]>
Commit | Line | Data |
---|---|---|
2c3a6c0a DM |
1 | package PVE::API2::AccessControl; |
2 | ||
3 | use strict; | |
4 | use warnings; | |
5 | ||
37d45deb | 6 | use PVE::Exception qw(raise raise_perm_exc); |
2c3a6c0a DM |
7 | use PVE::SafeSyslog; |
8 | use PVE::RPCEnvironment; | |
a427cecb | 9 | use PVE::Cluster qw(cfs_read_file); |
2c3a6c0a DM |
10 | use PVE::RESTHandler; |
11 | use PVE::AccessControl; | |
12 | use PVE::JSONSchema qw(get_standard_option); | |
13 | use PVE::API2::Domains; | |
14 | use PVE::API2::User; | |
15 | use PVE::API2::Group; | |
16 | use PVE::API2::Role; | |
17 | use PVE::API2::ACL; | |
18 | ||
19 | use base qw(PVE::RESTHandler); | |
20 | ||
21 | __PACKAGE__->register_method ({ | |
22 | subclass => "PVE::API2::User", | |
23 | path => 'users', | |
24 | }); | |
25 | ||
26 | __PACKAGE__->register_method ({ | |
27 | subclass => "PVE::API2::Group", | |
28 | path => 'groups', | |
29 | }); | |
30 | ||
31 | __PACKAGE__->register_method ({ | |
32 | subclass => "PVE::API2::Role", | |
33 | path => 'roles', | |
34 | }); | |
35 | ||
36 | __PACKAGE__->register_method ({ | |
37 | subclass => "PVE::API2::ACL", | |
38 | path => 'acl', | |
39 | }); | |
40 | ||
41 | __PACKAGE__->register_method ({ | |
42 | subclass => "PVE::API2::Domains", | |
43 | path => 'domains', | |
44 | }); | |
45 | ||
46 | __PACKAGE__->register_method ({ | |
47 | name => 'index', | |
48 | path => '', | |
49 | method => 'GET', | |
50 | description => "Directory index.", | |
82b63965 DM |
51 | permissions => { |
52 | user => 'all', | |
53 | }, | |
2c3a6c0a DM |
54 | parameters => { |
55 | additionalProperties => 0, | |
56 | properties => {}, | |
57 | }, | |
58 | returns => { | |
59 | type => 'array', | |
60 | items => { | |
61 | type => "object", | |
62 | properties => { | |
63 | subdir => { type => 'string' }, | |
64 | }, | |
65 | }, | |
66 | links => [ { rel => 'child', href => "{subdir}" } ], | |
67 | }, | |
68 | code => sub { | |
69 | my ($param) = @_; | |
70 | ||
71 | my $res = []; | |
72 | ||
73 | my $ma = __PACKAGE__->method_attributes(); | |
74 | ||
75 | foreach my $info (@$ma) { | |
76 | next if !$info->{subclass}; | |
77 | ||
78 | my $subpath = $info->{match_re}->[0]; | |
79 | ||
80 | push @$res, { subdir => $subpath }; | |
81 | } | |
82 | ||
83 | push @$res, { subdir => 'ticket' }; | |
37d45deb | 84 | push @$res, { subdir => 'password' }; |
2c3a6c0a DM |
85 | |
86 | return $res; | |
87 | }}); | |
88 | ||
adf8d771 DM |
89 | |
90 | my $verify_auth = sub { | |
96f8ebd6 | 91 | my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_; |
adf8d771 DM |
92 | |
93 | my $normpath = PVE::AccessControl::normalize_path($path); | |
94 | ||
95 | my $ticketuser; | |
96 | if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && | |
97 | ($ticketuser eq $username)) { | |
98 | # valid ticket | |
99 | } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) { | |
100 | # valid vnc ticket | |
101 | } else { | |
96f8ebd6 | 102 | $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); |
adf8d771 DM |
103 | } |
104 | ||
105 | my $privlist = [ PVE::Tools::split_list($privs) ]; | |
106 | if (!($normpath && scalar(@$privlist) && $rpcenv->check($username, $normpath, $privlist))) { | |
107 | die "no permission ($path, $privs)\n"; | |
108 | } | |
109 | ||
110 | return { username => $username }; | |
111 | }; | |
112 | ||
113 | my $create_ticket = sub { | |
96f8ebd6 | 114 | my ($rpcenv, $username, $pw_or_ticket, $otp) = @_; |
adf8d771 DM |
115 | |
116 | my $ticketuser; | |
117 | if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && | |
118 | ($ticketuser eq 'root@pam' || $ticketuser eq $username)) { | |
119 | # valid ticket. Note: root@pam can create tickets for other users | |
120 | } else { | |
96f8ebd6 | 121 | $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); |
adf8d771 DM |
122 | } |
123 | ||
124 | my $ticket = PVE::AccessControl::assemble_ticket($username); | |
125 | my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username); | |
126 | ||
127 | return { | |
128 | ticket => $ticket, | |
129 | username => $username, | |
130 | CSRFPreventionToken => $csrftoken, | |
131 | }; | |
132 | }; | |
133 | ||
dd2cfee0 DM |
134 | my $compute_api_permission = sub { |
135 | my ($rpcenv, $authuser) = @_; | |
136 | ||
137 | my $usercfg = $rpcenv->{user_cfg}; | |
138 | ||
a2c18811 TL |
139 | my $res = {}; |
140 | my $priv_re_map = { | |
141 | vms => qr/VM\.|Permissions\.Modify/, | |
142 | access => qr/(User|Group)\.|Permissions\.Modify/, | |
143 | storage => qr/Datastore\./, | |
144 | nodes => qr/Sys\.|Permissions\.Modify/, | |
145 | dc => qr/Sys\.Audit/, | |
dd2cfee0 | 146 | }; |
a2c18811 TL |
147 | map { $res->{$_} = {} } keys %$priv_re_map; |
148 | ||
149 | my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage']; | |
150 | ||
151 | my $checked_paths = {}; | |
152 | foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) { | |
153 | next if $checked_paths->{$path}; | |
154 | $checked_paths->{$path} = 1; | |
155 | ||
156 | my $path_perm = $rpcenv->permissions($authuser, $path); | |
157 | ||
158 | my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc'; | |
159 | if ($toplevel eq 'pool') { | |
160 | foreach my $priv (keys %$path_perm) { | |
161 | if ($priv =~ m/^VM\./) { | |
162 | $res->{vms}->{$priv} = 1; | |
163 | } elsif ($priv =~ m/^Datastore\./) { | |
164 | $res->{storage}->{$priv} = 1; | |
165 | } elsif ($priv eq 'Permissions.Modify') { | |
166 | $res->{storage}->{$priv} = 1; | |
167 | $res->{vms}->{$priv} = 1; | |
168 | } | |
169 | } | |
170 | } else { | |
171 | my $priv_regex = $priv_re_map->{$toplevel} // next; | |
172 | foreach my $priv (keys %$path_perm) { | |
173 | next if $priv !~ m/^($priv_regex)/; | |
174 | $res->{$toplevel}->{$priv} = 1; | |
175 | } | |
dd2cfee0 DM |
176 | } |
177 | } | |
178 | ||
dd2cfee0 DM |
179 | return $res; |
180 | }; | |
181 | ||
39e4e363 DM |
182 | __PACKAGE__->register_method ({ |
183 | name => 'get_ticket', | |
184 | path => 'ticket', | |
185 | method => 'GET', | |
186 | permissions => { user => 'world' }, | |
36dd9dbd | 187 | description => "Dummy. Useful for formatters which want to provide a login page.", |
39e4e363 DM |
188 | parameters => { |
189 | additionalProperties => 0, | |
190 | }, | |
191 | returns => { type => "null" }, | |
192 | code => sub { return undef; }}); | |
193 | ||
2c3a6c0a DM |
194 | __PACKAGE__->register_method ({ |
195 | name => 'create_ticket', | |
196 | path => 'ticket', | |
197 | method => 'POST', | |
96919234 DM |
198 | permissions => { |
199 | description => "You need to pass valid credientials.", | |
200 | user => 'world' | |
201 | }, | |
2c3a6c0a | 202 | protected => 1, # else we can't access shadow files |
adf8d771 | 203 | description => "Create or verify authentication ticket.", |
2c3a6c0a DM |
204 | parameters => { |
205 | additionalProperties => 0, | |
206 | properties => { | |
207 | username => { | |
208 | description => "User name", | |
209 | type => 'string', | |
210 | maxLength => 64, | |
3e5bfdf6 | 211 | completion => \&PVE::AccessControl::complete_username, |
2c3a6c0a DM |
212 | }, |
213 | realm => get_standard_option('realm', { | |
214 | description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.", | |
3e5bfdf6 DM |
215 | optional => 1, |
216 | completion => \&PVE::AccessControl::complete_realm, | |
217 | }), | |
2c3a6c0a DM |
218 | password => { |
219 | description => "The secret password. This can also be a valid ticket.", | |
220 | type => 'string', | |
221 | }, | |
96f8ebd6 DM |
222 | otp => { |
223 | description => "One-time password for Two-factor authentication.", | |
224 | type => 'string', | |
225 | optional => 1, | |
226 | }, | |
2c3a6c0a | 227 | path => { |
adf8d771 | 228 | description => "Verify ticket, and check if user have access 'privs' on 'path'", |
2c3a6c0a DM |
229 | type => 'string', |
230 | requires => 'privs', | |
231 | optional => 1, | |
232 | maxLength => 64, | |
233 | }, | |
234 | privs => { | |
adf8d771 | 235 | description => "Verify ticket, and check if user have access 'privs' on 'path'", |
2c3a6c0a DM |
236 | type => 'string' , format => 'pve-priv-list', |
237 | requires => 'path', | |
238 | optional => 1, | |
239 | maxLength => 64, | |
240 | }, | |
241 | } | |
242 | }, | |
243 | returns => { | |
244 | type => "object", | |
245 | properties => { | |
2c3a6c0a | 246 | username => { type => 'string' }, |
adf8d771 DM |
247 | ticket => { type => 'string', optional => 1}, |
248 | CSRFPreventionToken => { type => 'string', optional => 1 }, | |
2c3a6c0a DM |
249 | } |
250 | }, | |
251 | code => sub { | |
252 | my ($param) = @_; | |
253 | ||
254 | my $username = $param->{username}; | |
255 | $username .= "\@$param->{realm}" if $param->{realm}; | |
256 | ||
257 | my $rpcenv = PVE::RPCEnvironment::get(); | |
2c3a6c0a | 258 | |
adf8d771 | 259 | my $res; |
adf8d771 | 260 | eval { |
7070c1ae DM |
261 | # test if user exists and is enabled |
262 | $rpcenv->check_user_enabled($username); | |
263 | ||
2c3a6c0a | 264 | if ($param->{path} && $param->{privs}) { |
96f8ebd6 | 265 | $res = &$verify_auth($rpcenv, $username, $param->{password}, $param->{otp}, |
adf8d771 | 266 | $param->{path}, $param->{privs}); |
2c3a6c0a | 267 | } else { |
96f8ebd6 | 268 | $res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp}); |
2c3a6c0a | 269 | } |
2c3a6c0a DM |
270 | }; |
271 | if (my $err = $@) { | |
adf8d771 | 272 | my $clientip = $rpcenv->get_client_ip() || ''; |
2c3a6c0a | 273 | syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err"); |
6126ab75 | 274 | # do not return any info to prevent user enumeration attacks |
fe2defd9 | 275 | die PVE::Exception->new("authentication failure\n", code => 401); |
2c3a6c0a DM |
276 | } |
277 | ||
dd2cfee0 DM |
278 | $res->{cap} = &$compute_api_permission($rpcenv, $username); |
279 | ||
2c3a6c0a DM |
280 | PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'"); |
281 | ||
adf8d771 | 282 | return $res; |
2c3a6c0a DM |
283 | }}); |
284 | ||
37d45deb DM |
285 | __PACKAGE__->register_method ({ |
286 | name => 'change_passsword', | |
287 | path => 'password', | |
288 | method => 'PUT', | |
12683df7 | 289 | permissions => { |
82b63965 | 290 | description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user <userid>) and 'User.Modify' permission on /access/groups/<group> on a group where user <userid> is member of.", |
12683df7 DM |
291 | check => [ 'or', |
292 | ['userid-param', 'self'], | |
82b63965 DM |
293 | [ 'and', |
294 | [ 'userid-param', 'Realm.AllocateUser'], | |
295 | [ 'userid-group', ['User.Modify']] | |
296 | ] | |
12683df7 DM |
297 | ], |
298 | }, | |
37d45deb DM |
299 | protected => 1, # else we can't access shadow files |
300 | description => "Change user password.", | |
301 | parameters => { | |
302 | additionalProperties => 0, | |
303 | properties => { | |
3e5bfdf6 DM |
304 | userid => get_standard_option('userid', { |
305 | completion => \&PVE::AccessControl::complete_username, | |
306 | }), | |
37d45deb DM |
307 | password => { |
308 | description => "The new password.", | |
309 | type => 'string', | |
310 | minLength => 5, | |
311 | maxLength => 64, | |
312 | }, | |
313 | } | |
314 | }, | |
315 | returns => { type => "null" }, | |
316 | code => sub { | |
317 | my ($param) = @_; | |
318 | ||
319 | my $rpcenv = PVE::RPCEnvironment::get(); | |
320 | my $authuser = $rpcenv->get_user(); | |
321 | ||
322 | my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid}); | |
323 | ||
12683df7 | 324 | $rpcenv->check_user_exist($userid); |
37d45deb DM |
325 | |
326 | if ($authuser eq 'root@pam') { | |
327 | # OK - root can change anything | |
328 | } else { | |
329 | if ($authuser eq $userid) { | |
330 | $rpcenv->check_user_enabled($userid); | |
331 | # OK - each user can change its own password | |
332 | } else { | |
12683df7 | 333 | # only root may change root password |
37d45deb | 334 | raise_perm_exc() if $userid eq 'root@pam'; |
59321f26 DM |
335 | # do not allow to change system user passwords |
336 | raise_perm_exc() if $realm eq 'pam'; | |
37d45deb DM |
337 | } |
338 | } | |
339 | ||
340 | PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password}); | |
341 | ||
342 | PVE::Cluster::log_msg('info', 'root@pam', "changed password for user '$userid'"); | |
343 | ||
344 | return undef; | |
345 | }}); | |
346 | ||
2c3a6c0a | 347 | 1; |