use PVE::LDAP module instead of useing Net::LDAP directly

[pve-access-control.git] / PVE / Auth / AD.pm

diff --git a/PVE/Auth/AD.pm b/PVE/Auth/AD.pm
index 35396b937c77f2efffc5d93c18d8740827204c0f..06fac9dff9f4faa279469e51f7a179c93aa83684 100755 (executable)
--- a/PVE/Auth/AD.pm
+++ b/PVE/Auth/AD.pm
@@ -3,7 +3,7 @@ package PVE::Auth::AD;
 use strict;
 use warnings;
 use PVE::Auth::Plugin;
-use Net::LDAP;
+use PVE::LDAP;
 
 use base qw(PVE::Auth::Plugin);
 
@@ -13,33 +13,38 @@ sub type {
 
 sub properties {
     return {
-       server1 => { 
-           description => "Server IP address (or DNS name)",           
+       server1 => {
+           description => "Server IP address (or DNS name)",
            type => 'string',
-           pattern => '[\w\d]+(.[\w\d]+)*',
+           format => 'address',
            maxLength => 256,
        },
-       server2 => { 
+       server2 => {
            description => "Fallback Server IP address (or DNS name)",
            type => 'string',
            optional => 1,
-           pattern => '[\w\d]+(.[\w\d]+)*',
+           format => 'address',
            maxLength => 256,
        },
-       secure => { 
+       secure => {
            description => "Use secure LDAPS protocol.",
-           type => 'boolean', 
+           type => 'boolean',
+           optional => 1,
+       },
+       sslversion => {
+           description => "LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!",
+           type => 'string',
+           enum => [qw(tlsv1 tlsv1_1 tlsv1_2 tlsv1_3)],
            optional => 1,
-
        },
-       default => { 
+       default => {
            description => "Use this as default realm",
-           type => 'boolean', 
+           type => 'boolean',
            optional => 1,
        },
-       comment => { 
+       comment => {
            description => "Description.",
-           type => 'string', 
+           type => 'string',
            optional => 1,
            maxLength => 4096,
        },
@@ -57,6 +62,7 @@ sub properties {
            optional => 1,
            maxLength => 256,
        },
+       tfa => PVE::JSONSchema::get_standard_option('tfa'),
     };
 }
 
@@ -67,42 +73,55 @@ sub options {
        domain => {},
        port => { optional => 1 },
        secure => { optional => 1 },
+       sslversion => { optional => 1 },
        default => { optional => 1 },,
        comment => { optional => 1 },
+       tfa => { optional => 1 },
+       verify => { optional => 1 },
+       capath => { optional => 1 },
+       cert => { optional => 1 },
+       certkey => { optional => 1 },
     };
 }
 
-my $authenticate_user_ad = sub {
-    my ($config, $server, $username, $password) = @_;
+sub authenticate_user {
+    my ($class, $config, $realm, $username, $password) = @_;
+
+    my $servers = [$config->{server1}];
+    push @$servers, $config->{server2} if $config->{server2};
 
     my $default_port = $config->{secure} ? 636: 389;
-    my $port = $config->{port} ? $config->{port} : $default_port;
+    my $port = $config->{port} // $default_port;
     my $scheme = $config->{secure} ? 'ldaps' : 'ldap';
-    my $conn_string = "$scheme://${server}:$port";
-    
-    my $ldap = Net::LDAP->new($conn_string) || die "$@\n";
 
-    $username = "$username\@$config->{domain}" 
+    my %ad_args;
+    if ($config->{verify}) {
+       $ad_args{verify} = 'require';
+       $ad_args{clientcert} = $config->{cert} if $config->{cert};
+       $ad_args{clientkey} = $config->{certkey} if $config->{certkey};
+       if (defined(my $capath = $config->{capath})) {
+           if (-d $capath) {
+               $ad_args{capath} = $capath;
+           } else {
+               $ad_args{cafile} = $capath;
+           }
+       }
+    } elsif (defined($config->{verify})) {
+       $ad_args{verify} = 'none';
+    }
+
+    if ($config->{secure}) {
+       $ad_args{sslversion} = $config->{sslversion} // 'tlsv1_2';
+    }
+
+    my $ldap = PVE::LDAP::ldap_connect($servers, $scheme, $port, \%ad_args);
+
+    $username = "$username\@$config->{domain}"
        if $username !~ m/@/ && $config->{domain};
 
-    my $res = $ldap->bind($username, password => $password);
-
-    my $code = $res->code();
-    my $err = $res->error;
+    PVE::LDAP::auth_user_dn($ldap, $username, $password);
 
     $ldap->unbind();
-
-    die "$err\n" if ($code);
-};
-
-sub authenticate_user {
-    my ($class, $config, $realm, $username, $password) = @_;
-
-    eval { &$authenticate_user_ad($config, $config->{server1}, $username, $password); };
-    my $err = $@;
-    return 1 if !$err;
-    die $err if !$config->{server2};
-    &$authenticate_user_ad($config, $config->{server2}, $username, $password);
     return 1;
 }