PMG/LDAPConfig.pm

   1 package PMG::LDAPConfig;
   2
   3 use strict;
   4 use warnings;
   5 use MIME::Base64;
   6 use Data::Dumper;
   7
   8 use PVE::Tools;
   9 use PVE::JSONSchema qw(get_standard_option);
  10 use PVE::INotify;
  11 use PVE::SectionConfig;
  12
  13 use base qw(PVE::SectionConfig);
  14
  15 PVE::JSONSchema::register_format('ldap-simple-attr', \&verify_ldap_simple_attr);
  16 sub verify_ldap_simple_attr {
  17     my ($attr, $noerr) = @_;
  18
  19     if ($attr =~ m/^[a-zA-Z0-9]+$/) {
  20         return $attr;
  21     }
  22
  23     die "value '$attr' does not look like a simple ldap attribute name\n" if !$noerr;
  24
  25     return undef;
  26 }
  27
  28 my $inotify_file_id = 'pmg-ldap.conf';
  29 my $config_filename = '/etc/pmg/ldap.conf';
  30
  31 my $defaultData = {
  32     propertyList => {
  33         type => { description => "Section type." },
  34         profile => {
  35             description => "Profile ID.",
  36             type => 'string', format => 'pve-configid',
  37         },
  38     },
  39 };
  40
  41
  42 sub properties {
  43     return {
  44         disable => {
  45             description => "Flag to disable/deactivate the entry.",
  46             type => 'boolean',
  47             optional => 1,
  48         },
  49         comment => {
  50             description => "Description.",
  51             type => 'string',
  52             optional => 1,
  53             maxLength => 4096,
  54         },
  55         mode => {
  56             description => "LDAP protocol mode ('ldap' or 'ldaps').",
  57             type => 'string',
  58             enum => ['ldap', 'ldaps'],
  59             default => 'ldap',
  60         },
  61         server1 => {
  62             description => "Server address.",
  63             type => 'string', format => 'address',
  64             maxLength => 256,
  65         },
  66         server2 => {
  67             description => "Fallback server address. Userd when the first server is not available.",
  68             type => 'string', format => 'address',
  69             maxLength => 256,
  70         },
  71         port => {
  72             description => "Specify the port to connect to.",
  73             type => 'integer',
  74             minimum => 1,
  75             maximum => 65535,
  76         },
  77         binddn => {
  78             description => "Bind domain name.",
  79             type => 'string',
  80         },
  81         bindpw => {
  82             description => "Bind password.",
  83             type => 'string',
  84         },
  85         basedn => {
  86             description => "Base domain name.",
  87             type => 'string',
  88         },
  89         groupbasedn => {
  90             description => "Base domain name for groups.",
  91             type => 'string',
  92         },
  93         filter => {
  94             description => "LDAP filter.",
  95             type => 'string',
  96         },
  97         accountattr => {
  98             description => "Account attribute name name.",
  99             type => 'string', format => 'ldap-simple-attr-list',
 100             default => 'sAMAccountName, uid',
 101         },
 102         mailattr => {
 103             description => "List of mail attribute names.",
 104             type => 'string', format => 'ldap-simple-attr-list',
 105             default => "mail, userPrincipalName, proxyAddresses, othermailbox, mailAlternativeAddress",
 106         },
 107         groupclass => {
 108             description => "List of objectclasses for groups.",
 109             type => 'string', format => 'ldap-simple-attr-list',
 110             default => "group, univentionGroup, ipausergroup",
 111         },
 112     };
 113 }
 114
 115 sub options {
 116     return {
 117         disable => { optional => 1 },
 118         comment => { optional => 1 },
 119         server1 => {  optional => 0 },
 120         server2 => {  optional => 1 },
 121         port => { optional => 1 },
 122         mode => { optional => 1 },
 123         binddn => { optional => 1 },
 124         bindpw => { optional => 1 },
 125         basedn => { optional => 1 },
 126         groupbasedn => { optional => 1 },
 127         filter => { optional => 1 },
 128         accountattr => { optional => 1 },
 129         mailattr => { optional => 1 },
 130         groupclass => { optional => 1 },
 131     };
 132 }
 133
 134 sub type {
 135     return 'ldap';
 136 }
 137
 138 sub private {
 139     return $defaultData;
 140 }
 141
 142 sub parse_section_header {
 143     my ($class, $line) = @_;
 144
 145     if ($line =~ m/^(\S+):\s*(\S+)\s*$/) {
 146         my ($type, $profileId) = ($1, $2);
 147         my $errmsg = undef; # set if you want to skip whole section
 148         eval { PVE::JSONSchema::pve_verify_configid($profileId); };
 149         $errmsg = $@ if $@;
 150         my $config = {}; # to return additional attributes
 151         return ($type, $profileId, $errmsg, $config);
 152     }
 153     return undef;
 154 }
 155
 156 sub parse_config {
 157     my ($class, $filename, $raw) = @_;
 158
 159     my $cfg = $class->SUPER::parse_config($filename, $raw);
 160
 161     foreach my $profile (keys %{$cfg->{ids}}) {
 162         my $data = $cfg->{ids}->{$profile};
 163
 164         $data->{comment} = PVE::Tools::decode_text($data->{comment})
 165             if defined($data->{comment});
 166
 167         $data->{bindpw} = decode_base64($data->{bindpw})
 168             if defined($data->{bindpw});
 169     }
 170
 171     return $cfg;
 172 }
 173
 174 sub write_config {
 175     my ($class, $filename, $cfg) = @_;
 176
 177     foreach my $profile (keys %{$cfg->{ids}}) {
 178         my $data = $cfg->{ids}->{$profile};
 179
 180         $data->{comment} = PVE::Tools::encode_text($data->{comment})
 181             if defined($data->{comment});
 182
 183         $data->{bindpw} = encode_base64($data->{bindpw}, '')
 184             if defined($data->{bindpw});
 185     }
 186
 187     $class->SUPER::write_config($filename, $cfg);
 188 }
 189
 190 sub new {
 191     my ($type) = @_;
 192
 193     my $class = ref($type) || $type;
 194
 195     my $cfg = PVE::INotify::read_file($inotify_file_id);
 196
 197     return bless $cfg, $class;
 198 }
 199
 200 sub write {
 201     my ($self) = @_;
 202
 203     PVE::INotify::write_file($inotify_file_id, $self);
 204 }
 205
 206 my $lockfile = "/var/lock/pmgldapconfig.lck";
 207
 208 sub lock_config {
 209     my ($code, $errmsg) = @_;
 210
 211     my $p = PVE::Tools::lock_file($lockfile, undef, $code);
 212     if (my $err = $@) {
 213         $errmsg ? die "$errmsg: $err" : die $err;
 214     }
 215 }
 216
 217
 218 __PACKAGE__->register();
 219 __PACKAGE__->init();
 220
 221 sub read_pmg_ldap_conf {
 222     my ($filename, $fh) = @_;
 223
 224     local $/ = undef; # slurp mode
 225
 226     my $raw = defined($fh) ? <$fh> : '';
 227
 228     return __PACKAGE__->parse_config($filename, $raw);
 229 }
 230
 231 sub write_pmg_ldap_conf {
 232     my ($filename, $fh, $cfg) = @_;
 233
 234     my $raw = __PACKAGE__->write_config($filename, $cfg);
 235
 236     my $gid = getgrnam('www-data');
 237     chown(0, $gid, $fh);
 238     chmod(0640, $fh);
 239
 240     PVE::Tools::safe_print($filename, $fh, $raw);
 241 }
 242
 243 PVE::INotify::register_file($inotify_file_id, $config_filename,
 244                             \&read_pmg_ldap_conf,
 245                             \&write_pmg_ldap_conf,
 246                             undef,
 247                             always_call_parser => 1);
 248
 249
 250 1;