+ let ldap_config =
+ LdapAuthenticator::api_type_to_config_with_password(&config, password.clone())?;
+ let conn = Connection::new(ldap_config);
+ proxmox_async::runtime::block_on(conn.check_connection()).map_err(|e| format_err!("{e:#}"))?;
+
if let Some(password) = password {
auth_helpers::store_ldap_bind_password(&config.realm, &password, &domain_config_lock)?;
}
config.bind_dn = Some(bind_dn);
}
- if let Some(password) = password {
- auth_helpers::store_ldap_bind_password(&realm, &password, &domain_config_lock)?;
- }
-
if let Some(filter) = update.filter {
config.filter = Some(filter);
}
config.user_classes = Some(user_classes);
}
+ let ldap_config = if let Some(_) = password {
+ LdapAuthenticator::api_type_to_config_with_password(&config, password.clone())?
+ } else {
+ LdapAuthenticator::api_type_to_config(&config)?
+ };
+
+ let conn = Connection::new(ldap_config);
+ proxmox_async::runtime::block_on(conn.check_connection()).map_err(|e| format_err!("{e:#}"))?;
+
+ if let Some(password) = password {
+ auth_helpers::store_ldap_bind_password(&realm, &password, &domain_config_lock)?;
+ }
+
domains.set_data(&realm, "ldap", &config)?;
domains::save_config(&domains)?;
impl LdapAuthenticator {
pub fn api_type_to_config(config: &LdapRealmConfig) -> Result<Config, Error> {
+ Self::api_type_to_config_with_password(
+ config,
+ auth_helpers::get_ldap_bind_password(&config.realm)?,
+ )
+ }
+
+ pub fn api_type_to_config_with_password(
+ config: &LdapRealmConfig,
+ password: Option<String>,
+ ) -> Result<Config, Error> {
let mut servers = vec![config.server1.clone()];
if let Some(server) = &config.server2 {
servers.push(server.clone());
user_attr: config.user_attr.clone(),
base_dn: config.base_dn.clone(),
bind_dn: config.bind_dn.clone(),
- bind_password: auth_helpers::get_ldap_bind_password(&config.realm)?,
+ bind_password: password,
tls_mode,
verify_certificate: config.verify.unwrap_or_default(),
additional_trusted_certificates: trusted_cert,