fix #1470: ad: server and client certificate support

[pve-access-control.git] / PVE / Auth / AD.pm

diff --git a/PVE/Auth/AD.pm b/PVE/Auth/AD.pm
index d33d3933b62adf38569bb9bfef015fc6b69edaa4..b9db568c912f6a9b683bb11fdebb5d18dfc0b9e6 100755 (executable)
--- a/PVE/Auth/AD.pm
+++ b/PVE/Auth/AD.pm
@@ -4,6 +4,7 @@ use strict;
 use warnings;
 use PVE::Auth::Plugin;
 use Net::LDAP;
+use Net::IP;
 
 use base qw(PVE::Auth::Plugin);
 
@@ -16,14 +17,14 @@ sub properties {
        server1 => { 
            description => "Server IP address (or DNS name)",           
            type => 'string',
-           pattern => '[\w\d]+(.[\w\d]+)*',
+           format => 'address',
            maxLength => 256,
        },
        server2 => { 
            description => "Fallback Server IP address (or DNS name)",
            type => 'string',
            optional => 1,
-           pattern => '[\w\d]+(.[\w\d]+)*',
+           format => 'address',
            maxLength => 256,
        },
        secure => { 
@@ -71,6 +72,10 @@ sub options {
        default => { optional => 1 },,
        comment => { optional => 1 },
        tfa => { optional => 1 },
+       verify => { optional => 1 },
+       capath => { optional => 1 },
+       cert => { optional => 1 },
+       certkey => { optional => 1 },
     };
 }
 
@@ -80,11 +85,32 @@ my $authenticate_user_ad = sub {
     my $default_port = $config->{secure} ? 636: 389;
     my $port = $config->{port} ? $config->{port} : $default_port;
     my $scheme = $config->{secure} ? 'ldaps' : 'ldap';
+    $server = "[$server]" if Net::IP::ip_is_ipv6($server);
     my $conn_string = "$scheme://${server}:$port";
-    
-    my $ldap = Net::LDAP->new($conn_string) || die "$@\n";
 
-    $username = "$username\@$config->{domain}" 
+    my %ad_args;
+    if ($config->{verify}) {
+       $ad_args{verify} = 'require';
+       if (defined(my $cert = $config->{cert})) {
+           $ad_args{clientcert} = $cert;
+       }
+       if (defined(my $key = $config->{certkey})) {
+           $ad_args{clientkey} = $key;
+       }
+       if (defined(my $capath = $config->{capath})) {
+           if (-d $capath) {
+               $ad_args{capath} = $capath;
+           } else {
+               $ad_args{cafile} = $capath;
+           }
+       }
+    } elsif (defined($config->{verify})) {
+       $ad_args{verify} = 'none';
+    }
+
+    my $ldap = Net::LDAP->new($conn_string, %ad_args) || die "$@\n";
+
+    $username = "$username\@$config->{domain}"
        if $username !~ m/@/ && $config->{domain};
 
     my $res = $ldap->bind($username, password => $password);