src/PVE/RPCEnvironment.pm

   1 package PVE::RPCEnvironment;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::AccessControl;
   7 use PVE::Cluster;
   8 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   9 use PVE::INotify;
  10 use PVE::ProcFSTools;
  11 use PVE::RESTEnvironment;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools;
  14
  15 use base qw(PVE::RESTEnvironment);
  16
  17 # ACL cache
  18
  19 my $compile_acl_path = sub {
  20     my ($self, $user, $path) = @_;
  21
  22     my $cfg = $self->{user_cfg};
  23
  24     return undef if !$cfg->{roles};
  25
  26     # permissions() has an early return for this case
  27     die "internal error" if $user eq 'root@pam';
  28
  29     my $cache = $self->{aclcache};
  30     $cache->{$user} = {} if !$cache->{$user};
  31     my $data = $cache->{$user};
  32
  33     # permissions() will always prime the cache for the owning user
  34     my ($username, undef) = PVE::AccessControl::split_tokenid($user, 1);
  35     die "internal error" if $username && $username ne 'root@pam' && !defined($cache->{$username});
  36
  37     # resolve and cache roles of the current user/token for all pool ACL paths
  38     if (!$data->{poolroles}) {
  39         $data->{poolroles} = {};
  40
  41         foreach my $pool (keys %{$cfg->{pools}}) {
  42             my $d = $cfg->{pools}->{$pool};
  43             my $pool_roles = PVE::AccessControl::roles($cfg, $user, "/pool/$pool"); # pool roles
  44             next if !scalar(keys %$pool_roles);
  45             foreach my $vmid (keys %{$d->{vms}}) {
  46                 for my $role (keys %$pool_roles) {
  47                     $data->{poolroles}->{"/vms/$vmid"}->{$role} = 1;
  48                 }
  49             }
  50             foreach my $storeid (keys %{$d->{storage}}) {
  51                 for my $role (keys %$pool_roles) {
  52                     $data->{poolroles}->{"/storage/$storeid"}->{$role} = 1;
  53                 }
  54             }
  55         }
  56     }
  57
  58     # get roles of current user/token on checked path - this already handles
  59     # propagation and NoAccess along the path
  60     #
  61     # hash mapping role name to propagation flag value, a key being defined
  62     # means the role is set
  63     my $roles = PVE::AccessControl::roles($cfg, $user, $path);
  64
  65     # apply roles inherited from pools
  66     if ($data->{poolroles}->{$path}) {
  67         # NoAccess must not be trumped by pool ACLs
  68         if (!defined($roles->{NoAccess})) {
  69             if ($data->{poolroles}->{$path}->{NoAccess}) {
  70                 # but pool ACL NoAccess trumps regular ACL
  71                 $roles = { 'NoAccess' => 0 };
  72             } else {
  73                 foreach my $role (keys %{$data->{poolroles}->{$path}}) {
  74                     # only use role from pool ACL if regular ACL didn't already
  75                     # set it, and never set propagation for pool-derived ACLs
  76                     $roles->{$role} = 0 if !defined($roles->{$role});
  77                 }
  78             }
  79         }
  80     }
  81
  82     # cache roles
  83     $data->{roles}->{$path} = $roles;
  84
  85     # derive privs from set roles - hash mapping privilege name to propagation
  86     # flag value, a key being defined means the priv is set
  87     my $privs = {};
  88     foreach my $role (keys %$roles) {
  89         if (my $privset = $cfg->{roles}->{$role}) {
  90             foreach my $p (keys %$privset) {
  91                 # set priv '$p' to propagated iff any of the set roles
  92                 # containing it have the propagated flag set
  93                 $privs->{$p} ||= $roles->{$role};
  94             }
  95         }
  96     }
  97
  98     # intersect user and token permissions
  99     if ($username && $username ne 'root@pam') {
 100         # map of set privs to their propagation flag value, for the owning user
 101         my $user_privs = $cache->{$username}->{privs}->{$path};
 102         # list of privs set both for token and owning user
 103         my $filtered_privs = [ grep { defined($user_privs->{$_}) } keys %$privs ];
 104         # intersection of privs using filtered list, combining both propagation
 105         # flags
 106         $privs = { map { $_ => $user_privs->{$_} && $privs->{$_} } @$filtered_privs };
 107     }
 108
 109     foreach my $priv (keys %$privs) {
 110         # safeguard, this should never happen anyway
 111         delete $privs->{$priv} if !defined($privs->{$priv});
 112     }
 113
 114     # cache privs
 115     $data->{privs}->{$path} = $privs;
 116
 117     return $privs;
 118 };
 119
 120 # this is the method used by permission check helpers below
 121 #
 122 # returned value is a hash mapping all set privileges on $path to their
 123 # respective propagation flag. the propagation flag is informational only -
 124 # actual propagation is handled in PVE::AccessControl::roles(). to determine
 125 # whether a privilege is set, check for definedness in the returned hash.
 126 #
 127 # compiled ACLs are cached, so repeated checks for the same path and user are
 128 # almost free.
 129 #
 130 # if $user is a tokenid, permissions are calculated depending on the
 131 # privilege-separation flag value:
 132 # - non-priv-separated: permissions for owning user are returned
 133 # - priv-separated: permissions for owning user are calculated and intersected
 134 #   with those of token
 135 sub permissions {
 136     my ($self, $user, $path) = @_;
 137
 138     if ($user eq 'root@pam') { # root can do anything
 139         my $cfg = $self->{user_cfg};
 140         return { map { $_ => 1 } keys %{$cfg->{roles}->{'Administrator'}} };
 141     }
 142
 143     if (!defined($path)) {
 144         # this shouldn't happen!
 145         warn "internal error: ACL check called for undefined ACL path!\n";
 146         return {};
 147     }
 148
 149     if (PVE::AccessControl::pve_verify_tokenid($user, 1)) {
 150         my ($username, $token) = PVE::AccessControl::split_tokenid($user);
 151         my $cfg = $self->{user_cfg};
 152         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
 153
 154         return {} if !$token_info;
 155
 156         # ensure cache for user is populated
 157         my $user_perms = $self->permissions($username, $path);
 158
 159         # return user privs for non-privsep tokens
 160         return $user_perms if !$token_info->{privsep};
 161     } else {
 162         $user = PVE::AccessControl::verify_username($user, 1);
 163         return {} if !$user;
 164     }
 165
 166     my $cache = $self->{aclcache};
 167     $cache->{$user} = {} if !$cache->{$user};
 168
 169     my $acl = $cache->{$user};
 170
 171     my $perm = $acl->{privs}->{$path};
 172     return $perm if $perm;
 173
 174     return &$compile_acl_path($self, $user, $path);
 175 }
 176
 177 sub compute_api_permission {
 178     my ($self, $authuser) = @_;
 179
 180     my $usercfg = $self->{user_cfg};
 181
 182     my $res = {};
 183     my $priv_re_map = {
 184         vms => qr/VM\.|Permissions\.Modify/,
 185         access => qr/(User|Group)\.|Permissions\.Modify/,
 186         storage => qr/Datastore\.|Permissions\.Modify/,
 187         nodes => qr/Sys\.|Permissions\.Modify/,
 188         sdn => qr/SDN\.|Permissions\.Modify/,
 189         dc => qr/Sys\.Audit|Sys\.Modify|SDN\./,
 190         mapping => qr/Mapping\.|Permissions.Modify/,
 191     };
 192     map { $res->{$_} = {} } keys %$priv_re_map;
 193
 194     my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn', '/mapping'];
 195     my $defined_paths = [];
 196     PVE::AccessControl::iterate_acl_tree("/", $usercfg->{acl_root}, sub {
 197         my ($path, $node) = @_;
 198         push @$defined_paths, $path;
 199     });
 200
 201     my $checked_paths = {};
 202     foreach my $path (@$required_paths, @$defined_paths) {
 203         next if $checked_paths->{$path};
 204         $checked_paths->{$path} = 1;
 205
 206         my $path_perm = $self->permissions($authuser, $path);
 207
 208         my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
 209         if ($toplevel eq 'pool') {
 210             foreach my $priv (keys %$path_perm) {
 211                 next if !defined($path_perm->{$priv});
 212
 213                 if ($priv =~ m/^VM\./) {
 214                     $res->{vms}->{$priv} = 1;
 215                 } elsif ($priv =~ m/^Datastore\./) {
 216                     $res->{storage}->{$priv} = 1;
 217                 } elsif ($priv eq 'Permissions.Modify') {
 218                     $res->{storage}->{$priv} = 1;
 219                     $res->{vms}->{$priv} = 1;
 220                 }
 221             }
 222         } else {
 223             my $priv_regex = $priv_re_map->{$toplevel} // next;
 224             foreach my $priv (keys %$path_perm) {
 225                 next if !defined($path_perm->{$priv});
 226
 227                 next if $priv !~ m/^($priv_regex)/;
 228                 $res->{$toplevel}->{$priv} = 1;
 229             }
 230         }
 231     }
 232
 233     return $res;
 234 }
 235
 236 sub get_effective_permissions {
 237     my ($self, $user) = @_;
 238
 239     # default / top level paths
 240     my $paths = {
 241         '/' => 1,
 242         '/access' => 1,
 243         '/access/groups' => 1,
 244         '/nodes' => 1,
 245         '/pool' => 1,
 246         '/sdn' => 1,
 247         '/storage' => 1,
 248         '/vms' => 1,
 249     };
 250
 251     my $cfg = $self->{user_cfg};
 252
 253     # paths explicitly listed in ACLs
 254     PVE::AccessControl::iterate_acl_tree("/", $cfg->{acl_root}, sub {
 255         my ($path, $node) = @_;
 256         $paths->{$path} = 1;
 257     });
 258
 259     # paths referenced by pool definitions
 260     foreach my $pool (keys %{$cfg->{pools}}) {
 261         my $d = $cfg->{pools}->{$pool};
 262         foreach my $vmid (keys %{$d->{vms}}) {
 263             $paths->{"/vms/$vmid"} = 1;
 264         }
 265         foreach my $storeid (keys %{$d->{storage}}) {
 266             $paths->{"/storage/$storeid"} = 1;
 267         }
 268     }
 269
 270     my $perms = {};
 271     foreach my $path (keys %$paths) {
 272         my $path_perms = $self->permissions($user, $path);
 273         foreach my $priv (keys %$path_perms) {
 274             delete $path_perms->{$priv} if !defined($path_perms->{$priv});
 275         }
 276         # filter paths where user has NO permissions
 277         $perms->{$path} = $path_perms if %$path_perms;
 278     }
 279     return $perms;
 280 }
 281
 282 sub check {
 283     my ($self, $user, $path, $privs, $noerr) = @_;
 284
 285     my $perm = $self->permissions($user, $path);
 286
 287     foreach my $priv (@$privs) {
 288         PVE::AccessControl::verify_privname($priv);
 289         if (!defined($perm->{$priv})) {
 290             return undef if $noerr;
 291             raise_perm_exc("$path, $priv");
 292         }
 293     };
 294
 295     return 1;
 296 };
 297
 298 sub check_any {
 299     my ($self, $user, $path, $privs, $noerr) = @_;
 300
 301     my $perm = $self->permissions($user, $path);
 302
 303     my $found = 0;
 304     foreach my $priv (@$privs) {
 305         PVE::AccessControl::verify_privname($priv);
 306         if (defined($perm->{$priv})) {
 307             $found = 1;
 308             last;
 309         }
 310     };
 311
 312     return 1 if $found;
 313
 314     return undef if $noerr;
 315
 316     raise_perm_exc("$path, " . join("|", @$privs));
 317 };
 318
 319 sub check_full {
 320     my ($self, $username, $path, $privs, $any, $noerr) = @_;
 321     if ($any) {
 322         return $self->check_any($username, $path, $privs, $noerr);
 323     } else {
 324         return $self->check($username, $path, $privs, $noerr);
 325     }
 326 }
 327
 328 # check for any fashion of access to vnet/bridge
 329 sub check_sdn_bridge {
 330     my ($self, $username, $zone, $bridge, $privs, $noerr) = @_;
 331
 332     my $path = "/sdn/zones/$zone/$bridge";
 333     # check access to bridge itself
 334     return 1 if $self->check_any($username, $path, $privs, 1);
 335
 336     my $cfg = $self->{user_cfg};
 337     my $bridge_acl = PVE::AccessControl::find_acl_tree_node($cfg->{acl_root}, $path);
 338     if ($bridge_acl) {
 339         # check access to VLANs
 340         my $vlans = $bridge_acl->{children};
 341         for my $vlan (keys %$vlans) {
 342             my $vlanpath = "$path/$vlan";
 343             return 1 if $self->check_any($username, $vlanpath, $privs, 1);
 344         }
 345     }
 346
 347     # repeat check, but fatal
 348     $self->check_any($username, $path, $privs, 0) if !$noerr;
 349
 350     return;
 351 }
 352
 353 sub check_user_enabled {
 354     my ($self, $user, $noerr) = @_;
 355
 356     my $cfg = $self->{user_cfg};
 357     return PVE::AccessControl::check_user_enabled($cfg, $user, $noerr);
 358 }
 359
 360 sub check_user_exist {
 361     my ($self, $user, $noerr) = @_;
 362
 363     my $cfg = $self->{user_cfg};
 364     return PVE::AccessControl::check_user_exist($cfg, $user, $noerr);
 365 }
 366
 367 sub check_pool_exist {
 368     my ($self, $pool, $noerr) = @_;
 369
 370     my $cfg = $self->{user_cfg};
 371
 372     return 1 if $cfg->{pools}->{$pool};
 373
 374     return undef if $noerr;
 375
 376     raise_perm_exc("pool '$pool' does not exist");
 377 }
 378
 379 sub check_vm_perm {
 380     my ($self, $user, $vmid, $pool, $privs, $any, $noerr) = @_;
 381
 382     my $cfg = $self->{user_cfg};
 383
 384     if ($pool) {
 385         return if $self->check_full($user, "/pool/$pool", $privs, $any, 1);
 386     }
 387     return $self->check_full($user, "/vms/$vmid", $privs, $any, $noerr);
 388 };
 389
 390 sub is_group_member {
 391     my ($self, $group, $user) = @_;
 392
 393     my $cfg = $self->{user_cfg};
 394
 395     return 0 if !$cfg->{groups}->{$group};
 396
 397     return defined($cfg->{groups}->{$group}->{users}->{$user});
 398 }
 399
 400 sub filter_groups {
 401     my ($self, $user, $privs, $any) = @_;
 402
 403     my $cfg = $self->{user_cfg};
 404
 405     my $groups = {};
 406     foreach my $group (keys %{$cfg->{groups}}) {
 407         my $path = "/access/groups/$group";
 408         if ($self->check_full($user, $path, $privs, $any, 1)) {
 409             $groups->{$group} = $cfg->{groups}->{$group};
 410         }
 411     }
 412
 413     return $groups;
 414 }
 415
 416 sub group_member_join {
 417     my ($self, $grouplist) = @_;
 418
 419     my $users = {};
 420
 421     my $cfg = $self->{user_cfg};
 422     foreach my $group (@$grouplist) {
 423         my $data = $cfg->{groups}->{$group};
 424         next if !$data;
 425         foreach my $user (keys %{$data->{users}}) {
 426             $users->{$user} = 1;
 427         }
 428     }
 429
 430     return $users;
 431 }
 432
 433 sub check_perm_modify {
 434     my ($self, $username, $path, $noerr) = @_;
 435
 436     return $self->check($username, '/access', [ 'Permissions.Modify' ], $noerr) if !$path;
 437
 438     my $testperms = [ 'Permissions.Modify' ];
 439     if ($path =~ m|^/storage/.+$|) {
 440         push @$testperms, 'Datastore.Allocate';
 441     } elsif ($path =~ m|^/vms/.+$|) {
 442         push @$testperms, 'VM.Allocate';
 443     } elsif ($path =~ m|^/pool/.+$|) {
 444         push @$testperms, 'Pool.Allocate';
 445     }
 446
 447     return $self->check_any($username, $path, $testperms, $noerr);
 448 }
 449
 450 sub exec_api2_perm_check {
 451     my ($self, $check, $username, $param, $noerr) = @_;
 452
 453     # syslog("info", "CHECK " . join(', ', @$check));
 454
 455     my $ind = 0;
 456     my $test = $check->[$ind++];
 457     die "no permission test specified" if !$test;
 458
 459     if ($test eq 'and') {
 460         while (my $subcheck = $check->[$ind++]) {
 461             $self->exec_api2_perm_check($subcheck, $username, $param);
 462         }
 463         return 1;
 464     } elsif ($test eq 'or') {
 465         while (my $subcheck = $check->[$ind++]) {
 466             return 1 if $self->exec_api2_perm_check($subcheck, $username, $param, 1);
 467         }
 468         return 0 if $noerr;
 469         raise_perm_exc();
 470     } elsif ($test eq 'perm') {
 471         my ($t, $tmplpath, $privs, %options) = @$check;
 472         my $any = $options{any};
 473         die "missing parameters" if !($tmplpath && $privs);
 474         my $require_param = $options{require_param};
 475         if ($require_param && !defined($param->{$require_param})) {
 476             return 0 if $noerr;
 477             raise_perm_exc();
 478         }
 479         my $path = PVE::Tools::template_replace($tmplpath, $param);
 480         my $normpath = PVE::AccessControl::normalize_path($path);
 481         warn "Failed to normalize '$path'\n" if !defined($normpath) && defined($path);
 482
 483         return $self->check_full($username, $normpath, $privs, $any, $noerr);
 484     } elsif ($test eq 'userid-group') {
 485         my $userid = $param->{userid};
 486         my ($t, $privs, %options) = @$check;
 487
 488         my $check_existing_user = !$options{groups_param} || $options{groups_param} ne 'create';
 489         return 0 if $check_existing_user && !$self->check_user_exist($userid, $noerr);
 490
 491         # check permission for ALL groups (and thus ALL users)
 492         if (!$self->check_any($username, "/access/groups", $privs, 1)) {
 493             # list of groups $username has any of $privs on
 494             my $groups = $self->filter_groups($username, $privs, 1);
 495             if ($options{groups_param}) {
 496                 # does $username have any of $privs on all new/updated/.. groups?
 497                 my @group_param = PVE::Tools::split_list($param->{groups});
 498                 raise_perm_exc("/access/groups, " . join("|", @$privs)) if !scalar(@group_param);
 499                 foreach my $pg (@group_param) {
 500                     raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
 501                         if !$groups->{$pg};
 502                 }
 503             }
 504             if ($check_existing_user) {
 505                 # does $username have any of $privs on any existing group of $userid
 506                 my $allowed_users = $self->group_member_join([keys %$groups]);
 507                 if (!$allowed_users->{$userid}) {
 508                     return 0 if $noerr;
 509                     raise_perm_exc();
 510                 }
 511             }
 512         }
 513         return 1;
 514     } elsif ($test eq 'userid-param') {
 515         my ($userid, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 516         my ($t, $subtest) = @$check;
 517         die "missing parameters" if !$subtest;
 518         if ($subtest eq 'self') {
 519             return 0 if !$self->check_user_exist($userid, $noerr);
 520             return 1 if $username eq $userid;
 521             return 0 if $noerr;
 522             raise_perm_exc();
 523         } elsif ($subtest eq 'Realm.AllocateUser') {
 524             my $path =  "/access/realm/$realm";
 525             return $self->check($username, $path, ['Realm.AllocateUser'], $noerr);
 526         } else {
 527             die "unknown userid-param test";
 528         }
 529     } elsif ($test eq 'perm-modify') {
 530         my ($t, $tmplpath) = @$check;
 531         my $path = PVE::Tools::template_replace($tmplpath, $param);
 532         $path = PVE::AccessControl::normalize_path($path);
 533         return 0 if !defined($path); # should already die in API2::ACL
 534         return $self->check_perm_modify($username, $path, $noerr);
 535     } else {
 536         die "unknown permission test";
 537     }
 538 };
 539
 540 sub check_api2_permissions {
 541     my ($self, $perm, $username, $param) = @_;
 542
 543     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 544
 545     raise_perm_exc("user != null") if !$username;
 546
 547     return 1 if $username eq 'root@pam';
 548
 549     raise_perm_exc('user != root@pam') if !$perm;
 550
 551     return 1 if $perm->{user} && $perm->{user} eq 'all';
 552
 553     return $self->exec_api2_perm_check($perm->{check}, $username, $param)
 554         if $perm->{check};
 555
 556     raise_perm_exc();
 557 }
 558
 559 sub log_cluster_msg {
 560     my ($self, $pri, $user, $msg) = @_;
 561
 562     PVE::Cluster::log_msg($pri, $user, $msg);
 563 }
 564
 565 sub broadcast_tasklist {
 566     my ($self, $tlist) = @_;
 567
 568     PVE::Cluster::broadcast_tasklist($tlist);
 569 }
 570
 571 # initialize environment - must be called once at program startup
 572 sub init {
 573     my ($class, $type, %params) = @_;
 574
 575     $class = ref($class) || $class;
 576
 577     my $self = $class->SUPER::init($type, %params);
 578
 579     $self->{user_cfg} = {};
 580     $self->{aclcache} = {};
 581     $self->{aclversion} = undef;
 582
 583     return $self;
 584 };
 585
 586
 587 # init_request - must be called before each RPC request
 588 sub init_request {
 589     my ($self, %params) = @_;
 590
 591     PVE::Cluster::cfs_update();
 592
 593     $self->{result_attributes} = {};
 594
 595     my $userconfig; # we use this for regression tests
 596     foreach my $p (keys %params) {
 597         if ($p eq 'userconfig') {
 598             $userconfig = $params{$p};
 599         } else {
 600             die "unknown parameter '$p'";
 601         }
 602     }
 603
 604     eval {
 605         $self->{aclcache} = {};
 606         if ($userconfig) {
 607             my $ucdata = PVE::Tools::file_get_contents($userconfig);
 608             my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
 609             $self->{user_cfg} = $cfg;
 610         } else {
 611             my $ucvers = PVE::Cluster::cfs_file_version('user.cfg');
 612             if (!$self->{aclcache} || !defined($self->{aclversion}) ||
 613                 !defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
 614                 $self->{aclversion} = $ucvers;
 615                 my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 616                 $self->{user_cfg} = $cfg;
 617             }
 618         }
 619     };
 620     if (my $err = $@) {
 621         $self->{user_cfg} = {};
 622         die "Unable to load access control list: $err";
 623     }
 624 }
 625
 626 # hacks: to provide better backwards compatibility
 627
 628 # old code uses PVE::RPCEnvironment::get();
 629 # new code should use PVE::RPCEnvironment->get();
 630 sub get {
 631     return PVE::RESTEnvironment->get();
 632 }
 633
 634 # old code uses PVE::RPCEnvironment::is_worker();
 635 # new code should use PVE::RPCEnvironment->is_worker();
 636 sub is_worker {
 637     return PVE::RESTEnvironment->is_worker();
 638 }
 639
 640 # Permission helper for TFA and password API endpoints modifying users.
 641 # Only root may modify root, regular users need to specify their password.
 642 #
 643 # Returns the same as `verify_username` in list context (userid, ruid, realm),
 644 # or just the userid in scalar context.
 645 sub reauth_user_for_user_modification : prototype($$$$;$) {
 646     my ($rpcenv, $authuser, $userid, $password, $param_name) = @_;
 647
 648     $param_name //= 'password';
 649
 650     ($userid, my $ruid, my $realm) = PVE::AccessControl::verify_username($userid);
 651     $rpcenv->check_user_exist($userid);
 652
 653     raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam';
 654
 655     # Regular users need to confirm their password to change TFA settings.
 656     if ($authuser ne 'root@pam') {
 657         raise_param_exc({ $param_name => 'password is required to modify user' })
 658             if !defined($password);
 659
 660         ($authuser, my $auth_username, my $auth_realm) =
 661             PVE::AccessControl::verify_username($authuser);
 662
 663         my $domain_cfg = PVE::Cluster::cfs_read_file('domains.cfg');
 664         my $cfg = $domain_cfg->{ids}->{$auth_realm};
 665         die "auth domain '$auth_realm' does not exist\n" if !$cfg;
 666         my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 667         $plugin->authenticate_user($cfg, $auth_realm, $auth_username, $password);
 668     }
 669
 670     return wantarray ? ($userid, $ruid, $realm) : $userid;
 671 }
 672
 673 1;