1 package PVE
::API2
::User
;
5 use PVE
::Exception
qw(raise raise_perm_exc);
6 use PVE
::Cluster qw
(cfs_read_file cfs_write_file
);
7 use PVE
::Tools
qw(split_list);
8 use PVE
::AccessControl
;
9 use PVE
::JSONSchema
qw(get_standard_option);
13 use Data
::Dumper
; # fixme: remove
17 use base
qw(PVE::RESTHandler);
19 my $extract_user_data = sub {
20 my ($data, $full) = @_;
24 foreach my $prop (qw(enable expire firstname lastname email comment keys)) {
25 $res->{$prop} = $data->{$prop} if defined($data->{$prop});
28 return $res if !$full;
30 $res->{groups
} = $data->{groups
} ?
[ keys %{$data->{groups
}} ] : [];
35 __PACKAGE__-
>register_method ({
39 description
=> "User index.",
41 description
=> "The returned list is restricted to users where you have 'User.Modify' or 'Sys.Audit' permissions on '/access/groups' or on a group the user belongs too. But it always includes the current (authenticated) user.",
45 additionalProperties
=> 0,
49 description
=> "Optional filter for enable property.",
59 userid
=> { type
=> 'string' },
62 links
=> [ { rel
=> 'child', href
=> "{userid}" } ],
67 my $rpcenv = PVE
::RPCEnvironment
::get
();
68 my $usercfg = $rpcenv->{user_cfg
};
69 my $authuser = $rpcenv->get_user();
73 my $privs = [ 'User.Modify', 'Sys.Audit' ];
74 my $canUserMod = $rpcenv->check_any($authuser, "/access/groups", $privs, 1);
75 my $groups = $rpcenv->filter_groups($authuser, $privs, 1);
76 my $allowed_users = $rpcenv->group_member_join([keys %$groups]);
78 foreach my $user (keys %{$usercfg->{users
}}) {
80 if (!($canUserMod || $user eq $authuser)) {
81 next if !$allowed_users->{$user};
84 my $entry = &$extract_user_data($usercfg->{users
}->{$user});
86 if (defined($param->{enabled
})) {
87 next if $entry->{enable
} && !$param->{enabled
};
88 next if !$entry->{enable
} && $param->{enabled
};
91 $entry->{userid
} = $user;
98 __PACKAGE__-
>register_method ({
99 name
=> 'create_user',
104 description
=> "You need 'Realm.AllocateUser' on '/access/realm/<realm>' on the realm of user <userid>, and 'User.Modify' permissions to '/access/groups/<group>' for any group specified (or 'User.Modify' on '/access/groups' if you pass no groups.",
106 [ 'userid-param', 'Realm.AllocateUser'],
107 [ 'userid-group', ['User.Modify'], groups_param
=> 1],
110 description
=> "Create new user.",
112 additionalProperties
=> 0,
114 userid
=> get_standard_option
('userid'),
116 description
=> "Initial password.",
123 type
=> 'string', format
=> 'pve-groupid-list',
125 completion
=> \
&PVE
::AccessControl
::complete_group
,
127 firstname
=> { type
=> 'string', optional
=> 1 },
128 lastname
=> { type
=> 'string', optional
=> 1 },
129 email
=> { type
=> 'string', optional
=> 1, format
=> 'email-opt' },
130 comment
=> { type
=> 'string', optional
=> 1 },
132 description
=> "Keys for two factor auth (yubico).",
137 description
=> "Account expiration date (seconds since epoch). '0' means no expiration date.",
143 description
=> "Enable the account (default). You can set this to '0' to disable the accout",
150 returns
=> { type
=> 'null' },
154 PVE
::AccessControl
::lock_user_config
(
157 my ($username, $ruid, $realm) = PVE
::AccessControl
::verify_username
($param->{userid
});
159 my $usercfg = cfs_read_file
("user.cfg");
161 die "user '$username' already exists\n"
162 if $usercfg->{users
}->{$username};
164 PVE
::AccessControl
::domain_set_password
($realm, $ruid, $param->{password
})
165 if defined($param->{password
});
167 my $enable = defined($param->{enable
}) ?
$param->{enable
} : 1;
168 $usercfg->{users
}->{$username} = { enable
=> $enable };
169 $usercfg->{users
}->{$username}->{expire
} = $param->{expire
} if $param->{expire
};
171 if ($param->{groups
}) {
172 foreach my $group (split_list
($param->{groups
})) {
173 if ($usercfg->{groups
}->{$group}) {
174 PVE
::AccessControl
::add_user_group
($username, $usercfg, $group);
176 die "no such group '$group'\n";
181 $usercfg->{users
}->{$username}->{firstname
} = $param->{firstname
} if $param->{firstname
};
182 $usercfg->{users
}->{$username}->{lastname
} = $param->{lastname
} if $param->{lastname
};
183 $usercfg->{users
}->{$username}->{email
} = $param->{email
} if $param->{email
};
184 $usercfg->{users
}->{$username}->{comment
} = $param->{comment
} if $param->{comment
};
185 $usercfg->{users
}->{$username}->{keys} = $param->{keys} if $param->{keys};
187 cfs_write_file
("user.cfg", $usercfg);
188 }, "create user failed");
193 __PACKAGE__-
>register_method ({
197 description
=> "Get user configuration.",
199 check
=> ['userid-group', ['User.Modify', 'Sys.Audit']],
202 additionalProperties
=> 0,
204 userid
=> get_standard_option
('userid'),
208 additionalProperties
=> 0,
210 enable
=> { type
=> 'boolean' },
211 expire
=> { type
=> 'integer', optional
=> 1 },
212 firstname
=> { type
=> 'string', optional
=> 1 },
213 lastname
=> { type
=> 'string', optional
=> 1 },
214 email
=> { type
=> 'string', optional
=> 1 },
215 comment
=> { type
=> 'string', optional
=> 1 },
216 keys => { type
=> 'string', optional
=> 1 },
217 groups
=> { type
=> 'array' },
223 my ($username, undef, $domain) =
224 PVE
::AccessControl
::verify_username
($param->{userid
});
226 my $usercfg = cfs_read_file
("user.cfg");
228 my $data = PVE
::AccessControl
::check_user_exist
($usercfg, $username);
230 return &$extract_user_data($data, 1);
233 __PACKAGE__-
>register_method ({
234 name
=> 'update_user',
239 check
=> ['userid-group', ['User.Modify'], groups_param
=> 1 ],
241 description
=> "Update user configuration.",
243 additionalProperties
=> 0,
245 userid
=> get_standard_option
('userid', {
246 completion
=> \
&PVE
::AccessControl
::complete_username
,
249 type
=> 'string', format
=> 'pve-groupid-list',
251 completion
=> \
&PVE
::AccessControl
::complete_group
,
256 requires
=> 'groups',
259 description
=> "Enable/disable the account.",
263 firstname
=> { type
=> 'string', optional
=> 1 },
264 lastname
=> { type
=> 'string', optional
=> 1 },
265 email
=> { type
=> 'string', optional
=> 1, format
=> 'email-opt' },
266 comment
=> { type
=> 'string', optional
=> 1 },
268 description
=> "Keys for two factor auth (yubico).",
273 description
=> "Account expiration date (seconds since epoch). '0' means no expiration date.",
280 returns
=> { type
=> 'null' },
284 my ($username, $ruid, $realm) =
285 PVE
::AccessControl
::verify_username
($param->{userid
});
287 PVE
::AccessControl
::lock_user_config
(
290 my $usercfg = cfs_read_file
("user.cfg");
292 PVE
::AccessControl
::check_user_exist
($usercfg, $username);
294 $usercfg->{users
}->{$username}->{enable
} = $param->{enable
} if defined($param->{enable
});
296 $usercfg->{users
}->{$username}->{expire
} = $param->{expire
} if defined($param->{expire
});
298 PVE
::AccessControl
::delete_user_group
($username, $usercfg)
299 if (!$param->{append
} && defined($param->{groups
}));
301 if ($param->{groups
}) {
302 foreach my $group (split_list
($param->{groups
})) {
303 if ($usercfg->{groups
}->{$group}) {
304 PVE
::AccessControl
::add_user_group
($username, $usercfg, $group);
306 die "no such group '$group'\n";
311 $usercfg->{users
}->{$username}->{firstname
} = $param->{firstname
} if defined($param->{firstname
});
312 $usercfg->{users
}->{$username}->{lastname
} = $param->{lastname
} if defined($param->{lastname
});
313 $usercfg->{users
}->{$username}->{email
} = $param->{email
} if defined($param->{email
});
314 $usercfg->{users
}->{$username}->{comment
} = $param->{comment
} if defined($param->{comment
});
315 $usercfg->{users
}->{$username}->{keys} = $param->{keys} if defined($param->{keys});
317 cfs_write_file
("user.cfg", $usercfg);
318 }, "update user failed");
323 __PACKAGE__-
>register_method ({
324 name
=> 'delete_user',
328 description
=> "Delete user.",
331 [ 'userid-param', 'Realm.AllocateUser'],
332 [ 'userid-group', ['User.Modify']],
336 additionalProperties
=> 0,
338 userid
=> get_standard_option
('userid', {
339 completion
=> \
&PVE
::AccessControl
::complete_username
,
343 returns
=> { type
=> 'null' },
347 my $rpcenv = PVE
::RPCEnvironment
::get
();
348 my $authuser = $rpcenv->get_user();
350 my ($userid, $ruid, $realm) =
351 PVE
::AccessControl
::verify_username
($param->{userid
});
353 PVE
::AccessControl
::lock_user_config
(
356 my $usercfg = cfs_read_file
("user.cfg");
358 my $domain_cfg = cfs_read_file
('domains.cfg');
359 if (my $cfg = $domain_cfg->{ids
}->{$realm}) {
360 my $plugin = PVE
::Auth
::Plugin-
>lookup($cfg->{type
});
361 $plugin->delete_user($cfg, $realm, $ruid);
364 delete $usercfg->{users
}->{$userid};
366 PVE
::AccessControl
::delete_user_group
($userid, $usercfg);
367 PVE
::AccessControl
::delete_user_acl
($userid, $usercfg);
369 cfs_write_file
("user.cfg", $usercfg);
370 }, "delete user failed");