add more privileges, improve docs

[pve-access-control.git] / PVE / API2 / Domains.pm

diff --git a/PVE/API2/Domains.pm b/PVE/API2/Domains.pm
index 117ef3c92fd58a5f020349507b0789aee7c0e102..27a1c895c92dbf3a75b8364e0b96fd4dcb7d4f32 100644 (file)
--- a/PVE/API2/Domains.pm
+++ b/PVE/API2/Domains.pm
@@ -7,9 +7,6 @@ use PVE::AccessControl;
 use PVE::JSONSchema qw(get_standard_option);
 
 use PVE::SafeSyslog;
-
-use Data::Dumper; # fixme: remove
-
 use PVE::RESTHandler;
 
 my $domainconfigfile = "domains.cfg";
@@ -21,7 +18,10 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Authentication domain index.",
-    permissions => { user => 'world' },
+    permissions => { 
+       description => "Anyone can access that, because we need that list for the login box (before the user is authenticated).",
+       user => 'world', 
+    },
     parameters => {
        additionalProperties => 0,
        properties => {},
@@ -60,6 +60,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Add an authentication server.",
     parameters => {
        additionalProperties => 0,
@@ -146,12 +149,15 @@ __PACKAGE__->register_method ({
 
                foreach my $p (keys %$param) {
                    next if $p eq 'realm';
-                   $cfg->{$realm}->{$p} = $param->{$p};
+                   $cfg->{$realm}->{$p} = $param->{$p} if $param->{$p};
                }
 
                # port 0 ==> use default
-               if (defined($param->{port}) && !$param->{port}) { 
-                   delete $cfg->{$realm}->{port};
+               # server2 == '' ===> delete server2
+               for my $p (qw(port server2)) { 
+                   if (defined($param->{$p}) && !$param->{$p}) { 
+                       delete $cfg->{$realm}->{$p};
+                   }
                }
 
                cfs_write_file($domainconfigfile, $cfg);
@@ -164,6 +170,9 @@ __PACKAGE__->register_method ({
     name => 'update', 
     path => '{realm}', 
     method => 'PUT',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Update authentication server settings.",
     protected => 1,
     parameters => {
@@ -247,12 +256,11 @@ __PACKAGE__->register_method ({
                }
 
                foreach my $p (keys %$param) {
-                   $cfg->{$realm}->{$p} = $param->{$p};
-               }
-
-               # port 0 ==> use default
-               if (defined($param->{port}) && !$param->{port}) { 
-                   delete $cfg->{$realm}->{port};
+                   if ($param->{$p}) {
+                       $cfg->{$realm}->{$p} = $param->{$p};
+                   } else {
+                       delete $cfg->{$realm}->{$p};
+                   }
                }
 
                cfs_write_file($domainconfigfile, $cfg);
@@ -267,6 +275,9 @@ __PACKAGE__->register_method ({
     path => '{realm}', 
     method => 'GET',
     description => "Get auth server configuration.",
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate', 'Sys.Audit'], any => 1],
+    },
     parameters => {
        additionalProperties => 0,
        properties => {
@@ -292,6 +303,9 @@ __PACKAGE__->register_method ({
     name => 'delete', 
     path => '{realm}', 
     method => 'DELETE',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Delete an authentication server.",
     protected => 1,
     parameters => {