1 package PVE
::API2
::OpenId
;
6 use PVE
::Tools
qw(extract_param);
9 use PVE
::Exception
qw(raise raise_perm_exc raise_param_exc);
11 use PVE
::RPCEnvironment
;
12 use PVE
::Cluster
qw(cfs_read_file cfs_write_file);
13 use PVE
::AccessControl
;
14 use PVE
::JSONSchema
qw(get_standard_option);
15 use PVE
::Auth
::Plugin
;
19 use base
qw(PVE::RESTHandler);
21 my $openid_state_path = "/var/lib/pve-manager";
23 my $lookup_openid_auth = sub {
24 my ($realm, $redirect_url) = @_;
26 my $cfg = cfs_read_file
('domains.cfg');
27 my $ids = $cfg->{ids
};
29 die "authentication domain '$realm' does not exist\n" if !$ids->{$realm};
31 my $config = $ids->{$realm};
32 die "wrong realm type ($config->{type} != openid)\n" if $config->{type
} ne "openid";
35 issuer_url
=> $config->{'issuer-url'},
36 client_id
=> $config->{'client-id'},
37 client_key
=> $config->{'client-key'},
40 my $openid = PVE
::RS
::OpenId-
>discover($openid_config, $redirect_url);
41 return ($config, $openid);
44 __PACKAGE__-
>register_method ({
48 description
=> "Directory index.",
53 additionalProperties
=> 0,
61 subdir
=> { type
=> 'string' },
64 links
=> [ { rel
=> 'child', href
=> "{subdir}" } ],
70 { subdir
=> 'auth-url' },
71 { subdir
=> 'login' },
75 __PACKAGE__-
>register_method ({
80 description
=> "Get the OpenId Authorization Url for the specified realm.",
82 additionalProperties
=> 0,
84 realm
=> get_standard_option
('realm'),
86 description
=> "Redirection Url. The client should set this to the used server url (location.origin).",
94 description
=> "Redirection URL.",
96 permissions
=> { user
=> 'world' },
100 my $dcconf = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
101 local $ENV{all_proxy
} = $dcconf->{http_proxy
} if exists $dcconf->{http_proxy
};
103 my $realm = extract_param
($param, 'realm');
104 my $redirect_url = extract_param
($param, 'redirect-url');
106 my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
107 my $url = $openid->authorize_url($openid_state_path , $realm);
112 __PACKAGE__-
>register_method ({
117 description
=> " Verify OpenID authorization code and create a ticket.",
119 additionalProperties
=> 0,
122 description
=> "OpenId state.",
127 description
=> "OpenId authorization code.",
132 description
=> "Redirection Url. The client should set this to the used server url (location.origin).",
140 username
=> { type
=> 'string' },
141 ticket
=> { type
=> 'string' },
142 CSRFPreventionToken
=> { type
=> 'string' },
143 cap
=> { type
=> 'object' }, # computed api permissions
144 clustername
=> { type
=> 'string', optional
=> 1 },
147 permissions
=> { user
=> 'world' },
151 my $rpcenv = PVE
::RPCEnvironment
::get
();
155 my $dcconf = PVE
::Cluster
::cfs_read_file
('datacenter.cfg');
156 local $ENV{all_proxy
} = $dcconf->{http_proxy
} if exists $dcconf->{http_proxy
};
158 my ($realm, $private_auth_state) = PVE
::RS
::OpenId
::verify_public_auth_state
(
159 $openid_state_path, $param->{'state'});
161 my $redirect_url = extract_param
($param, 'redirect-url');
163 my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
165 my $info = $openid->verify_authorization_code($param->{code
}, $private_auth_state);
166 my $subject = $info->{'sub'};
169 if (defined(my $user_attr = $config->{'username-claim'})) {
170 if (defined($info->{$user_attr})) {
171 $unique_name = $info->{$user_attr};
172 } elsif ($user_attr eq 'subject') { # stay compat with old versions
173 $unique_name = $subject;
174 } elsif ($user_attr eq 'username') { # stay compat with old versions
175 my $username = $info->{'preferred_username'};
176 die "missing claim 'preferred_username'\n" if !defined($username);
177 $unique_name = $username;
179 # neither the attr nor fallback are defined in info..
180 die "missing configured claim '$user_attr'\n";
184 my $username = "${unique_name}\@${realm}";
186 # first, check if $username respects our naming conventions
187 PVE
::Auth
::Plugin
::verify_username
($username);
189 if ($config->{'autocreate'} && !$rpcenv->check_user_exist($username, 1)) {
190 PVE
::AccessControl
::lock_user_config
(sub {
191 my $usercfg = cfs_read_file
("user.cfg");
193 die "user '$username' already exists\n" if $usercfg->{users
}->{$username};
195 my $entry = { enable
=> 1 };
196 if (defined(my $email = $info->{'email'})) {
197 $entry->{email
} = $email;
199 if (defined(my $given_name = $info->{'given_name'})) {
200 $entry->{firstname
} = $given_name;
202 if (defined(my $family_name = $info->{'family_name'})) {
203 $entry->{lastname
} = $family_name;
206 $usercfg->{users
}->{$username} = $entry;
208 cfs_write_file
("user.cfg", $usercfg);
209 }, "autocreate openid user failed");
211 # test if user exists and is enabled
212 $rpcenv->check_user_enabled($username);
215 my $ticket = PVE
::AccessControl
::assemble_ticket
($username);
216 my $csrftoken = PVE
::AccessControl
::assemble_csrf_prevention_token
($username);
217 my $cap = $rpcenv->compute_api_permission($username);
221 username
=> $username,
222 CSRFPreventionToken
=> $csrftoken,
226 my $clinfo = PVE
::Cluster
::get_clinfo
();
227 if ($clinfo->{cluster
}->{name
} && $rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
228 $res->{clustername
} = $clinfo->{cluster
}->{name
};
232 my $clientip = $rpcenv->get_client_ip() || '';
233 syslog
('err', "openid authentication failure; rhost=$clientip msg=$err");
234 # do not return any info to prevent user enumeration attacks
235 die PVE
::Exception-
>new("authentication failure\n", code
=> 401);
238 PVE
::Cluster
::log_msg
('info', 'root@pam', "successful openid auth for user '$res->{username}'");