bump version to 6.1-3

[pve-access-control.git] / PVE / API2 / User.pm

diff --git a/PVE/API2/User.pm b/PVE/API2/User.pm
index 311f913853d9a79747b661131597006512f12350..05de57f37d4155078b30cfd646bb7457732a5940 100644 (file)
--- a/PVE/API2/User.pm
+++ b/PVE/API2/User.pm
@@ -229,41 +229,40 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::lock_user_config(
-           sub {
+       PVE::AccessControl::lock_user_config(sub {
+           my ($username, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
 
-               my ($username, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
+           my $usercfg = cfs_read_file("user.cfg");
 
-               my $usercfg = cfs_read_file("user.cfg");
+           # ensure "user exists" check works for case insensitive realms
+           $username = PVE::AccessControl::lookup_username($username, 1);
+           die "user '$username' already exists\n" if $usercfg->{users}->{$username};
 
-               die "user '$username' already exists\n"
-                   if $usercfg->{users}->{$username};
+           PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password})
+               if defined($param->{password});
 
-               PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password})
-                   if defined($param->{password});
+           my $enable = defined($param->{enable}) ? $param->{enable} : 1;
+           $usercfg->{users}->{$username} = { enable => $enable };
+           $usercfg->{users}->{$username}->{expire} = $param->{expire} if $param->{expire};
 
-               my $enable = defined($param->{enable}) ? $param->{enable} : 1;
-               $usercfg->{users}->{$username} = { enable => $enable };
-               $usercfg->{users}->{$username}->{expire} = $param->{expire} if $param->{expire};
-
-               if ($param->{groups}) {
-                   foreach my $group (split_list($param->{groups})) {
-                       if ($usercfg->{groups}->{$group}) {
-                           PVE::AccessControl::add_user_group($username, $usercfg, $group);
-                       } else {
-                           die "no such group '$group'\n";
-                       }
+           if ($param->{groups}) {
+               foreach my $group (split_list($param->{groups})) {
+                   if ($usercfg->{groups}->{$group}) {
+                       PVE::AccessControl::add_user_group($username, $usercfg, $group);
+                   } else {
+                       die "no such group '$group'\n";
                    }
                }
+           }
 
-               $usercfg->{users}->{$username}->{firstname} = $param->{firstname} if $param->{firstname};
-               $usercfg->{users}->{$username}->{lastname} = $param->{lastname} if $param->{lastname};
-               $usercfg->{users}->{$username}->{email} = $param->{email} if $param->{email};
-               $usercfg->{users}->{$username}->{comment} = $param->{comment} if $param->{comment};
-               $usercfg->{users}->{$username}->{keys} = $param->{keys} if $param->{keys};
+           $usercfg->{users}->{$username}->{firstname} = $param->{firstname} if $param->{firstname};
+           $usercfg->{users}->{$username}->{lastname} = $param->{lastname} if $param->{lastname};
+           $usercfg->{users}->{$username}->{email} = $param->{email} if $param->{email};
+           $usercfg->{users}->{$username}->{comment} = $param->{comment} if $param->{comment};
+           $usercfg->{users}->{$username}->{keys} = $param->{keys} if $param->{keys};
 
-               cfs_write_file("user.cfg", $usercfg);
-           }, "create user failed");
+           cfs_write_file("user.cfg", $usercfg);
+       }, "create user failed");
 
        return undef;
     }});
@@ -600,6 +599,11 @@ __PACKAGE__->register_method ({
                type => 'string',
                description => 'API token value used for authentication.',
            },
+           'full-tokenid' => {
+               type => 'string',
+               format_description => '<userid>!<tokenid>',
+               description => 'The full token id.',
+           },
        },
     },
     code => sub {
@@ -611,7 +615,7 @@ __PACKAGE__->register_method ({
        my $usercfg = cfs_read_file("user.cfg");
 
        my $token = PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid, 1);
-       my $value;
+       my ($full_tokenid, $value);
 
        PVE::AccessControl::check_user_exist($usercfg, $userid);
        raise_param_exc({ 'tokenid' => 'Token already exists.' }) if defined($token);
@@ -621,7 +625,7 @@ __PACKAGE__->register_method ({
            PVE::AccessControl::check_user_exist($usercfg, $userid);
            die "Token already exists.\n" if defined(PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid, 1));
 
-           my $full_tokenid = PVE::AccessControl::join_tokenid($userid, $tokenid);
+           $full_tokenid = PVE::AccessControl::join_tokenid($userid, $tokenid);
            $value = PVE::TokenConfig::generate_token($full_tokenid);
 
            $token = {};
@@ -635,7 +639,11 @@ __PACKAGE__->register_method ({
 
        PVE::AccessControl::lock_user_config($generate_and_add_token, 'generating token failed');
 
-       return { info => $token, value => $value };
+       return {
+           info => $token,
+           value => $value,
+           'full-tokenid' => $full_tokenid,
+       };
     }});