]>
Commit | Line | Data |
---|---|---|
1 | package PVE::API2::AccessControl; | |
2 | ||
3 | use strict; | |
4 | use warnings; | |
5 | ||
6 | use JSON; | |
7 | use MIME::Base64; | |
8 | ||
9 | use PVE::Exception qw(raise raise_perm_exc); | |
10 | use PVE::SafeSyslog; | |
11 | use PVE::RPCEnvironment; | |
12 | use PVE::Cluster qw(cfs_read_file); | |
13 | use PVE::Corosync; | |
14 | use PVE::RESTHandler; | |
15 | use PVE::AccessControl; | |
16 | use PVE::JSONSchema qw(get_standard_option); | |
17 | use PVE::API2::Domains; | |
18 | use PVE::API2::User; | |
19 | use PVE::API2::Group; | |
20 | use PVE::API2::Role; | |
21 | use PVE::API2::ACL; | |
22 | use PVE::OTP; | |
23 | use PVE::Tools; | |
24 | ||
25 | my $u2f_available = 0; | |
26 | eval { | |
27 | require PVE::U2F; | |
28 | $u2f_available = 1; | |
29 | }; | |
30 | ||
31 | use base qw(PVE::RESTHandler); | |
32 | ||
33 | __PACKAGE__->register_method ({ | |
34 | subclass => "PVE::API2::User", | |
35 | path => 'users', | |
36 | }); | |
37 | ||
38 | __PACKAGE__->register_method ({ | |
39 | subclass => "PVE::API2::Group", | |
40 | path => 'groups', | |
41 | }); | |
42 | ||
43 | __PACKAGE__->register_method ({ | |
44 | subclass => "PVE::API2::Role", | |
45 | path => 'roles', | |
46 | }); | |
47 | ||
48 | __PACKAGE__->register_method ({ | |
49 | subclass => "PVE::API2::ACL", | |
50 | path => 'acl', | |
51 | }); | |
52 | ||
53 | __PACKAGE__->register_method ({ | |
54 | subclass => "PVE::API2::Domains", | |
55 | path => 'domains', | |
56 | }); | |
57 | ||
58 | __PACKAGE__->register_method ({ | |
59 | name => 'index', | |
60 | path => '', | |
61 | method => 'GET', | |
62 | description => "Directory index.", | |
63 | permissions => { | |
64 | user => 'all', | |
65 | }, | |
66 | parameters => { | |
67 | additionalProperties => 0, | |
68 | properties => {}, | |
69 | }, | |
70 | returns => { | |
71 | type => 'array', | |
72 | items => { | |
73 | type => "object", | |
74 | properties => { | |
75 | subdir => { type => 'string' }, | |
76 | }, | |
77 | }, | |
78 | links => [ { rel => 'child', href => "{subdir}" } ], | |
79 | }, | |
80 | code => sub { | |
81 | my ($param) = @_; | |
82 | ||
83 | my $res = []; | |
84 | ||
85 | my $ma = __PACKAGE__->method_attributes(); | |
86 | ||
87 | foreach my $info (@$ma) { | |
88 | next if !$info->{subclass}; | |
89 | ||
90 | my $subpath = $info->{match_re}->[0]; | |
91 | ||
92 | push @$res, { subdir => $subpath }; | |
93 | } | |
94 | ||
95 | push @$res, { subdir => 'ticket' }; | |
96 | push @$res, { subdir => 'password' }; | |
97 | ||
98 | return $res; | |
99 | }}); | |
100 | ||
101 | ||
102 | my $verify_auth = sub { | |
103 | my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_; | |
104 | ||
105 | my $normpath = PVE::AccessControl::normalize_path($path); | |
106 | ||
107 | my $ticketuser; | |
108 | if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) && | |
109 | ($ticketuser eq $username)) { | |
110 | # valid ticket | |
111 | } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) { | |
112 | # valid vnc ticket | |
113 | } else { | |
114 | $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); | |
115 | } | |
116 | ||
117 | my $privlist = [ PVE::Tools::split_list($privs) ]; | |
118 | if (!($normpath && scalar(@$privlist) && $rpcenv->check($username, $normpath, $privlist))) { | |
119 | die "no permission ($path, $privs)\n"; | |
120 | } | |
121 | ||
122 | return { username => $username }; | |
123 | }; | |
124 | ||
125 | my $create_ticket = sub { | |
126 | my ($rpcenv, $username, $pw_or_ticket, $otp) = @_; | |
127 | ||
128 | my ($ticketuser, undef, $tfa_info) = PVE::AccessControl::verify_ticket($pw_or_ticket, 1); | |
129 | if (defined($ticketuser) && ($ticketuser eq 'root@pam' || $ticketuser eq $username)) { | |
130 | if (defined($tfa_info)) { | |
131 | die "incomplete ticket\n"; | |
132 | } | |
133 | # valid ticket. Note: root@pam can create tickets for other users | |
134 | } else { | |
135 | ($username, $tfa_info) = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp); | |
136 | } | |
137 | ||
138 | my %extra; | |
139 | my $ticket_data = $username; | |
140 | if (defined($tfa_info)) { | |
141 | $extra{NeedTFA} = 1; | |
142 | if ($tfa_info->{type} eq 'u2f') { | |
143 | my $u2finfo = $tfa_info->{data}; | |
144 | my $u2f = get_u2f_instance($rpcenv, $u2finfo->@{qw(publicKey keyHandle)}); | |
145 | my $challenge = $u2f->auth_challenge() | |
146 | or die "failed to get u2f challenge\n"; | |
147 | $challenge = decode_json($challenge); | |
148 | $extra{U2FChallenge} = $challenge; | |
149 | $ticket_data = "u2f!$username!$challenge->{challenge}"; | |
150 | } else { | |
151 | # General half-login / 'missing 2nd factor' ticket: | |
152 | $ticket_data = "tfa!$username"; | |
153 | } | |
154 | } | |
155 | ||
156 | my $ticket = PVE::AccessControl::assemble_ticket($ticket_data); | |
157 | my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username); | |
158 | ||
159 | return { | |
160 | ticket => $ticket, | |
161 | username => $username, | |
162 | CSRFPreventionToken => $csrftoken, | |
163 | %extra, | |
164 | }; | |
165 | }; | |
166 | ||
167 | my $compute_api_permission = sub { | |
168 | my ($rpcenv, $authuser) = @_; | |
169 | ||
170 | my $usercfg = $rpcenv->{user_cfg}; | |
171 | ||
172 | my $res = {}; | |
173 | my $priv_re_map = { | |
174 | vms => qr/VM\.|Permissions\.Modify/, | |
175 | access => qr/(User|Group)\.|Permissions\.Modify/, | |
176 | storage => qr/Datastore\.|Permissions\.Modify/, | |
177 | nodes => qr/Sys\.|Permissions\.Modify/, | |
178 | dc => qr/Sys\.Audit/, | |
179 | }; | |
180 | map { $res->{$_} = {} } keys %$priv_re_map; | |
181 | ||
182 | my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage']; | |
183 | ||
184 | my $checked_paths = {}; | |
185 | foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) { | |
186 | next if $checked_paths->{$path}; | |
187 | $checked_paths->{$path} = 1; | |
188 | ||
189 | my $path_perm = $rpcenv->permissions($authuser, $path); | |
190 | ||
191 | my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc'; | |
192 | if ($toplevel eq 'pool') { | |
193 | foreach my $priv (keys %$path_perm) { | |
194 | if ($priv =~ m/^VM\./) { | |
195 | $res->{vms}->{$priv} = 1; | |
196 | } elsif ($priv =~ m/^Datastore\./) { | |
197 | $res->{storage}->{$priv} = 1; | |
198 | } elsif ($priv eq 'Permissions.Modify') { | |
199 | $res->{storage}->{$priv} = 1; | |
200 | $res->{vms}->{$priv} = 1; | |
201 | } | |
202 | } | |
203 | } else { | |
204 | my $priv_regex = $priv_re_map->{$toplevel} // next; | |
205 | foreach my $priv (keys %$path_perm) { | |
206 | next if $priv !~ m/^($priv_regex)/; | |
207 | $res->{$toplevel}->{$priv} = 1; | |
208 | } | |
209 | } | |
210 | } | |
211 | ||
212 | return $res; | |
213 | }; | |
214 | ||
215 | __PACKAGE__->register_method ({ | |
216 | name => 'get_ticket', | |
217 | path => 'ticket', | |
218 | method => 'GET', | |
219 | permissions => { user => 'world' }, | |
220 | description => "Dummy. Useful for formatters which want to provide a login page.", | |
221 | parameters => { | |
222 | additionalProperties => 0, | |
223 | }, | |
224 | returns => { type => "null" }, | |
225 | code => sub { return undef; }}); | |
226 | ||
227 | __PACKAGE__->register_method ({ | |
228 | name => 'create_ticket', | |
229 | path => 'ticket', | |
230 | method => 'POST', | |
231 | permissions => { | |
232 | description => "You need to pass valid credientials.", | |
233 | user => 'world' | |
234 | }, | |
235 | protected => 1, # else we can't access shadow files | |
236 | description => "Create or verify authentication ticket.", | |
237 | parameters => { | |
238 | additionalProperties => 0, | |
239 | properties => { | |
240 | username => { | |
241 | description => "User name", | |
242 | type => 'string', | |
243 | maxLength => 64, | |
244 | completion => \&PVE::AccessControl::complete_username, | |
245 | }, | |
246 | realm => get_standard_option('realm', { | |
247 | description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.", | |
248 | optional => 1, | |
249 | completion => \&PVE::AccessControl::complete_realm, | |
250 | }), | |
251 | password => { | |
252 | description => "The secret password. This can also be a valid ticket.", | |
253 | type => 'string', | |
254 | }, | |
255 | otp => { | |
256 | description => "One-time password for Two-factor authentication.", | |
257 | type => 'string', | |
258 | optional => 1, | |
259 | }, | |
260 | path => { | |
261 | description => "Verify ticket, and check if user have access 'privs' on 'path'", | |
262 | type => 'string', | |
263 | requires => 'privs', | |
264 | optional => 1, | |
265 | maxLength => 64, | |
266 | }, | |
267 | privs => { | |
268 | description => "Verify ticket, and check if user have access 'privs' on 'path'", | |
269 | type => 'string' , format => 'pve-priv-list', | |
270 | requires => 'path', | |
271 | optional => 1, | |
272 | maxLength => 64, | |
273 | }, | |
274 | } | |
275 | }, | |
276 | returns => { | |
277 | type => "object", | |
278 | properties => { | |
279 | username => { type => 'string' }, | |
280 | ticket => { type => 'string', optional => 1}, | |
281 | CSRFPreventionToken => { type => 'string', optional => 1 }, | |
282 | clustername => { type => 'string', optional => 1 }, | |
283 | # cap => computed api permissions, unless there's a u2f challenge | |
284 | } | |
285 | }, | |
286 | code => sub { | |
287 | my ($param) = @_; | |
288 | ||
289 | my $username = $param->{username}; | |
290 | $username .= "\@$param->{realm}" if $param->{realm}; | |
291 | ||
292 | my $rpcenv = PVE::RPCEnvironment::get(); | |
293 | ||
294 | my $res; | |
295 | eval { | |
296 | # test if user exists and is enabled | |
297 | $rpcenv->check_user_enabled($username); | |
298 | ||
299 | if ($param->{path} && $param->{privs}) { | |
300 | $res = &$verify_auth($rpcenv, $username, $param->{password}, $param->{otp}, | |
301 | $param->{path}, $param->{privs}); | |
302 | } else { | |
303 | $res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp}); | |
304 | } | |
305 | }; | |
306 | if (my $err = $@) { | |
307 | my $clientip = $rpcenv->get_client_ip() || ''; | |
308 | syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err"); | |
309 | # do not return any info to prevent user enumeration attacks | |
310 | die PVE::Exception->new("authentication failure\n", code => 401); | |
311 | } | |
312 | ||
313 | $res->{cap} = &$compute_api_permission($rpcenv, $username) | |
314 | if !defined($res->{NeedTFA}); | |
315 | ||
316 | if (PVE::Corosync::check_conf_exists(1)) { | |
317 | if ($rpcenv->check($username, '/', ['Sys.Audit'], 1)) { | |
318 | eval { | |
319 | my $conf = cfs_read_file('corosync.conf'); | |
320 | my $totem = PVE::Corosync::totem_config($conf); | |
321 | if ($totem->{cluster_name}) { | |
322 | $res->{clustername} = $totem->{cluster_name}; | |
323 | } | |
324 | }; | |
325 | warn "$@\n" if $@; | |
326 | } | |
327 | } | |
328 | ||
329 | PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'"); | |
330 | ||
331 | return $res; | |
332 | }}); | |
333 | ||
334 | __PACKAGE__->register_method ({ | |
335 | name => 'change_password', | |
336 | path => 'password', | |
337 | method => 'PUT', | |
338 | permissions => { | |
339 | description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user <userid>) and 'User.Modify' permission on /access/groups/<group> on a group where user <userid> is member of.", | |
340 | check => [ 'or', | |
341 | ['userid-param', 'self'], | |
342 | [ 'and', | |
343 | [ 'userid-param', 'Realm.AllocateUser'], | |
344 | [ 'userid-group', ['User.Modify']] | |
345 | ] | |
346 | ], | |
347 | }, | |
348 | protected => 1, # else we can't access shadow files | |
349 | description => "Change user password.", | |
350 | parameters => { | |
351 | additionalProperties => 0, | |
352 | properties => { | |
353 | userid => get_standard_option('userid-completed'), | |
354 | password => { | |
355 | description => "The new password.", | |
356 | type => 'string', | |
357 | minLength => 5, | |
358 | maxLength => 64, | |
359 | }, | |
360 | } | |
361 | }, | |
362 | returns => { type => "null" }, | |
363 | code => sub { | |
364 | my ($param) = @_; | |
365 | ||
366 | my $rpcenv = PVE::RPCEnvironment::get(); | |
367 | my $authuser = $rpcenv->get_user(); | |
368 | ||
369 | my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid}); | |
370 | ||
371 | $rpcenv->check_user_exist($userid); | |
372 | ||
373 | if ($authuser eq 'root@pam') { | |
374 | # OK - root can change anything | |
375 | } else { | |
376 | if ($authuser eq $userid) { | |
377 | $rpcenv->check_user_enabled($userid); | |
378 | # OK - each user can change its own password | |
379 | } else { | |
380 | # only root may change root password | |
381 | raise_perm_exc() if $userid eq 'root@pam'; | |
382 | # do not allow to change system user passwords | |
383 | raise_perm_exc() if $realm eq 'pam'; | |
384 | } | |
385 | } | |
386 | ||
387 | PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password}); | |
388 | ||
389 | PVE::Cluster::log_msg('info', 'root@pam', "changed password for user '$userid'"); | |
390 | ||
391 | return undef; | |
392 | }}); | |
393 | ||
394 | sub get_u2f_config() { | |
395 | die "u2f support not available\n" if !$u2f_available; | |
396 | ||
397 | my $dc = cfs_read_file('datacenter.cfg'); | |
398 | my $u2f = $dc->{u2f}; | |
399 | die "u2f not configured in datacenter.cfg\n" if !$u2f; | |
400 | $u2f = PVE::JSONSchema::parse_property_string($PVE::Cluster::u2f_format, $u2f); | |
401 | return $u2f; | |
402 | } | |
403 | ||
404 | sub get_u2f_instance { | |
405 | my ($rpcenv, $publicKey, $keyHandle) = @_; | |
406 | ||
407 | # We store the public key base64 encoded (as the api provides it in binary) | |
408 | $publicKey = decode_base64($publicKey) if defined($publicKey); | |
409 | ||
410 | my $u2fconfig = get_u2f_config(); | |
411 | my $u2f = PVE::U2F->new(); | |
412 | ||
413 | # via the 'Host' header (in case a node has multiple hosts available). | |
414 | my $origin = $u2fconfig->{origin}; | |
415 | if (!defined($origin)) { | |
416 | $origin = $rpcenv->get_request_host(1); | |
417 | if ($origin) { | |
418 | $origin = "https://$origin"; | |
419 | } else { | |
420 | die "failed to figure out u2f origin\n"; | |
421 | } | |
422 | } | |
423 | ||
424 | my $appid = $u2fconfig->{appid} // $origin; | |
425 | $u2f->set_appid($appid); | |
426 | $u2f->set_origin($origin); | |
427 | $u2f->set_publicKey($publicKey) if defined($publicKey); | |
428 | $u2f->set_keyHandle($keyHandle) if defined($keyHandle); | |
429 | return $u2f; | |
430 | } | |
431 | ||
432 | sub verify_user_tfa_config { | |
433 | my ($type, $tfa_cfg, $value) = @_; | |
434 | ||
435 | if (!defined($type)) { | |
436 | die "missing tfa 'type'\n"; | |
437 | } | |
438 | ||
439 | if ($type ne 'oath') { | |
440 | die "invalid type for custom tfa authentication\n"; | |
441 | } | |
442 | ||
443 | my $secret = $tfa_cfg->{keys} | |
444 | or die "missing TOTP secret\n"; | |
445 | $tfa_cfg = $tfa_cfg->{config}; | |
446 | # Copy the hash to verify that we have no unexpected keys without modifying the original hash. | |
447 | $tfa_cfg = {%$tfa_cfg}; | |
448 | ||
449 | # We can only verify 1 secret but oath_verify_otp allows multiple: | |
450 | if (scalar(PVE::Tools::split_list($secret)) != 1) { | |
451 | die "only exactly one secret key allowed\n"; | |
452 | } | |
453 | ||
454 | my $digits = delete($tfa_cfg->{digits}) // 6; | |
455 | my $step = delete($tfa_cfg->{step}) // 30; | |
456 | # Maybe also this? | |
457 | # my $algorithm = delete($tfa_cfg->{algorithm}) // 'sha1'; | |
458 | ||
459 | if (length(my $more = join(', ', keys %$tfa_cfg))) { | |
460 | die "unexpected tfa config keys: $more\n"; | |
461 | } | |
462 | ||
463 | PVE::OTP::oath_verify_otp($value, $secret, $step, $digits); | |
464 | } | |
465 | ||
466 | __PACKAGE__->register_method ({ | |
467 | name => 'change_tfa', | |
468 | path => 'tfa', | |
469 | method => 'PUT', | |
470 | permissions => { | |
471 | description => 'A user can change their own u2f or totp token.', | |
472 | check => [ 'or', | |
473 | ['userid-param', 'self'], | |
474 | [ 'and', | |
475 | [ 'userid-param', 'Realm.AllocateUser'], | |
476 | [ 'userid-group', ['User.Modify']] | |
477 | ] | |
478 | ], | |
479 | }, | |
480 | protected => 1, # else we can't access shadow files | |
481 | description => "Change user u2f authentication.", | |
482 | parameters => { | |
483 | additionalProperties => 0, | |
484 | properties => { | |
485 | userid => get_standard_option('userid', { | |
486 | completion => \&PVE::AccessControl::complete_username, | |
487 | }), | |
488 | password => { | |
489 | optional => 1, # Only required if not root@pam | |
490 | description => "The current password.", | |
491 | type => 'string', | |
492 | minLength => 5, | |
493 | maxLength => 64, | |
494 | }, | |
495 | action => { | |
496 | description => 'The action to perform', | |
497 | type => 'string', | |
498 | enum => [qw(delete new confirm)], | |
499 | }, | |
500 | response => { | |
501 | optional => 1, | |
502 | description => | |
503 | 'Either the the response to the current u2f registration challenge,' | |
504 | .' or, when adding TOTP, the currently valid TOTP value.', | |
505 | type => 'string', | |
506 | }, | |
507 | key => { | |
508 | optional => 1, | |
509 | description => 'When adding TOTP, the shared secret value.', | |
510 | type => 'string', | |
511 | # This is what pve-common's PVE::OTP::oath_verify_otp accepts. | |
512 | # Should we move this to pve-common's JSONSchema as a named format? | |
513 | pattern => qr/[A-Z2-7=]{16}|[A-Fa-f0-9]{40}/, | |
514 | }, | |
515 | config => { | |
516 | optional => 1, | |
517 | description => 'A TFA configuration. This must currently be of type TOTP of not set at all.', | |
518 | type => 'string', | |
519 | format => 'pve-tfa-config', | |
520 | maxLength => 128, | |
521 | }, | |
522 | } | |
523 | }, | |
524 | returns => { type => 'object' }, | |
525 | code => sub { | |
526 | my ($param) = @_; | |
527 | ||
528 | my $rpcenv = PVE::RPCEnvironment::get(); | |
529 | my $authuser = $rpcenv->get_user(); | |
530 | ||
531 | my $action = delete $param->{action}; | |
532 | my $response = delete $param->{response}; | |
533 | my $password = delete($param->{password}) // ''; | |
534 | my $key = delete($param->{key}); | |
535 | my $config = delete($param->{config}); | |
536 | ||
537 | my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid}); | |
538 | $rpcenv->check_user_exist($userid); | |
539 | ||
540 | # Only root may modify root | |
541 | raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam'; | |
542 | ||
543 | # Regular users need to confirm their password to change u2f settings. | |
544 | if ($authuser ne 'root@pam') { | |
545 | raise_param_exc('password' => 'password is required to modify u2f data') | |
546 | if !defined($password); | |
547 | my $domain_cfg = cfs_read_file('domains.cfg'); | |
548 | my $cfg = $domain_cfg->{ids}->{$realm}; | |
549 | die "auth domain '$realm' does not exists\n" if !$cfg; | |
550 | my $plugin = PVE::Auth::Plugin->lookup($cfg->{type}); | |
551 | $plugin->authenticate_user($cfg, $realm, $ruid, $password); | |
552 | } | |
553 | ||
554 | if ($action eq 'delete') { | |
555 | PVE::AccessControl::user_set_tfa($userid, $realm, undef, undef); | |
556 | PVE::Cluster::log_msg('info', $authuser, "deleted u2f data for user '$userid'"); | |
557 | } elsif ($action eq 'new') { | |
558 | if (defined($config)) { | |
559 | $config = PVE::Auth::Plugin::parse_tfa_config($config); | |
560 | my $type = delete($config->{type}); | |
561 | my $tfa_cfg = { | |
562 | keys => $key, | |
563 | config => $config, | |
564 | }; | |
565 | verify_user_tfa_config($type, $tfa_cfg, $response); | |
566 | PVE::AccessControl::user_set_tfa($userid, $realm, $type, $tfa_cfg); | |
567 | } else { | |
568 | # The default is U2F: | |
569 | my $u2f = get_u2f_instance($rpcenv); | |
570 | my $challenge = $u2f->registration_challenge() | |
571 | or raise("failed to get u2f challenge"); | |
572 | $challenge = decode_json($challenge); | |
573 | PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', $challenge); | |
574 | return $challenge; | |
575 | } | |
576 | } elsif ($action eq 'confirm') { | |
577 | raise_param_exc('response' => "confirm action requires the 'response' parameter to be set") | |
578 | if !defined($response); | |
579 | ||
580 | my ($type, $u2fdata) = PVE::AccessControl::user_get_tfa($userid, $realm); | |
581 | raise("no u2f data available") | |
582 | if (!defined($type) || $type ne 'u2f'); | |
583 | ||
584 | my $challenge = $u2fdata->{challenge} | |
585 | or raise("no active challenge"); | |
586 | ||
587 | my $u2f = get_u2f_instance($rpcenv); | |
588 | $u2f->set_challenge($challenge); | |
589 | my ($keyHandle, $publicKey) = $u2f->registration_verify($response); | |
590 | PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', { | |
591 | keyHandle => $keyHandle, | |
592 | publicKey => encode_base64($publicKey, ''), | |
593 | }); | |
594 | } else { | |
595 | die "invalid action: $action\n"; | |
596 | } | |
597 | ||
598 | return {}; | |
599 | }}); | |
600 | ||
601 | __PACKAGE__->register_method({ | |
602 | name => 'verify_tfa', | |
603 | path => 'tfa', | |
604 | method => 'POST', | |
605 | permissions => { user => 'all' }, | |
606 | protected => 1, # else we can't access shadow files | |
607 | description => 'Finish a u2f challenge.', | |
608 | parameters => { | |
609 | additionalProperties => 0, | |
610 | properties => { | |
611 | response => { | |
612 | type => 'string', | |
613 | description => 'The response to the current authentication challenge.', | |
614 | }, | |
615 | } | |
616 | }, | |
617 | returns => { | |
618 | type => 'object', | |
619 | properties => { | |
620 | ticket => { type => 'string' }, | |
621 | # cap | |
622 | } | |
623 | }, | |
624 | code => sub { | |
625 | my ($param) = @_; | |
626 | ||
627 | my $rpcenv = PVE::RPCEnvironment::get(); | |
628 | my $authuser = $rpcenv->get_user(); | |
629 | my ($username, undef, $realm) = PVE::AccessControl::verify_username($authuser); | |
630 | ||
631 | my ($tfa_type, $tfa_data) = PVE::AccessControl::user_get_tfa($username, $realm); | |
632 | if (!defined($tfa_type)) { | |
633 | raise('no u2f data available'); | |
634 | } | |
635 | ||
636 | eval { | |
637 | if ($tfa_type eq 'u2f') { | |
638 | my $challenge = $rpcenv->get_u2f_challenge() | |
639 | or raise('no active challenge'); | |
640 | ||
641 | my $keyHandle = $tfa_data->{keyHandle}; | |
642 | my $publicKey = $tfa_data->{publicKey}; | |
643 | raise("incomplete u2f setup") | |
644 | if !defined($keyHandle) || !defined($publicKey); | |
645 | ||
646 | my $u2f = get_u2f_instance($rpcenv, $publicKey, $keyHandle); | |
647 | $u2f->set_challenge($challenge); | |
648 | ||
649 | my ($counter, $present) = $u2f->auth_verify($param->{response}); | |
650 | # Do we want to do anything with these? | |
651 | } else { | |
652 | # sanity check before handing off to the verification code: | |
653 | my $keys = $tfa_data->{keys} or die "missing tfa keys\n"; | |
654 | my $config = $tfa_data->{config} or die "bad tfa entry\n"; | |
655 | PVE::AccessControl::verify_one_time_pw($tfa_type, $authuser, $keys, $config, $param->{response}); | |
656 | } | |
657 | }; | |
658 | if (my $err = $@) { | |
659 | my $clientip = $rpcenv->get_client_ip() || ''; | |
660 | syslog('err', "authentication verification failure; rhost=$clientip user=$authuser msg=$err"); | |
661 | die PVE::Exception->new("authentication failure\n", code => 401); | |
662 | } | |
663 | ||
664 | return { | |
665 | ticket => PVE::AccessControl::assemble_ticket($authuser), | |
666 | cap => &$compute_api_permission($rpcenv, $authuser), | |
667 | } | |
668 | }}); | |
669 | ||
670 | 1; |