1 package PVE
::API2
::OpenId
;
6 use PVE
::Tools
qw(extract_param);
9 use PVE
::Exception
qw(raise raise_perm_exc raise_param_exc);
11 use PVE
::RPCEnvironment
;
12 use PVE
::Cluster
qw(cfs_read_file cfs_write_file);
13 use PVE
::AccessControl
;
14 use PVE
::JSONSchema
qw(get_standard_option);
15 use PVE
::Auth
::Plugin
;
19 use base
qw(PVE::RESTHandler);
21 my $openid_state_path = "/var/lib/pve-manager";
23 my $lookup_openid_auth = sub {
24 my ($realm, $redirect_url) = @_;
26 my $cfg = cfs_read_file
('domains.cfg');
27 my $ids = $cfg->{ids
};
29 die "authentication domain '$realm' does not exist\n" if !$ids->{$realm};
31 my $config = $ids->{$realm};
32 die "wrong realm type ($config->{type} != openid)\n" if $config->{type
} ne "openid";
35 issuer_url
=> $config->{'issuer-url'},
36 client_id
=> $config->{'client-id'},
37 client_key
=> $config->{'client-key'},
39 $openid_config->{prompt
} = $config->{'prompt'} if defined($config->{'prompt'});
41 my $scopes = $config->{'scopes'} // 'email profile';
42 $openid_config->{scopes
} = [ PVE
::Tools
::split_list
($scopes) ];
44 my $openid = PVE
::RS
::OpenId-
>discover($openid_config, $redirect_url);
45 return ($config, $openid);
48 __PACKAGE__-
>register_method ({
52 description
=> "Directory index.",
57 additionalProperties
=> 0,
65 subdir
=> { type
=> 'string' },
68 links
=> [ { rel
=> 'child', href
=> "{subdir}" } ],
74 { subdir
=> 'auth-url' },
75 { subdir
=> 'login' },
79 __PACKAGE__-
>register_method ({
84 description
=> "Get the OpenId Authorization Url for the specified realm.",
86 additionalProperties
=> 0,
88 realm
=> get_standard_option
('realm'),
90 description
=> "Redirection Url. The client should set this to the used server url (location.origin).",
98 description
=> "Redirection URL.",
100 permissions
=> { user
=> 'world' },
104 my $dcconf = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
105 local $ENV{all_proxy
} = $dcconf->{http_proxy
} if exists $dcconf->{http_proxy
};
107 my $realm = extract_param
($param, 'realm');
108 my $redirect_url = extract_param
($param, 'redirect-url');
110 my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
111 my $url = $openid->authorize_url($openid_state_path , $realm);
116 __PACKAGE__-
>register_method ({
121 description
=> " Verify OpenID authorization code and create a ticket.",
123 additionalProperties
=> 0,
126 description
=> "OpenId state.",
131 description
=> "OpenId authorization code.",
136 description
=> "Redirection Url. The client should set this to the used server url (location.origin).",
144 username
=> { type
=> 'string' },
145 ticket
=> { type
=> 'string' },
146 CSRFPreventionToken
=> { type
=> 'string' },
147 cap
=> { type
=> 'object' }, # computed api permissions
148 clustername
=> { type
=> 'string', optional
=> 1 },
151 permissions
=> { user
=> 'world' },
155 my $rpcenv = PVE
::RPCEnvironment
::get
();
159 my $dcconf = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
160 local $ENV{all_proxy
} = $dcconf->{http_proxy
} if exists $dcconf->{http_proxy
};
162 my ($realm, $private_auth_state) = PVE
::RS
::OpenId
::verify_public_auth_state
(
163 $openid_state_path, $param->{'state'});
165 my $redirect_url = extract_param
($param, 'redirect-url');
167 my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
169 my $info = $openid->verify_authorization_code($param->{code
}, $private_auth_state);
170 my $subject = $info->{'sub'};
173 if (defined(my $user_attr = $config->{'username-claim'})) {
174 if (defined($info->{$user_attr})) {
175 $unique_name = $info->{$user_attr};
176 } elsif ($user_attr eq 'subject') { # stay compat with old versions
177 $unique_name = $subject;
178 } elsif ($user_attr eq 'username') { # stay compat with old versions
179 my $username = $info->{'preferred_username'};
180 die "missing claim 'preferred_username'\n" if !defined($username);
181 $unique_name = $username;
183 # neither the attr nor fallback are defined in info..
184 die "missing configured claim '$user_attr'\n";
188 my $username = "${unique_name}\@${realm}";
190 # first, check if $username respects our naming conventions
191 PVE
::Auth
::Plugin
::verify_username
($username);
193 if ($config->{'autocreate'} && !$rpcenv->check_user_exist($username, 1)) {
194 PVE
::AccessControl
::lock_user_config
(sub {
195 my $usercfg = cfs_read_file
("user.cfg");
197 die "user '$username' already exists\n" if $usercfg->{users
}->{$username};
199 my $entry = { enable
=> 1 };
200 if (defined(my $email = $info->{'email'})) {
201 $entry->{email
} = $email;
203 if (defined(my $given_name = $info->{'given_name'})) {
204 $entry->{firstname
} = $given_name;
206 if (defined(my $family_name = $info->{'family_name'})) {
207 $entry->{lastname
} = $family_name;
210 $usercfg->{users
}->{$username} = $entry;
212 cfs_write_file
("user.cfg", $usercfg);
213 }, "autocreate openid user failed");
215 # test if user exists and is enabled
216 $rpcenv->check_user_enabled($username);
219 my $ticket = PVE
::AccessControl
::assemble_ticket
($username);
220 my $csrftoken = PVE
::AccessControl
::assemble_csrf_prevention_token
($username);
221 my $cap = $rpcenv->compute_api_permission($username);
225 username
=> $username,
226 CSRFPreventionToken
=> $csrftoken,
230 my $clinfo = PVE
::Cluster
::get_clinfo
();
231 if ($clinfo->{cluster
}->{name
} && $rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
232 $res->{clustername
} = $clinfo->{cluster
}->{name
};
236 my $clientip = $rpcenv->get_client_ip() || '';
237 syslog
('err', "openid authentication failure; rhost=$clientip msg=$err");
238 # do not return any info to prevent user enumeration attacks
239 die PVE
::Exception-
>new("authentication failure\n", code
=> 401);
242 PVE
::Cluster
::log_msg
('info', 'root@pam', "successful openid auth for user '$res->{username}'");