add more privileges, improve docs

[pve-access-control.git] / PVE / API2 / Domains.pm

diff --git a/PVE/API2/Domains.pm b/PVE/API2/Domains.pm
index f080c716e92eeeecfdcdeae113166aa228001102..27a1c895c92dbf3a75b8364e0b96fd4dcb7d4f32 100644 (file)
--- a/PVE/API2/Domains.pm
+++ b/PVE/API2/Domains.pm
@@ -7,9 +7,6 @@ use PVE::AccessControl;
 use PVE::JSONSchema qw(get_standard_option);
 
 use PVE::SafeSyslog;
-
-use Data::Dumper; # fixme: remove
-
 use PVE::RESTHandler;
 
 my $domainconfigfile = "domains.cfg";
@@ -21,7 +18,10 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Authentication domain index.",
-    permissions => { user => 'world' },
+    permissions => { 
+       description => "Anyone can access that, because we need that list for the login box (before the user is authenticated).",
+       user => 'world', 
+    },
     parameters => {
        additionalProperties => 0,
        properties => {},
@@ -60,6 +60,9 @@ __PACKAGE__->register_method ({
     protected => 1,
     path => '', 
     method => 'POST',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Add an authentication server.",
     parameters => {
        additionalProperties => 0,
@@ -94,9 +97,9 @@ __PACKAGE__->register_method ({
                optional => 1,
            },
            port => {
-               description => "Server port",
+               description => "Server port. Use '0' if you want to use default settings'",
                type => 'integer',
-               minimum => 1,
+               minimum => 0,
                maximum => 65535,
                optional => 1,
            },
@@ -137,7 +140,7 @@ __PACKAGE__->register_method ({
                if (defined($param->{secure})) {
                    $cfg->{$realm}->{secure} = $param->{secure} ? 1 : 0;
                }
-       
+
                if ($param->{default}) {
                    foreach my $r (keys %$cfg) {
                        delete $cfg->{$r}->{default};
@@ -146,7 +149,15 @@ __PACKAGE__->register_method ({
 
                foreach my $p (keys %$param) {
                    next if $p eq 'realm';
-                   $cfg->{$realm}->{$p} = $param->{$p};
+                   $cfg->{$realm}->{$p} = $param->{$p} if $param->{$p};
+               }
+
+               # port 0 ==> use default
+               # server2 == '' ===> delete server2
+               for my $p (qw(port server2)) { 
+                   if (defined($param->{$p}) && !$param->{$p}) { 
+                       delete $cfg->{$realm}->{$p};
+                   }
                }
 
                cfs_write_file($domainconfigfile, $cfg);
@@ -159,6 +170,9 @@ __PACKAGE__->register_method ({
     name => 'update', 
     path => '{realm}', 
     method => 'PUT',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Update authentication server settings.",
     protected => 1,
     parameters => {
@@ -190,9 +204,9 @@ __PACKAGE__->register_method ({
                optional => 1,
            },
            port => {
-               description => "Server port",
+               description => "Server port. Use '0' if you want to use default settings'",
                type => 'integer',
-               minimum => 1,
+               minimum => 0,
                maximum => 65535,
                optional => 1,
            },
@@ -242,7 +256,11 @@ __PACKAGE__->register_method ({
                }
 
                foreach my $p (keys %$param) {
-                   $cfg->{$realm}->{$p} = $param->{$p};
+                   if ($param->{$p}) {
+                       $cfg->{$realm}->{$p} = $param->{$p};
+                   } else {
+                       delete $cfg->{$realm}->{$p};
+                   }
                }
 
                cfs_write_file($domainconfigfile, $cfg);
@@ -257,6 +275,9 @@ __PACKAGE__->register_method ({
     path => '{realm}', 
     method => 'GET',
     description => "Get auth server configuration.",
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate', 'Sys.Audit'], any => 1],
+    },
     parameters => {
        additionalProperties => 0,
        properties => {
@@ -282,6 +303,9 @@ __PACKAGE__->register_method ({
     name => 'delete', 
     path => '{realm}', 
     method => 'DELETE',
+    permissions => { 
+       check => ['perm', '/access/realm', ['Realm.Allocate']],
+    },
     description => "Delete an authentication server.",
     protected => 1,
     parameters => {