]>
Commit | Line | Data |
---|---|---|
2c3a6c0a DM |
1 | package PVE::API2::AccessControl; |
2 | ||
3 | use strict; | |
4 | use warnings; | |
5 | ||
2b4c98ab WB |
6 | use JSON; |
7 | use MIME::Base64; | |
8 | ||
e240695b | 9 | use PVE::Exception qw(raise raise_perm_exc raise_param_exc); |
2c3a6c0a DM |
10 | use PVE::SafeSyslog; |
11 | use PVE::RPCEnvironment; | |
a427cecb | 12 | use PVE::Cluster qw(cfs_read_file); |
158514a8 | 13 | use PVE::DataCenterConfig; |
2c3a6c0a DM |
14 | use PVE::RESTHandler; |
15 | use PVE::AccessControl; | |
16 | use PVE::JSONSchema qw(get_standard_option); | |
17 | use PVE::API2::Domains; | |
18 | use PVE::API2::User; | |
19 | use PVE::API2::Group; | |
20 | use PVE::API2::Role; | |
21 | use PVE::API2::ACL; | |
ac344d7d | 22 | use PVE::API2::OpenId; |
8967f86f | 23 | use PVE::Auth::Plugin; |
47d731c7 | 24 | use PVE::OTP; |
2c3a6c0a | 25 | |
2b4c98ab WB |
26 | my $u2f_available = 0; |
27 | eval { | |
28 | require PVE::U2F; | |
29 | $u2f_available = 1; | |
30 | }; | |
31 | ||
2c3a6c0a DM |
32 | use base qw(PVE::RESTHandler); |
33 | ||
34 | __PACKAGE__->register_method ({ | |
30dd4869 | 35 | subclass => "PVE::API2::User", |
2c3a6c0a DM |
36 | path => 'users', |
37 | }); | |
38 | ||
39 | __PACKAGE__->register_method ({ | |
30dd4869 | 40 | subclass => "PVE::API2::Group", |
2c3a6c0a DM |
41 | path => 'groups', |
42 | }); | |
43 | ||
44 | __PACKAGE__->register_method ({ | |
30dd4869 | 45 | subclass => "PVE::API2::Role", |
2c3a6c0a DM |
46 | path => 'roles', |
47 | }); | |
48 | ||
49 | __PACKAGE__->register_method ({ | |
30dd4869 | 50 | subclass => "PVE::API2::ACL", |
2c3a6c0a DM |
51 | path => 'acl', |
52 | }); | |
53 | ||
54 | __PACKAGE__->register_method ({ | |
30dd4869 | 55 | subclass => "PVE::API2::Domains", |
2c3a6c0a DM |
56 | path => 'domains', |
57 | }); | |
58 | ||
ac344d7d DM |
59 | __PACKAGE__->register_method ({ |
60 | subclass => "PVE::API2::OpenId", | |
61 | path => 'openid', | |
62 | }); | |
63 | ||
2c3a6c0a | 64 | __PACKAGE__->register_method ({ |
30dd4869 TM |
65 | name => 'index', |
66 | path => '', | |
2c3a6c0a DM |
67 | method => 'GET', |
68 | description => "Directory index.", | |
30dd4869 | 69 | permissions => { |
82b63965 DM |
70 | user => 'all', |
71 | }, | |
2c3a6c0a DM |
72 | parameters => { |
73 | additionalProperties => 0, | |
74 | properties => {}, | |
75 | }, | |
76 | returns => { | |
77 | type => 'array', | |
78 | items => { | |
79 | type => "object", | |
80 | properties => { | |
81 | subdir => { type => 'string' }, | |
82 | }, | |
83 | }, | |
84 | links => [ { rel => 'child', href => "{subdir}" } ], | |
85 | }, | |
86 | code => sub { | |
87 | my ($param) = @_; | |
30dd4869 | 88 | |
2c3a6c0a DM |
89 | my $res = []; |
90 | ||
91 | my $ma = __PACKAGE__->method_attributes(); | |
92 | ||
93 | foreach my $info (@$ma) { | |
94 | next if !$info->{subclass}; | |
95 | ||
96 | my $subpath = $info->{match_re}->[0]; | |
97 | ||
98 | push @$res, { subdir => $subpath }; | |
99 | } | |
100 | ||
101 | push @$res, { subdir => 'ticket' }; | |
37d45deb | 102 | push @$res, { subdir => 'password' }; |
2c3a6c0a DM |
103 | |
104 | return $res; | |
105 | }}); | |
106 | ||
adf8d771 | 107 | |
afb10353 WB |
108 | my sub verify_auth : prototype($$$$$$$) { |
109 | my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs, $new_format) = @_; | |
adf8d771 DM |
110 | |
111 | my $normpath = PVE::AccessControl::normalize_path($path); | |
112 | ||
113 | my $ticketuser; | |
114 | if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && | |
115 | ($ticketuser eq $username)) { | |
116 | # valid ticket | |
117 | } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) { | |
118 | # valid vnc ticket | |
119 | } else { | |
afb10353 WB |
120 | $username = PVE::AccessControl::authenticate_user( |
121 | $username, | |
122 | $pw_or_ticket, | |
123 | $otp, | |
124 | $new_format, | |
125 | ); | |
adf8d771 DM |
126 | } |
127 | ||
128 | my $privlist = [ PVE::Tools::split_list($privs) ]; | |
129 | if (!($normpath && scalar(@$privlist) && $rpcenv->check($username, $normpath, $privlist))) { | |
130 | die "no permission ($path, $privs)\n"; | |
131 | } | |
132 | ||
133 | return { username => $username }; | |
134 | }; | |
135 | ||
afb10353 WB |
136 | my sub create_ticket_do : prototype($$$$$$) { |
137 | my ($rpcenv, $username, $pw_or_ticket, $otp, $new_format, $tfa_challenge) = @_; | |
138 | ||
139 | die "TFA response should be in 'password', not 'otp' when 'tfa-challenge' is set\n" | |
140 | if defined($otp) && defined($tfa_challenge); | |
141 | ||
142 | my ($ticketuser, undef, $tfa_info); | |
143 | if (!defined($tfa_challenge)) { | |
144 | # We only verify this ticket if we're not responding to a TFA challenge, as in that case | |
145 | # it is a TFA-data ticket and will be verified by `authenticate_user`. | |
146 | ||
147 | ($ticketuser, undef, $tfa_info) = PVE::AccessControl::verify_ticket($pw_or_ticket, 1); | |
148 | } | |
adf8d771 | 149 | |
f25628d3 WB |
150 | if (defined($ticketuser) && ($ticketuser eq 'root@pam' || $ticketuser eq $username)) { |
151 | if (defined($tfa_info)) { | |
152 | die "incomplete ticket\n"; | |
153 | } | |
adf8d771 DM |
154 | # valid ticket. Note: root@pam can create tickets for other users |
155 | } else { | |
afb10353 WB |
156 | ($username, $tfa_info) = PVE::AccessControl::authenticate_user( |
157 | $username, | |
158 | $pw_or_ticket, | |
159 | $otp, | |
160 | $new_format, | |
161 | $tfa_challenge, | |
162 | ); | |
18f8ba18 WB |
163 | } |
164 | ||
165 | my %extra; | |
166 | my $ticket_data = $username; | |
afb10353 WB |
167 | my $aad; |
168 | if ($new_format) { | |
169 | if (defined($tfa_info)) { | |
170 | $extra{NeedTFA} = 1; | |
171 | $ticket_data = "!tfa!$tfa_info"; | |
172 | $aad = $username; | |
173 | } | |
174 | } elsif (defined($tfa_info)) { | |
f25628d3 WB |
175 | $extra{NeedTFA} = 1; |
176 | if ($tfa_info->{type} eq 'u2f') { | |
177 | my $u2finfo = $tfa_info->{data}; | |
178 | my $u2f = get_u2f_instance($rpcenv, $u2finfo->@{qw(publicKey keyHandle)}); | |
179 | my $challenge = $u2f->auth_challenge() | |
180 | or die "failed to get u2f challenge\n"; | |
181 | $challenge = decode_json($challenge); | |
182 | $extra{U2FChallenge} = $challenge; | |
183 | $ticket_data = "u2f!$username!$challenge->{challenge}"; | |
184 | } else { | |
185 | # General half-login / 'missing 2nd factor' ticket: | |
186 | $ticket_data = "tfa!$username"; | |
187 | } | |
adf8d771 DM |
188 | } |
189 | ||
afb10353 | 190 | my $ticket = PVE::AccessControl::assemble_ticket($ticket_data, $aad); |
adf8d771 DM |
191 | my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username); |
192 | ||
193 | return { | |
194 | ticket => $ticket, | |
195 | username => $username, | |
196 | CSRFPreventionToken => $csrftoken, | |
18f8ba18 | 197 | %extra, |
adf8d771 DM |
198 | }; |
199 | }; | |
200 | ||
39e4e363 | 201 | __PACKAGE__->register_method ({ |
30dd4869 TM |
202 | name => 'get_ticket', |
203 | path => 'ticket', | |
39e4e363 DM |
204 | method => 'GET', |
205 | permissions => { user => 'world' }, | |
36dd9dbd | 206 | description => "Dummy. Useful for formatters which want to provide a login page.", |
39e4e363 DM |
207 | parameters => { |
208 | additionalProperties => 0, | |
209 | }, | |
210 | returns => { type => "null" }, | |
211 | code => sub { return undef; }}); | |
30dd4869 | 212 | |
2c3a6c0a | 213 | __PACKAGE__->register_method ({ |
30dd4869 TM |
214 | name => 'create_ticket', |
215 | path => 'ticket', | |
2c3a6c0a | 216 | method => 'POST', |
30dd4869 | 217 | permissions => { |
96919234 | 218 | description => "You need to pass valid credientials.", |
30dd4869 | 219 | user => 'world' |
96919234 | 220 | }, |
2c3a6c0a | 221 | protected => 1, # else we can't access shadow files |
49372390 | 222 | allowtoken => 0, # we don't want tokens to create tickets |
adf8d771 | 223 | description => "Create or verify authentication ticket.", |
2c3a6c0a DM |
224 | parameters => { |
225 | additionalProperties => 0, | |
226 | properties => { | |
227 | username => { | |
3a5ae7a0 SI |
228 | description => "User name", |
229 | type => 'string', | |
230 | maxLength => 64, | |
231 | completion => \&PVE::AccessControl::complete_username, | |
2c3a6c0a DM |
232 | }, |
233 | realm => get_standard_option('realm', { | |
234 | description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.", | |
3e5bfdf6 DM |
235 | optional => 1, |
236 | completion => \&PVE::AccessControl::complete_realm, | |
237 | }), | |
30dd4869 | 238 | password => { |
2c3a6c0a DM |
239 | description => "The secret password. This can also be a valid ticket.", |
240 | type => 'string', | |
241 | }, | |
96f8ebd6 DM |
242 | otp => { |
243 | description => "One-time password for Two-factor authentication.", | |
244 | type => 'string', | |
245 | optional => 1, | |
246 | }, | |
2c3a6c0a | 247 | path => { |
adf8d771 | 248 | description => "Verify ticket, and check if user have access 'privs' on 'path'", |
2c3a6c0a DM |
249 | type => 'string', |
250 | requires => 'privs', | |
251 | optional => 1, | |
252 | maxLength => 64, | |
253 | }, | |
30dd4869 | 254 | privs => { |
adf8d771 | 255 | description => "Verify ticket, and check if user have access 'privs' on 'path'", |
2c3a6c0a DM |
256 | type => 'string' , format => 'pve-priv-list', |
257 | requires => 'path', | |
258 | optional => 1, | |
259 | maxLength => 64, | |
260 | }, | |
afb10353 WB |
261 | 'new-format' => { |
262 | type => 'boolean', | |
263 | description => | |
264 | 'With webauthn the format of half-authenticated tickts changed.' | |
265 | .' New clients should pass 1 here and not worry about the old format.' | |
266 | .' The old format is deprecated and will be retired with PVE-8.0', | |
267 | optional => 1, | |
268 | default => 0, | |
269 | }, | |
270 | 'tfa-challenge' => { | |
271 | type => 'string', | |
272 | description => "The signed TFA challenge string the user wants to respond to.", | |
273 | optional => 1, | |
274 | }, | |
2c3a6c0a DM |
275 | } |
276 | }, | |
277 | returns => { | |
278 | type => "object", | |
279 | properties => { | |
2c3a6c0a | 280 | username => { type => 'string' }, |
adf8d771 DM |
281 | ticket => { type => 'string', optional => 1}, |
282 | CSRFPreventionToken => { type => 'string', optional => 1 }, | |
e842fec5 | 283 | clustername => { type => 'string', optional => 1 }, |
18f8ba18 | 284 | # cap => computed api permissions, unless there's a u2f challenge |
2c3a6c0a DM |
285 | } |
286 | }, | |
287 | code => sub { | |
288 | my ($param) = @_; | |
30dd4869 | 289 | |
2c3a6c0a DM |
290 | my $username = $param->{username}; |
291 | $username .= "\@$param->{realm}" if $param->{realm}; | |
292 | ||
eb41d200 | 293 | $username = PVE::AccessControl::lookup_username($username); |
2c3a6c0a | 294 | my $rpcenv = PVE::RPCEnvironment::get(); |
2c3a6c0a | 295 | |
adf8d771 | 296 | my $res; |
adf8d771 | 297 | eval { |
7070c1ae DM |
298 | # test if user exists and is enabled |
299 | $rpcenv->check_user_enabled($username); | |
300 | ||
2c3a6c0a | 301 | if ($param->{path} && $param->{privs}) { |
afb10353 WB |
302 | $res = verify_auth($rpcenv, $username, $param->{password}, $param->{otp}, |
303 | $param->{path}, $param->{privs}, $param->{'new-format'}); | |
2c3a6c0a | 304 | } else { |
afb10353 WB |
305 | $res = create_ticket_do( |
306 | $rpcenv, | |
307 | $username, | |
308 | $param->{password}, | |
309 | $param->{otp}, | |
310 | $param->{'new-format'}, | |
311 | $param->{'tfa-challenge'}, | |
312 | ); | |
2c3a6c0a | 313 | } |
2c3a6c0a DM |
314 | }; |
315 | if (my $err = $@) { | |
adf8d771 | 316 | my $clientip = $rpcenv->get_client_ip() || ''; |
2c3a6c0a | 317 | syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err"); |
6126ab75 | 318 | # do not return any info to prevent user enumeration attacks |
fe2defd9 | 319 | die PVE::Exception->new("authentication failure\n", code => 401); |
2c3a6c0a DM |
320 | } |
321 | ||
ac344d7d | 322 | $res->{cap} = $rpcenv->compute_api_permission($username) |
f25628d3 | 323 | if !defined($res->{NeedTFA}); |
dd2cfee0 | 324 | |
0fb0c62d FG |
325 | my $clinfo = PVE::Cluster::get_clinfo(); |
326 | if ($clinfo->{cluster}->{name} && $rpcenv->check($username, '/', ['Sys.Audit'], 1)) { | |
327 | $res->{clustername} = $clinfo->{cluster}->{name}; | |
e842fec5 TL |
328 | } |
329 | ||
2c3a6c0a DM |
330 | PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'"); |
331 | ||
adf8d771 | 332 | return $res; |
2c3a6c0a DM |
333 | }}); |
334 | ||
37d45deb | 335 | __PACKAGE__->register_method ({ |
765305e2 | 336 | name => 'change_password', |
30dd4869 | 337 | path => 'password', |
37d45deb | 338 | method => 'PUT', |
30dd4869 | 339 | permissions => { |
82b63965 | 340 | description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user <userid>) and 'User.Modify' permission on /access/groups/<group> on a group where user <userid> is member of.", |
30dd4869 | 341 | check => [ 'or', |
12683df7 | 342 | ['userid-param', 'self'], |
82b63965 DM |
343 | [ 'and', |
344 | [ 'userid-param', 'Realm.AllocateUser'], | |
345 | [ 'userid-group', ['User.Modify']] | |
346 | ] | |
12683df7 DM |
347 | ], |
348 | }, | |
37d45deb | 349 | protected => 1, # else we can't access shadow files |
49372390 | 350 | allowtoken => 0, # we don't want tokens to change the regular user password |
37d45deb DM |
351 | description => "Change user password.", |
352 | parameters => { | |
353 | additionalProperties => 0, | |
354 | properties => { | |
3a5ae7a0 | 355 | userid => get_standard_option('userid-completed'), |
30dd4869 | 356 | password => { |
37d45deb DM |
357 | description => "The new password.", |
358 | type => 'string', | |
30dd4869 | 359 | minLength => 5, |
37d45deb DM |
360 | maxLength => 64, |
361 | }, | |
362 | } | |
363 | }, | |
364 | returns => { type => "null" }, | |
365 | code => sub { | |
366 | my ($param) = @_; | |
367 | ||
368 | my $rpcenv = PVE::RPCEnvironment::get(); | |
369 | my $authuser = $rpcenv->get_user(); | |
370 | ||
371 | my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid}); | |
372 | ||
12683df7 | 373 | $rpcenv->check_user_exist($userid); |
37d45deb DM |
374 | |
375 | if ($authuser eq 'root@pam') { | |
376 | # OK - root can change anything | |
377 | } else { | |
378 | if ($authuser eq $userid) { | |
379 | $rpcenv->check_user_enabled($userid); | |
380 | # OK - each user can change its own password | |
381 | } else { | |
12683df7 | 382 | # only root may change root password |
37d45deb | 383 | raise_perm_exc() if $userid eq 'root@pam'; |
59321f26 DM |
384 | # do not allow to change system user passwords |
385 | raise_perm_exc() if $realm eq 'pam'; | |
37d45deb DM |
386 | } |
387 | } | |
388 | ||
389 | PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password}); | |
390 | ||
391 | PVE::Cluster::log_msg('info', 'root@pam', "changed password for user '$userid'"); | |
392 | ||
393 | return undef; | |
394 | }}); | |
395 | ||
2b4c98ab WB |
396 | sub get_u2f_config() { |
397 | die "u2f support not available\n" if !$u2f_available; | |
398 | ||
399 | my $dc = cfs_read_file('datacenter.cfg'); | |
400 | my $u2f = $dc->{u2f}; | |
401 | die "u2f not configured in datacenter.cfg\n" if !$u2f; | |
2b4c98ab WB |
402 | return $u2f; |
403 | } | |
404 | ||
405 | sub get_u2f_instance { | |
406 | my ($rpcenv, $publicKey, $keyHandle) = @_; | |
407 | ||
408 | # We store the public key base64 encoded (as the api provides it in binary) | |
409 | $publicKey = decode_base64($publicKey) if defined($publicKey); | |
410 | ||
411 | my $u2fconfig = get_u2f_config(); | |
412 | my $u2f = PVE::U2F->new(); | |
413 | ||
414 | # via the 'Host' header (in case a node has multiple hosts available). | |
415 | my $origin = $u2fconfig->{origin}; | |
416 | if (!defined($origin)) { | |
417 | $origin = $rpcenv->get_request_host(1); | |
418 | if ($origin) { | |
419 | $origin = "https://$origin"; | |
420 | } else { | |
421 | die "failed to figure out u2f origin\n"; | |
422 | } | |
423 | } | |
424 | ||
425 | my $appid = $u2fconfig->{appid} // $origin; | |
426 | $u2f->set_appid($appid); | |
427 | $u2f->set_origin($origin); | |
428 | $u2f->set_publicKey($publicKey) if defined($publicKey); | |
429 | $u2f->set_keyHandle($keyHandle) if defined($keyHandle); | |
430 | return $u2f; | |
431 | } | |
432 | ||
47d731c7 WB |
433 | sub verify_user_tfa_config { |
434 | my ($type, $tfa_cfg, $value) = @_; | |
435 | ||
436 | if (!defined($type)) { | |
437 | die "missing tfa 'type'\n"; | |
438 | } | |
439 | ||
440 | if ($type ne 'oath') { | |
441 | die "invalid type for custom tfa authentication\n"; | |
442 | } | |
443 | ||
444 | my $secret = $tfa_cfg->{keys} | |
445 | or die "missing TOTP secret\n"; | |
446 | $tfa_cfg = $tfa_cfg->{config}; | |
447 | # Copy the hash to verify that we have no unexpected keys without modifying the original hash. | |
448 | $tfa_cfg = {%$tfa_cfg}; | |
449 | ||
450 | # We can only verify 1 secret but oath_verify_otp allows multiple: | |
451 | if (scalar(PVE::Tools::split_list($secret)) != 1) { | |
452 | die "only exactly one secret key allowed\n"; | |
453 | } | |
454 | ||
455 | my $digits = delete($tfa_cfg->{digits}) // 6; | |
456 | my $step = delete($tfa_cfg->{step}) // 30; | |
457 | # Maybe also this? | |
458 | # my $algorithm = delete($tfa_cfg->{algorithm}) // 'sha1'; | |
459 | ||
460 | if (length(my $more = join(', ', keys %$tfa_cfg))) { | |
461 | die "unexpected tfa config keys: $more\n"; | |
462 | } | |
463 | ||
464 | PVE::OTP::oath_verify_otp($value, $secret, $step, $digits); | |
465 | } | |
466 | ||
2b4c98ab WB |
467 | __PACKAGE__->register_method ({ |
468 | name => 'change_tfa', | |
469 | path => 'tfa', | |
470 | method => 'PUT', | |
471 | permissions => { | |
47d731c7 | 472 | description => 'A user can change their own u2f or totp token.', |
2b4c98ab WB |
473 | check => [ 'or', |
474 | ['userid-param', 'self'], | |
475 | [ 'and', | |
476 | [ 'userid-param', 'Realm.AllocateUser'], | |
477 | [ 'userid-group', ['User.Modify']] | |
478 | ] | |
479 | ], | |
480 | }, | |
481 | protected => 1, # else we can't access shadow files | |
49372390 | 482 | allowtoken => 0, # we don't want tokens to change the regular user's TFA settings |
2b4c98ab WB |
483 | description => "Change user u2f authentication.", |
484 | parameters => { | |
485 | additionalProperties => 0, | |
486 | properties => { | |
487 | userid => get_standard_option('userid', { | |
488 | completion => \&PVE::AccessControl::complete_username, | |
489 | }), | |
490 | password => { | |
491 | optional => 1, # Only required if not root@pam | |
492 | description => "The current password.", | |
493 | type => 'string', | |
494 | minLength => 5, | |
495 | maxLength => 64, | |
496 | }, | |
497 | action => { | |
498 | description => 'The action to perform', | |
499 | type => 'string', | |
500 | enum => [qw(delete new confirm)], | |
501 | }, | |
502 | response => { | |
503 | optional => 1, | |
47d731c7 WB |
504 | description => |
505 | 'Either the the response to the current u2f registration challenge,' | |
506 | .' or, when adding TOTP, the currently valid TOTP value.', | |
507 | type => 'string', | |
508 | }, | |
509 | key => { | |
510 | optional => 1, | |
511 | description => 'When adding TOTP, the shared secret value.', | |
2b4c98ab | 512 | type => 'string', |
0bf114df | 513 | format => 'pve-tfa-secret', |
47d731c7 WB |
514 | }, |
515 | config => { | |
516 | optional => 1, | |
517 | description => 'A TFA configuration. This must currently be of type TOTP of not set at all.', | |
518 | type => 'string', | |
519 | format => 'pve-tfa-config', | |
520 | maxLength => 128, | |
2b4c98ab WB |
521 | }, |
522 | } | |
523 | }, | |
524 | returns => { type => 'object' }, | |
525 | code => sub { | |
526 | my ($param) = @_; | |
527 | ||
afb10353 WB |
528 | die "TODO!\n"; |
529 | ||
2b4c98ab WB |
530 | my $rpcenv = PVE::RPCEnvironment::get(); |
531 | my $authuser = $rpcenv->get_user(); | |
532 | ||
533 | my $action = delete $param->{action}; | |
534 | my $response = delete $param->{response}; | |
535 | my $password = delete($param->{password}) // ''; | |
47d731c7 WB |
536 | my $key = delete($param->{key}); |
537 | my $config = delete($param->{config}); | |
2b4c98ab WB |
538 | |
539 | my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid}); | |
540 | $rpcenv->check_user_exist($userid); | |
541 | ||
542 | # Only root may modify root | |
543 | raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam'; | |
544 | ||
545 | # Regular users need to confirm their password to change u2f settings. | |
546 | if ($authuser ne 'root@pam') { | |
e240695b | 547 | raise_param_exc({ 'password' => 'password is required to modify u2f data' }) |
2b4c98ab WB |
548 | if !defined($password); |
549 | my $domain_cfg = cfs_read_file('domains.cfg'); | |
550 | my $cfg = $domain_cfg->{ids}->{$realm}; | |
3443faca | 551 | die "auth domain '$realm' does not exist\n" if !$cfg; |
2b4c98ab WB |
552 | my $plugin = PVE::Auth::Plugin->lookup($cfg->{type}); |
553 | $plugin->authenticate_user($cfg, $realm, $ruid, $password); | |
554 | } | |
555 | ||
556 | if ($action eq 'delete') { | |
557 | PVE::AccessControl::user_set_tfa($userid, $realm, undef, undef); | |
558 | PVE::Cluster::log_msg('info', $authuser, "deleted u2f data for user '$userid'"); | |
559 | } elsif ($action eq 'new') { | |
47d731c7 WB |
560 | if (defined($config)) { |
561 | $config = PVE::Auth::Plugin::parse_tfa_config($config); | |
562 | my $type = delete($config->{type}); | |
563 | my $tfa_cfg = { | |
564 | keys => $key, | |
565 | config => $config, | |
566 | }; | |
567 | verify_user_tfa_config($type, $tfa_cfg, $response); | |
568 | PVE::AccessControl::user_set_tfa($userid, $realm, $type, $tfa_cfg); | |
569 | } else { | |
570 | # The default is U2F: | |
571 | my $u2f = get_u2f_instance($rpcenv); | |
572 | my $challenge = $u2f->registration_challenge() | |
573 | or raise("failed to get u2f challenge"); | |
574 | $challenge = decode_json($challenge); | |
575 | PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', $challenge); | |
576 | return $challenge; | |
577 | } | |
2b4c98ab | 578 | } elsif ($action eq 'confirm') { |
e240695b | 579 | raise_param_exc({ 'response' => "confirm action requires the 'response' parameter to be set" }) |
2b4c98ab WB |
580 | if !defined($response); |
581 | ||
afb10353 | 582 | my ($type, $u2fdata) = PVE::AccessControl::user_get_tfa($userid, $realm, 'FIXME'); |
2b4c98ab WB |
583 | raise("no u2f data available") |
584 | if (!defined($type) || $type ne 'u2f'); | |
585 | ||
586 | my $challenge = $u2fdata->{challenge} | |
587 | or raise("no active challenge"); | |
588 | ||
589 | my $u2f = get_u2f_instance($rpcenv); | |
590 | $u2f->set_challenge($challenge); | |
591 | my ($keyHandle, $publicKey) = $u2f->registration_verify($response); | |
592 | PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', { | |
593 | keyHandle => $keyHandle, | |
eb25cbaf | 594 | publicKey => $publicKey, # already base64 encoded |
2b4c98ab WB |
595 | }); |
596 | } else { | |
597 | die "invalid action: $action\n"; | |
598 | } | |
599 | ||
600 | return {}; | |
601 | }}); | |
602 | ||
603 | __PACKAGE__->register_method({ | |
604 | name => 'verify_tfa', | |
605 | path => 'tfa', | |
606 | method => 'POST', | |
607 | permissions => { user => 'all' }, | |
608 | protected => 1, # else we can't access shadow files | |
49372390 | 609 | allowtoken => 0, # we don't want tokens to access TFA information |
2b4c98ab WB |
610 | description => 'Finish a u2f challenge.', |
611 | parameters => { | |
612 | additionalProperties => 0, | |
613 | properties => { | |
614 | response => { | |
615 | type => 'string', | |
616 | description => 'The response to the current authentication challenge.', | |
617 | }, | |
618 | } | |
619 | }, | |
620 | returns => { | |
621 | type => 'object', | |
622 | properties => { | |
623 | ticket => { type => 'string' }, | |
624 | # cap | |
625 | } | |
626 | }, | |
627 | code => sub { | |
628 | my ($param) = @_; | |
629 | ||
630 | my $rpcenv = PVE::RPCEnvironment::get(); | |
2b4c98ab WB |
631 | my $authuser = $rpcenv->get_user(); |
632 | my ($username, undef, $realm) = PVE::AccessControl::verify_username($authuser); | |
633 | ||
afb10353 | 634 | my ($tfa_type, $tfa_data) = PVE::AccessControl::user_get_tfa($username, $realm, 0); |
f25628d3 | 635 | if (!defined($tfa_type)) { |
2b4c98ab WB |
636 | raise('no u2f data available'); |
637 | } | |
638 | ||
f25628d3 WB |
639 | eval { |
640 | if ($tfa_type eq 'u2f') { | |
641 | my $challenge = $rpcenv->get_u2f_challenge() | |
642 | or raise('no active challenge'); | |
2b4c98ab | 643 | |
f25628d3 WB |
644 | my $keyHandle = $tfa_data->{keyHandle}; |
645 | my $publicKey = $tfa_data->{publicKey}; | |
646 | raise("incomplete u2f setup") | |
647 | if !defined($keyHandle) || !defined($publicKey); | |
2b4c98ab | 648 | |
f25628d3 WB |
649 | my $u2f = get_u2f_instance($rpcenv, $publicKey, $keyHandle); |
650 | $u2f->set_challenge($challenge); | |
651 | ||
652 | my ($counter, $present) = $u2f->auth_verify($param->{response}); | |
653 | # Do we want to do anything with these? | |
654 | } else { | |
655 | # sanity check before handing off to the verification code: | |
656 | my $keys = $tfa_data->{keys} or die "missing tfa keys\n"; | |
657 | my $config = $tfa_data->{config} or die "bad tfa entry\n"; | |
658 | PVE::AccessControl::verify_one_time_pw($tfa_type, $authuser, $keys, $config, $param->{response}); | |
659 | } | |
2b4c98ab WB |
660 | }; |
661 | if (my $err = $@) { | |
662 | my $clientip = $rpcenv->get_client_ip() || ''; | |
663 | syslog('err', "authentication verification failure; rhost=$clientip user=$authuser msg=$err"); | |
664 | die PVE::Exception->new("authentication failure\n", code => 401); | |
665 | } | |
666 | ||
2b4c98ab | 667 | return { |
f25628d3 | 668 | ticket => PVE::AccessControl::assemble_ticket($authuser), |
ac344d7d | 669 | cap => $rpcenv->compute_api_permission($authuser), |
2b4c98ab WB |
670 | } |
671 | }}); | |
672 | ||
c3fa8a36 FG |
673 | __PACKAGE__->register_method({ |
674 | name => 'permissions', | |
675 | path => 'permissions', | |
676 | method => 'GET', | |
677 | description => 'Retrieve effective permissions of given user/token.', | |
678 | permissions => { | |
679 | description => "Each user/token is allowed to dump their own permissions. A user can dump the permissions of another user if they have 'Sys.Audit' permission on /access.", | |
680 | user => 'all', | |
681 | }, | |
682 | parameters => { | |
683 | additionalProperties => 0, | |
684 | properties => { | |
685 | userid => { | |
686 | type => 'string', | |
687 | description => "User ID or full API token ID", | |
688 | pattern => $PVE::AccessControl::userid_or_token_regex, | |
689 | optional => 1, | |
690 | }, | |
691 | path => get_standard_option('acl-path', { | |
692 | description => "Only dump this specific path, not the whole tree.", | |
693 | optional => 1, | |
694 | }), | |
695 | }, | |
696 | }, | |
697 | returns => { | |
698 | type => 'object', | |
699 | description => 'Map of "path" => (Map of "privilege" => "propagate boolean").', | |
700 | }, | |
701 | code => sub { | |
702 | my ($param) = @_; | |
703 | ||
704 | my $rpcenv = PVE::RPCEnvironment::get(); | |
705 | ||
706 | my $userid = $param->{userid}; | |
707 | if (defined($userid)) { | |
708 | $rpcenv->check($rpcenv->get_user(), '/access', ['Sys.Audit']); | |
709 | } else { | |
710 | $userid = $rpcenv->get_user(); | |
711 | } | |
712 | ||
713 | my $res; | |
714 | ||
715 | if (my $path = $param->{path}) { | |
716 | my $perms = $rpcenv->permissions($userid, $path); | |
717 | if ($perms) { | |
718 | $res = { $path => $perms }; | |
719 | } else { | |
720 | $res = {}; | |
721 | } | |
722 | } else { | |
723 | $res = $rpcenv->get_effective_permissions($userid); | |
724 | } | |
725 | ||
726 | return $res; | |
727 | }}); | |
728 | ||
2c3a6c0a | 729 | 1; |