use PVE::SafeSyslog;
use PVE::RPCEnvironment;
use PVE::Cluster qw(cfs_read_file);
+use PVE::Corosync;
use PVE::RESTHandler;
use PVE::AccessControl;
use PVE::JSONSchema qw(get_standard_option);
my $usercfg = $rpcenv->{user_cfg};
- my $nodelist = PVE::Cluster::get_nodelist();
- my $vmlist = PVE::Cluster::get_vmlist() || {};
- my $idlist = $vmlist->{ids} || {};
-
- my $cfg = PVE::Storage::config();
- my @sids = PVE::Storage::storage_ids ($cfg);
-
- my $res = {
- vms => {},
- storage => {},
- access => {},
- nodes => {},
- dc => {},
- };
-
- my $extract_vm_caps = sub {
- my ($path) = @_;
-
- my $perm = $rpcenv->permissions($authuser, $path);
- foreach my $priv (keys %$perm) {
- next if !($priv eq 'Permissions.Modify' || $priv =~ m/^VM\./);
- $res->{vms}->{$priv} = 1;
- }
+ my $res = {};
+ my $priv_re_map = {
+ vms => qr/VM\.|Permissions\.Modify/,
+ access => qr/(User|Group)\.|Permissions\.Modify/,
+ storage => qr/Datastore\.|Permissions\.Modify/,
+ nodes => qr/Sys\.|Permissions\.Modify/,
+ dc => qr/Sys\.Audit/,
};
-
- foreach my $pool (keys %{$usercfg->{pools}}) {
- &$extract_vm_caps("/pool/$pool");
- }
-
- foreach my $vmid (keys %$idlist, '__phantom__') {
- &$extract_vm_caps("/vms/$vmid");
- }
-
- foreach my $storeid (@sids, '__phantom__') {
- my $perm = $rpcenv->permissions($authuser, "/storage/$storeid");
- foreach my $priv (keys %$perm) {
- next if !($priv eq 'Permissions.Modify' || $priv =~ m/^Datastore\./);
- $res->{storage}->{$priv} = 1;
- }
- }
-
- foreach my $path (('/access/groups')) {
- my $perm = $rpcenv->permissions($authuser, $path);
- foreach my $priv (keys %$perm) {
- next if $priv !~ m/^(User|Group)\./;
- $res->{access}->{$priv} = 1;
- }
- }
-
- foreach my $group (keys %{$usercfg->{users}->{$authuser}->{groups}}, '__phantom__') {
- my $perm = $rpcenv->permissions($authuser, "/access/groups/$group");
- if ($perm->{'User.Modify'}) {
- $res->{access}->{'User.Modify'} = 1;
- }
- }
-
- foreach my $node (@$nodelist) {
- my $perm = $rpcenv->permissions($authuser, "/nodes/$node");
- foreach my $priv (keys %$perm) {
- next if $priv !~ m/^Sys\./;
- $res->{nodes}->{$priv} = 1;
+ map { $res->{$_} = {} } keys %$priv_re_map;
+
+ my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage'];
+
+ my $checked_paths = {};
+ foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
+ next if $checked_paths->{$path};
+ $checked_paths->{$path} = 1;
+
+ my $path_perm = $rpcenv->permissions($authuser, $path);
+
+ my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
+ if ($toplevel eq 'pool') {
+ foreach my $priv (keys %$path_perm) {
+ if ($priv =~ m/^VM\./) {
+ $res->{vms}->{$priv} = 1;
+ } elsif ($priv =~ m/^Datastore\./) {
+ $res->{storage}->{$priv} = 1;
+ } elsif ($priv eq 'Permissions.Modify') {
+ $res->{storage}->{$priv} = 1;
+ $res->{vms}->{$priv} = 1;
+ }
+ }
+ } else {
+ my $priv_regex = $priv_re_map->{$toplevel} // next;
+ foreach my $priv (keys %$path_perm) {
+ next if $priv !~ m/^($priv_regex)/;
+ $res->{$toplevel}->{$priv} = 1;
+ }
}
}
- my $perm = $rpcenv->permissions($authuser, "/");
- $res->{dc}->{'Sys.Audit'} = 1 if $perm->{'Sys.Audit'};
-
return $res;
};
path => 'ticket',
method => 'GET',
permissions => { user => 'world' },
- description => "Dummy. Useful for formaters which want to priovde a login page.",
+ description => "Dummy. Useful for formatters which want to provide a login page.",
parameters => {
additionalProperties => 0,
},
additionalProperties => 0,
properties => {
username => {
- description => "User name",
- type => 'string',
- maxLength => 64,
+ description => "User name",
+ type => 'string',
+ maxLength => 64,
+ completion => \&PVE::AccessControl::complete_username,
},
realm => get_standard_option('realm', {
description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.",
- optional => 1}),
+ optional => 1,
+ completion => \&PVE::AccessControl::complete_realm,
+ }),
password => {
description => "The secret password. This can also be a valid ticket.",
type => 'string',
username => { type => 'string' },
ticket => { type => 'string', optional => 1},
CSRFPreventionToken => { type => 'string', optional => 1 },
+ clustername => { type => 'string', optional => 1 },
}
},
code => sub {
$res->{cap} = &$compute_api_permission($rpcenv, $username);
+ if (PVE::Corosync::check_conf_exists(1)) {
+ if ($rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
+ eval {
+ my $conf = cfs_read_file('corosync.conf');
+ my $totem = PVE::Corosync::totem_config($conf);
+ if ($totem->{cluster_name}) {
+ $res->{clustername} = $totem->{cluster_name};
+ }
+ };
+ warn "$@\n" if $@;
+ }
+ }
+
PVE::Cluster::log_msg('info', 'root@pam', "successful auth for user '$username'");
return $res;
}});
__PACKAGE__->register_method ({
- name => 'change_passsword',
+ name => 'change_password',
path => 'password',
method => 'PUT',
permissions => {
parameters => {
additionalProperties => 0,
properties => {
- userid => get_standard_option('userid'),
+ userid => get_standard_option('userid-completed'),
password => {
description => "The new password.",
type => 'string',