fix #2947 login name for the LDAP/AD realm can be case-insensitive

[pve-access-control.git] / PVE / Auth / AD.pm

diff --git a/PVE/Auth/AD.pm b/PVE/Auth/AD.pm
index 42eb79d0a386e2127fc5e94ece5c26925b58b494..88b2098355bd3d1bf9cfb32be6ea257083b891d1 100755 (executable)
--- a/PVE/Auth/AD.pm
+++ b/PVE/Auth/AD.pm
@@ -2,11 +2,10 @@ package PVE::Auth::AD;
 
 use strict;
 use warnings;
-use PVE::Auth::Plugin;
-use Net::LDAP;
-use Net::IP;
+use PVE::Auth::LDAP;
+use PVE::LDAP;
 
-use base qw(PVE::Auth::Plugin);
+use base qw(PVE::Auth::LDAP);
 
 sub type {
     return 'ad';
@@ -28,10 +27,9 @@ sub properties {
            maxLength => 256,
        },
        secure => {
-           description => "Use secure LDAPS protocol.",
+           description => "Use secure LDAPS protocol. DEPRECATED: use 'mode' instead.",
            type => 'boolean',
            optional => 1,
-
        },
        sslversion => {
            description => "LDAPS TLS/SSL version. It's not recommended to use version older than 1.2!",
@@ -83,27 +81,44 @@ sub options {
        capath => { optional => 1 },
        cert => { optional => 1 },
        certkey => { optional => 1 },
+       base_dn => { optional => 1 },
+       bind_dn => { optional => 1 },
+       password => { optional => 1 },
+       user_attr => { optional => 1 },
+       filter => { optional => 1 },
+       sync_attributes => { optional => 1 },
+       user_classes => { optional => 1 },
+       group_dn => { optional => 1 },
+       group_name_attr => { optional => 1 },
+       group_filter => { optional => 1 },
+       group_classes => { optional => 1 },
+       'sync-defaults-options' => { optional => 1 },
+       mode => { optional => 1 },
+       'case-sensitive' => { optional => 1 },
     };
 }
 
-my $authenticate_user_ad = sub {
-    my ($config, $server, $username, $password) = @_;
+sub get_users {
+    my ($class, $config, $realm) = @_;
+
+    $config->{user_attr} //= 'sAMAccountName';
+
+    return $class->SUPER::get_users($config, $realm);
+}
+
+sub authenticate_user {
+    my ($class, $config, $realm, $username, $password) = @_;
+
+    my $servers = [$config->{server1}];
+    push @$servers, $config->{server2} if $config->{server2};
 
-    my $default_port = $config->{secure} ? 636: 389;
-    my $port = $config->{port} ? $config->{port} : $default_port;
-    my $scheme = $config->{secure} ? 'ldaps' : 'ldap';
-    $server = "[$server]" if Net::IP::ip_is_ipv6($server);
-    my $conn_string = "$scheme://${server}:$port";
+    my ($scheme, $port) = $class->get_scheme_and_port($config);
 
     my %ad_args;
     if ($config->{verify}) {
        $ad_args{verify} = 'require';
-       if (defined(my $cert = $config->{cert})) {
-           $ad_args{clientcert} = $cert;
-       }
-       if (defined(my $key = $config->{certkey})) {
-           $ad_args{clientkey} = $key;
-       }
+       $ad_args{clientcert} = $config->{cert} if $config->{cert};
+       $ad_args{clientkey} = $config->{certkey} if $config->{certkey};
        if (defined(my $capath = $config->{capath})) {
            if (-d $capath) {
                $ad_args{capath} = $capath;
@@ -115,33 +130,18 @@ my $authenticate_user_ad = sub {
        $ad_args{verify} = 'none';
     }
 
-    if ($config->{secure}) {
-       $ad_args{sslversion} = $config->{sslversion} || 'tlsv1_2';
+    if ($scheme ne 'ldap') {
+       $ad_args{sslversion} = $config->{sslversion} // 'tlsv1_2';
     }
 
-    my $ldap = Net::LDAP->new($conn_string, %ad_args) || die "$@\n";
+    my $ldap = PVE::LDAP::ldap_connect($servers, $scheme, $port, \%ad_args);
 
     $username = "$username\@$config->{domain}"
        if $username !~ m/@/ && $config->{domain};
 
-    my $res = $ldap->bind($username, password => $password);
-
-    my $code = $res->code();
-    my $err = $res->error;
+    PVE::LDAP::auth_user_dn($ldap, $username, $password);
 
     $ldap->unbind();
-
-    die "$err\n" if ($code);
-};
-
-sub authenticate_user {
-    my ($class, $config, $realm, $username, $password) = @_;
-
-    eval { &$authenticate_user_ad($config, $config->{server1}, $username, $password); };
-    my $err = $@;
-    return 1 if !$err;
-    die $err if !$config->{server2};
-    &$authenticate_user_ad($config, $config->{server2}, $username, $password);
     return 1;
 }