]>
Commit | Line | Data |
---|---|---|
2c3a6c0a DM |
1 | package PVE::API2::AccessControl; |
2 | ||
3 | use strict; | |
4 | use warnings; | |
5 | ||
2b4c98ab WB |
6 | use JSON; |
7 | use MIME::Base64; | |
8 | ||
e240695b | 9 | use PVE::Exception qw(raise raise_perm_exc raise_param_exc); |
2c3a6c0a DM |
10 | use PVE::SafeSyslog; |
11 | use PVE::RPCEnvironment; | |
a427cecb | 12 | use PVE::Cluster qw(cfs_read_file); |
158514a8 | 13 | use PVE::DataCenterConfig; |
2c3a6c0a DM |
14 | use PVE::RESTHandler; |
15 | use PVE::AccessControl; | |
16 | use PVE::JSONSchema qw(get_standard_option); | |
17 | use PVE::API2::Domains; | |
18 | use PVE::API2::User; | |
19 | use PVE::API2::Group; | |
20 | use PVE::API2::Role; | |
21 | use PVE::API2::ACL; | |
ac344d7d | 22 | use PVE::API2::OpenId; |
dc547a13 | 23 | use PVE::API2::TFA; |
8967f86f | 24 | use PVE::Auth::Plugin; |
47d731c7 | 25 | use PVE::OTP; |
2c3a6c0a | 26 | |
2b4c98ab WB |
27 | my $u2f_available = 0; |
28 | eval { | |
29 | require PVE::U2F; | |
30 | $u2f_available = 1; | |
31 | }; | |
32 | ||
2c3a6c0a DM |
33 | use base qw(PVE::RESTHandler); |
34 | ||
35 | __PACKAGE__->register_method ({ | |
30dd4869 | 36 | subclass => "PVE::API2::User", |
2c3a6c0a DM |
37 | path => 'users', |
38 | }); | |
39 | ||
40 | __PACKAGE__->register_method ({ | |
30dd4869 | 41 | subclass => "PVE::API2::Group", |
2c3a6c0a DM |
42 | path => 'groups', |
43 | }); | |
44 | ||
45 | __PACKAGE__->register_method ({ | |
30dd4869 | 46 | subclass => "PVE::API2::Role", |
2c3a6c0a DM |
47 | path => 'roles', |
48 | }); | |
49 | ||
50 | __PACKAGE__->register_method ({ | |
30dd4869 | 51 | subclass => "PVE::API2::ACL", |
2c3a6c0a DM |
52 | path => 'acl', |
53 | }); | |
54 | ||
55 | __PACKAGE__->register_method ({ | |
30dd4869 | 56 | subclass => "PVE::API2::Domains", |
2c3a6c0a DM |
57 | path => 'domains', |
58 | }); | |
59 | ||
ac344d7d DM |
60 | __PACKAGE__->register_method ({ |
61 | subclass => "PVE::API2::OpenId", | |
62 | path => 'openid', | |
63 | }); | |
64 | ||
dc547a13 WB |
65 | __PACKAGE__->register_method ({ |
66 | subclass => "PVE::API2::TFA", | |
67 | path => 'tfa', | |
68 | }); | |
69 | ||
2c3a6c0a | 70 | __PACKAGE__->register_method ({ |
30dd4869 TM |
71 | name => 'index', |
72 | path => '', | |
2c3a6c0a DM |
73 | method => 'GET', |
74 | description => "Directory index.", | |
30dd4869 | 75 | permissions => { |
82b63965 DM |
76 | user => 'all', |
77 | }, | |
2c3a6c0a DM |
78 | parameters => { |
79 | additionalProperties => 0, | |
80 | properties => {}, | |
81 | }, | |
82 | returns => { | |
83 | type => 'array', | |
84 | items => { | |
85 | type => "object", | |
86 | properties => { | |
87 | subdir => { type => 'string' }, | |
88 | }, | |
89 | }, | |
90 | links => [ { rel => 'child', href => "{subdir}" } ], | |
91 | }, | |
92 | code => sub { | |
93 | my ($param) = @_; | |
30dd4869 | 94 | |
2c3a6c0a DM |
95 | my $res = []; |
96 | ||
97 | my $ma = __PACKAGE__->method_attributes(); | |
98 | ||
99 | foreach my $info (@$ma) { | |
100 | next if !$info->{subclass}; | |
101 | ||
102 | my $subpath = $info->{match_re}->[0]; | |
103 | ||
104 | push @$res, { subdir => $subpath }; | |
105 | } | |
106 | ||
107 | push @$res, { subdir => 'ticket' }; | |
37d45deb | 108 | push @$res, { subdir => 'password' }; |
2c3a6c0a DM |
109 | |
110 | return $res; | |
111 | }}); | |
112 | ||
adf8d771 | 113 | |
cfd8636b WB |
114 | my sub verify_auth : prototype($$$$$$) { |
115 | my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_; | |
adf8d771 DM |
116 | |
117 | my $normpath = PVE::AccessControl::normalize_path($path); | |
37d3c16b | 118 | die "invalid path - $path\n" if defined($path) && !defined($normpath); |
adf8d771 DM |
119 | |
120 | my $ticketuser; | |
121 | if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && | |
122 | ($ticketuser eq $username)) { | |
123 | # valid ticket | |
124 | } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) { | |
125 | # valid vnc ticket | |
126 | } else { | |
afb10353 WB |
127 | $username = PVE::AccessControl::authenticate_user( |
128 | $username, | |
129 | $pw_or_ticket, | |
130 | $otp, | |
afb10353 | 131 | ); |
adf8d771 DM |
132 | } |
133 | ||
134 | my $privlist = [ PVE::Tools::split_list($privs) ]; | |
135 | if (!($normpath && scalar(@$privlist) && $rpcenv->check($username, $normpath, $privlist))) { | |
136 | die "no permission ($path, $privs)\n"; | |
137 | } | |
138 | ||
139 | return { username => $username }; | |
140 | }; | |
141 | ||
cfd8636b WB |
142 | my sub create_ticket_do : prototype($$$$$) { |
143 | my ($rpcenv, $username, $pw_or_ticket, $otp, $tfa_challenge) = @_; | |
afb10353 WB |
144 | |
145 | die "TFA response should be in 'password', not 'otp' when 'tfa-challenge' is set\n" | |
146 | if defined($otp) && defined($tfa_challenge); | |
147 | ||
148 | my ($ticketuser, undef, $tfa_info); | |
149 | if (!defined($tfa_challenge)) { | |
150 | # We only verify this ticket if we're not responding to a TFA challenge, as in that case | |
151 | # it is a TFA-data ticket and will be verified by `authenticate_user`. | |
152 | ||
153 | ($ticketuser, undef, $tfa_info) = PVE::AccessControl::verify_ticket($pw_or_ticket, 1); | |
154 | } | |
adf8d771 | 155 | |
f25628d3 WB |
156 | if (defined($ticketuser) && ($ticketuser eq 'root@pam' || $ticketuser eq $username)) { |
157 | if (defined($tfa_info)) { | |
158 | die "incomplete ticket\n"; | |
159 | } | |
adf8d771 DM |
160 | # valid ticket. Note: root@pam can create tickets for other users |
161 | } else { | |
afb10353 WB |
162 | ($username, $tfa_info) = PVE::AccessControl::authenticate_user( |
163 | $username, | |
164 | $pw_or_ticket, | |
165 | $otp, | |
afb10353 WB |
166 | $tfa_challenge, |
167 | ); | |
18f8ba18 WB |
168 | } |
169 | ||
170 | my %extra; | |
171 | my $ticket_data = $username; | |
afb10353 | 172 | my $aad; |
cfd8636b | 173 | if (defined($tfa_info)) { |
f25628d3 | 174 | $extra{NeedTFA} = 1; |
cfd8636b WB |
175 | $ticket_data = "!tfa!$tfa_info"; |
176 | $aad = $username; | |
adf8d771 DM |
177 | } |
178 | ||
afb10353 | 179 | my $ticket = PVE::AccessControl::assemble_ticket($ticket_data, $aad); |
adf8d771 DM |
180 | my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username); |
181 | ||
182 | return { | |
183 | ticket => $ticket, | |
184 | username => $username, | |
185 | CSRFPreventionToken => $csrftoken, | |
18f8ba18 | 186 | %extra, |
adf8d771 DM |
187 | }; |
188 | }; | |
189 | ||
39e4e363 | 190 | __PACKAGE__->register_method ({ |
30dd4869 TM |
191 | name => 'get_ticket', |
192 | path => 'ticket', | |
39e4e363 DM |
193 | method => 'GET', |
194 | permissions => { user => 'world' }, | |
36dd9dbd | 195 | description => "Dummy. Useful for formatters which want to provide a login page.", |
39e4e363 DM |
196 | parameters => { |
197 | additionalProperties => 0, | |
198 | }, | |
199 | returns => { type => "null" }, | |
200 | code => sub { return undef; }}); | |
30dd4869 | 201 | |
2c3a6c0a | 202 | __PACKAGE__->register_method ({ |
30dd4869 TM |
203 | name => 'create_ticket', |
204 | path => 'ticket', | |
2c3a6c0a | 205 | method => 'POST', |
30dd4869 | 206 | permissions => { |
96919234 | 207 | description => "You need to pass valid credientials.", |
30dd4869 | 208 | user => 'world' |
96919234 | 209 | }, |
2c3a6c0a | 210 | protected => 1, # else we can't access shadow files |
49372390 | 211 | allowtoken => 0, # we don't want tokens to create tickets |
adf8d771 | 212 | description => "Create or verify authentication ticket.", |
2c3a6c0a DM |
213 | parameters => { |
214 | additionalProperties => 0, | |
215 | properties => { | |
216 | username => { | |
3a5ae7a0 SI |
217 | description => "User name", |
218 | type => 'string', | |
219 | maxLength => 64, | |
220 | completion => \&PVE::AccessControl::complete_username, | |
2c3a6c0a DM |
221 | }, |
222 | realm => get_standard_option('realm', { | |
223 | description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.", | |
3e5bfdf6 DM |
224 | optional => 1, |
225 | completion => \&PVE::AccessControl::complete_realm, | |
226 | }), | |
30dd4869 | 227 | password => { |
2c3a6c0a DM |
228 | description => "The secret password. This can also be a valid ticket.", |
229 | type => 'string', | |
230 | }, | |
96f8ebd6 DM |
231 | otp => { |
232 | description => "One-time password for Two-factor authentication.", | |
233 | type => 'string', | |
234 | optional => 1, | |
235 | }, | |
2c3a6c0a | 236 | path => { |
adf8d771 | 237 | description => "Verify ticket, and check if user have access 'privs' on 'path'", |
2c3a6c0a DM |
238 | type => 'string', |
239 | requires => 'privs', | |
240 | optional => 1, | |
241 | maxLength => 64, | |
242 | }, | |
30dd4869 | 243 | privs => { |
adf8d771 | 244 | description => "Verify ticket, and check if user have access 'privs' on 'path'", |
2c3a6c0a DM |
245 | type => 'string' , format => 'pve-priv-list', |
246 | requires => 'path', | |
247 | optional => 1, | |
248 | maxLength => 64, | |
249 | }, | |
afb10353 WB |
250 | 'new-format' => { |
251 | type => 'boolean', | |
cfd8636b | 252 | description => 'This parameter is now ignored and assumed to be 1.', |
afb10353 | 253 | optional => 1, |
cfd8636b | 254 | default => 1, |
afb10353 WB |
255 | }, |
256 | 'tfa-challenge' => { | |
257 | type => 'string', | |
258 | description => "The signed TFA challenge string the user wants to respond to.", | |
259 | optional => 1, | |
260 | }, | |
2c3a6c0a DM |
261 | } |
262 | }, | |
263 | returns => { | |
264 | type => "object", | |
265 | properties => { | |
2c3a6c0a | 266 | username => { type => 'string' }, |
adf8d771 DM |
267 | ticket => { type => 'string', optional => 1}, |
268 | CSRFPreventionToken => { type => 'string', optional => 1 }, | |
e842fec5 | 269 | clustername => { type => 'string', optional => 1 }, |
18f8ba18 | 270 | # cap => computed api permissions, unless there's a u2f challenge |
2c3a6c0a DM |
271 | } |
272 | }, | |
273 | code => sub { | |
274 | my ($param) = @_; | |
30dd4869 | 275 | |
2c3a6c0a DM |
276 | my $username = $param->{username}; |
277 | $username .= "\@$param->{realm}" if $param->{realm}; | |
278 | ||
eb41d200 | 279 | $username = PVE::AccessControl::lookup_username($username); |
2c3a6c0a | 280 | my $rpcenv = PVE::RPCEnvironment::get(); |
2c3a6c0a | 281 | |
adf8d771 | 282 | my $res; |
adf8d771 | 283 | eval { |
7070c1ae DM |
284 | # test if user exists and is enabled |
285 | $rpcenv->check_user_enabled($username); | |
286 | ||
2c3a6c0a | 287 | if ($param->{path} && $param->{privs}) { |
afb10353 | 288 | $res = verify_auth($rpcenv, $username, $param->{password}, $param->{otp}, |
cfd8636b | 289 | $param->{path}, $param->{privs}); |
2c3a6c0a | 290 | } else { |
afb10353 WB |
291 | $res = create_ticket_do( |
292 | $rpcenv, | |
293 | $username, | |
294 | $param->{password}, | |
295 | $param->{otp}, | |
afb10353 WB |
296 | $param->{'tfa-challenge'}, |
297 | ); | |
2c3a6c0a | 298 | } |
2c3a6c0a DM |
299 | }; |
300 | if (my $err = $@) { | |
adf8d771 | 301 | my $clientip = $rpcenv->get_client_ip() || ''; |
2c3a6c0a | 302 | syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err"); |
6126ab75 | 303 | # do not return any info to prevent user enumeration attacks |
fe2defd9 | 304 | die PVE::Exception->new("authentication failure\n", code => 401); |
2c3a6c0a DM |
305 | } |
306 | ||
ac344d7d | 307 | $res->{cap} = $rpcenv->compute_api_permission($username) |
f25628d3 | 308 | if !defined($res->{NeedTFA}); |
dd2cfee0 | 309 | |
0fb0c62d FG |
310 | my $clinfo = PVE::Cluster::get_clinfo(); |
311 | if ($clinfo->{cluster}->{name} && $rpcenv->check($username, '/', ['Sys.Audit'], 1)) { | |
312 | $res->{clustername} = $clinfo->{cluster}->{name}; | |
e842fec5 TL |
313 | } |
314 | ||
2c3a6c0a DM |
315 | PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'"); |
316 | ||
adf8d771 | 317 | return $res; |
2c3a6c0a DM |
318 | }}); |
319 | ||
37d45deb | 320 | __PACKAGE__->register_method ({ |
765305e2 | 321 | name => 'change_password', |
30dd4869 | 322 | path => 'password', |
37d45deb | 323 | method => 'PUT', |
30dd4869 | 324 | permissions => { |
82b63965 | 325 | description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user <userid>) and 'User.Modify' permission on /access/groups/<group> on a group where user <userid> is member of.", |
30dd4869 | 326 | check => [ 'or', |
12683df7 | 327 | ['userid-param', 'self'], |
82b63965 DM |
328 | [ 'and', |
329 | [ 'userid-param', 'Realm.AllocateUser'], | |
330 | [ 'userid-group', ['User.Modify']] | |
331 | ] | |
12683df7 DM |
332 | ], |
333 | }, | |
37d45deb | 334 | protected => 1, # else we can't access shadow files |
49372390 | 335 | allowtoken => 0, # we don't want tokens to change the regular user password |
37d45deb DM |
336 | description => "Change user password.", |
337 | parameters => { | |
338 | additionalProperties => 0, | |
339 | properties => { | |
3a5ae7a0 | 340 | userid => get_standard_option('userid-completed'), |
30dd4869 | 341 | password => { |
37d45deb DM |
342 | description => "The new password.", |
343 | type => 'string', | |
30dd4869 | 344 | minLength => 5, |
37d45deb DM |
345 | maxLength => 64, |
346 | }, | |
5bcf553e | 347 | 'confirmation-password' => $PVE::API2::TFA::OPTIONAL_PASSWORD_SCHEMA, |
37d45deb DM |
348 | } |
349 | }, | |
350 | returns => { type => "null" }, | |
351 | code => sub { | |
352 | my ($param) = @_; | |
353 | ||
354 | my $rpcenv = PVE::RPCEnvironment::get(); | |
355 | my $authuser = $rpcenv->get_user(); | |
356 | ||
5bcf553e WB |
357 | my ($userid, $ruid, $realm) = $rpcenv->reauth_user_for_user_modification( |
358 | $authuser, | |
359 | $param->{userid}, | |
360 | $param->{'confirmation-password'}, | |
361 | 'confirmation-password', | |
362 | ); | |
37d45deb DM |
363 | |
364 | if ($authuser eq 'root@pam') { | |
365 | # OK - root can change anything | |
366 | } else { | |
367 | if ($authuser eq $userid) { | |
368 | $rpcenv->check_user_enabled($userid); | |
369 | # OK - each user can change its own password | |
370 | } else { | |
12683df7 | 371 | # only root may change root password |
37d45deb | 372 | raise_perm_exc() if $userid eq 'root@pam'; |
59321f26 DM |
373 | # do not allow to change system user passwords |
374 | raise_perm_exc() if $realm eq 'pam'; | |
37d45deb DM |
375 | } |
376 | } | |
377 | ||
378 | PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password}); | |
379 | ||
380 | PVE::Cluster::log_msg('info', 'root@pam', "changed password for user '$userid'"); | |
381 | ||
382 | return undef; | |
383 | }}); | |
384 | ||
2b4c98ab WB |
385 | sub get_u2f_config() { |
386 | die "u2f support not available\n" if !$u2f_available; | |
387 | ||
388 | my $dc = cfs_read_file('datacenter.cfg'); | |
389 | my $u2f = $dc->{u2f}; | |
390 | die "u2f not configured in datacenter.cfg\n" if !$u2f; | |
2b4c98ab WB |
391 | return $u2f; |
392 | } | |
393 | ||
394 | sub get_u2f_instance { | |
395 | my ($rpcenv, $publicKey, $keyHandle) = @_; | |
396 | ||
397 | # We store the public key base64 encoded (as the api provides it in binary) | |
398 | $publicKey = decode_base64($publicKey) if defined($publicKey); | |
399 | ||
400 | my $u2fconfig = get_u2f_config(); | |
401 | my $u2f = PVE::U2F->new(); | |
402 | ||
403 | # via the 'Host' header (in case a node has multiple hosts available). | |
404 | my $origin = $u2fconfig->{origin}; | |
405 | if (!defined($origin)) { | |
406 | $origin = $rpcenv->get_request_host(1); | |
407 | if ($origin) { | |
408 | $origin = "https://$origin"; | |
409 | } else { | |
410 | die "failed to figure out u2f origin\n"; | |
411 | } | |
412 | } | |
413 | ||
414 | my $appid = $u2fconfig->{appid} // $origin; | |
415 | $u2f->set_appid($appid); | |
416 | $u2f->set_origin($origin); | |
417 | $u2f->set_publicKey($publicKey) if defined($publicKey); | |
418 | $u2f->set_keyHandle($keyHandle) if defined($keyHandle); | |
419 | return $u2f; | |
420 | } | |
421 | ||
47d731c7 WB |
422 | sub verify_user_tfa_config { |
423 | my ($type, $tfa_cfg, $value) = @_; | |
424 | ||
425 | if (!defined($type)) { | |
426 | die "missing tfa 'type'\n"; | |
427 | } | |
428 | ||
429 | if ($type ne 'oath') { | |
430 | die "invalid type for custom tfa authentication\n"; | |
431 | } | |
432 | ||
433 | my $secret = $tfa_cfg->{keys} | |
434 | or die "missing TOTP secret\n"; | |
435 | $tfa_cfg = $tfa_cfg->{config}; | |
436 | # Copy the hash to verify that we have no unexpected keys without modifying the original hash. | |
437 | $tfa_cfg = {%$tfa_cfg}; | |
438 | ||
439 | # We can only verify 1 secret but oath_verify_otp allows multiple: | |
440 | if (scalar(PVE::Tools::split_list($secret)) != 1) { | |
441 | die "only exactly one secret key allowed\n"; | |
442 | } | |
443 | ||
444 | my $digits = delete($tfa_cfg->{digits}) // 6; | |
445 | my $step = delete($tfa_cfg->{step}) // 30; | |
446 | # Maybe also this? | |
447 | # my $algorithm = delete($tfa_cfg->{algorithm}) // 'sha1'; | |
448 | ||
449 | if (length(my $more = join(', ', keys %$tfa_cfg))) { | |
450 | die "unexpected tfa config keys: $more\n"; | |
451 | } | |
452 | ||
453 | PVE::OTP::oath_verify_otp($value, $secret, $step, $digits); | |
454 | } | |
455 | ||
2b4c98ab | 456 | |
c3fa8a36 FG |
457 | __PACKAGE__->register_method({ |
458 | name => 'permissions', | |
459 | path => 'permissions', | |
460 | method => 'GET', | |
461 | description => 'Retrieve effective permissions of given user/token.', | |
462 | permissions => { | |
463 | description => "Each user/token is allowed to dump their own permissions. A user can dump the permissions of another user if they have 'Sys.Audit' permission on /access.", | |
464 | user => 'all', | |
465 | }, | |
466 | parameters => { | |
467 | additionalProperties => 0, | |
468 | properties => { | |
469 | userid => { | |
470 | type => 'string', | |
471 | description => "User ID or full API token ID", | |
472 | pattern => $PVE::AccessControl::userid_or_token_regex, | |
473 | optional => 1, | |
474 | }, | |
475 | path => get_standard_option('acl-path', { | |
476 | description => "Only dump this specific path, not the whole tree.", | |
477 | optional => 1, | |
478 | }), | |
479 | }, | |
480 | }, | |
481 | returns => { | |
482 | type => 'object', | |
483 | description => 'Map of "path" => (Map of "privilege" => "propagate boolean").', | |
484 | }, | |
485 | code => sub { | |
486 | my ($param) = @_; | |
487 | ||
488 | my $rpcenv = PVE::RPCEnvironment::get(); | |
489 | ||
490 | my $userid = $param->{userid}; | |
491 | if (defined($userid)) { | |
492 | $rpcenv->check($rpcenv->get_user(), '/access', ['Sys.Audit']); | |
493 | } else { | |
494 | $userid = $rpcenv->get_user(); | |
495 | } | |
496 | ||
497 | my $res; | |
498 | ||
499 | if (my $path = $param->{path}) { | |
500 | my $perms = $rpcenv->permissions($userid, $path); | |
501 | if ($perms) { | |
502 | $res = { $path => $perms }; | |
503 | } else { | |
504 | $res = {}; | |
505 | } | |
506 | } else { | |
507 | $res = $rpcenv->get_effective_permissions($userid); | |
508 | } | |
509 | ||
510 | return $res; | |
511 | }}); | |
512 | ||
2c3a6c0a | 513 | 1; |