use strict;
use warnings;
use PVE::Auth::Plugin;
-use Net::LDAP;
-use Net::IP;
+use PVE::LDAP;
use base qw(PVE::Auth::Plugin);
sub properties {
return {
- server1 => {
- description => "Server IP address (or DNS name)",
+ server1 => {
+ description => "Server IP address (or DNS name)",
type => 'string',
format => 'address',
maxLength => 256,
},
- server2 => {
+ server2 => {
description => "Fallback Server IP address (or DNS name)",
type => 'string',
optional => 1,
format => 'address',
maxLength => 256,
},
- secure => {
+ secure => {
description => "Use secure LDAPS protocol.",
- type => 'boolean',
+ type => 'boolean',
+ optional => 1,
+ },
+ sslversion => {
+ description => "LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!",
+ type => 'string',
+ enum => [qw(tlsv1 tlsv1_1 tlsv1_2 tlsv1_3)],
optional => 1,
-
},
- default => {
+ default => {
description => "Use this as default realm",
- type => 'boolean',
+ type => 'boolean',
optional => 1,
},
- comment => {
+ comment => {
description => "Description.",
- type => 'string',
+ type => 'string',
optional => 1,
maxLength => 4096,
},
optional => 1,
maxLength => 256,
},
- tfa => PVE::JSONSchema::get_standard_option('tfa'),
+ tfa => PVE::JSONSchema::get_standard_option('tfa'),
};
}
domain => {},
port => { optional => 1 },
secure => { optional => 1 },
+ sslversion => { optional => 1 },
default => { optional => 1 },,
comment => { optional => 1 },
tfa => { optional => 1 },
+ verify => { optional => 1 },
+ capath => { optional => 1 },
+ cert => { optional => 1 },
+ certkey => { optional => 1 },
};
}
-my $authenticate_user_ad = sub {
- my ($config, $server, $username, $password) = @_;
+sub authenticate_user {
+ my ($class, $config, $realm, $username, $password) = @_;
+
+ my $servers = [$config->{server1}];
+ push @$servers, $config->{server2} if $config->{server2};
my $default_port = $config->{secure} ? 636: 389;
- my $port = $config->{port} ? $config->{port} : $default_port;
+ my $port = $config->{port} // $default_port;
my $scheme = $config->{secure} ? 'ldaps' : 'ldap';
- $server = "[$server]" if Net::IP::ip_is_ipv6($server);
- my $conn_string = "$scheme://${server}:$port";
-
- my $ldap = Net::LDAP->new($conn_string) || die "$@\n";
- $username = "$username\@$config->{domain}"
+ my %ad_args;
+ if ($config->{verify}) {
+ $ad_args{verify} = 'require';
+ $ad_args{clientcert} = $config->{cert} if $config->{cert};
+ $ad_args{clientkey} = $config->{certkey} if $config->{certkey};
+ if (defined(my $capath = $config->{capath})) {
+ if (-d $capath) {
+ $ad_args{capath} = $capath;
+ } else {
+ $ad_args{cafile} = $capath;
+ }
+ }
+ } elsif (defined($config->{verify})) {
+ $ad_args{verify} = 'none';
+ }
+
+ if ($config->{secure}) {
+ $ad_args{sslversion} = $config->{sslversion} // 'tlsv1_2';
+ }
+
+ my $ldap = PVE::LDAP::ldap_connect($servers, $scheme, $port, \%ad_args);
+
+ $username = "$username\@$config->{domain}"
if $username !~ m/@/ && $config->{domain};
- my $res = $ldap->bind($username, password => $password);
-
- my $code = $res->code();
- my $err = $res->error;
+ PVE::LDAP::auth_user_dn($ldap, $username, $password);
$ldap->unbind();
-
- die "$err\n" if ($code);
-};
-
-sub authenticate_user {
- my ($class, $config, $realm, $username, $password) = @_;
-
- eval { &$authenticate_user_ad($config, $config->{server1}, $username, $password); };
- my $err = $@;
- return 1 if !$err;
- die $err if !$config->{server2};
- &$authenticate_user_ad($config, $config->{server2}, $username, $password);
return 1;
}