use new PVE::Tools::encrypt_pw, bump version to 5.0-3

[pve-access-control.git] / PVE / Auth / Plugin.pm

diff --git a/PVE/Auth/Plugin.pm b/PVE/Auth/Plugin.pm
index e9d54f0147c943ddb340dcc04acb396c669c166f..b5f474b3ffc06e71b51383c3cb3b5bd273e16e57 100755 (executable)
--- a/PVE/Auth/Plugin.pm
+++ b/PVE/Auth/Plugin.pm
@@ -83,11 +83,51 @@ PVE::JSONSchema::register_standard_option('userid', {
     maxLength => 64,
 });
 
-sub encrypt_pw {
-    my ($pw) = @_;
+PVE::JSONSchema::register_format('pve-tfa-config', \&verify_tfa_config);
+sub verify_tfa_config {
+    my ($value, $noerr) = @_;
 
-    my $time = substr(Digest::SHA::sha1_base64 (time), 0, 8);
-    return crypt(encode("utf8", $pw), "\$5\$$time\$");
+    return $value if parse_tfa_config($value);
+
+    return undef if $noerr;
+
+    die "unable to parse tfa option\n";
+}
+
+PVE::JSONSchema::register_standard_option('tfa', {
+    description => "Use Two-factor authentication.",
+    type => 'string', format => 'pve-tfa-config',
+    optional => 1,
+    maxLength => 128,
+});
+
+sub parse_tfa_config {
+    my ($data) = @_;
+
+    my $res = {};
+
+    foreach my $kvp (split(/,/, $data)) {
+
+       if ($kvp =~ m/^type=(yubico|oath)$/) {
+           $res->{type} = $1;
+       } elsif ($kvp =~ m/^id=(\S+)$/) {
+           $res->{id} = $1;
+       } elsif ($kvp =~ m/^key=(\S+)$/) {
+           $res->{key} = $1;
+       } elsif ($kvp =~ m/^url=(\S+)$/) {
+           $res->{url} = $1;
+       } elsif ($kvp =~ m/^digits=([6|7|8])$/) {
+           $res->{digits} = $1;
+       } elsif ($kvp =~ m/^step=([1-9]\d+)$/) {
+           $res->{step} = $1;
+       } else {
+           return undef;
+       }           
+    }
+
+    return undef if !$res->{type};
+
+    return $res;
 }
 
 my $defaultData = {
@@ -140,16 +180,14 @@ sub parse_config {
 
     # add default domains
 
-    $cfg->{ids}->{pve} = {
-       type => 'pve',
-       comment => "Proxmox VE authentication server", 
-    };
+    $cfg->{ids}->{pve}->{type} = 'pve'; # force type
+    $cfg->{ids}->{pve}->{comment} = "Proxmox VE authentication server"
+       if !$cfg->{ids}->{pve}->{comment};
 
-    $cfg->{ids}->{pam} = {
-       type => 'pam',
-       plugin => 'PVE::Auth::PAM',
-       comment => "Linux PAM standard authentication", 
-    };
+    $cfg->{ids}->{pam}->{type} = 'pam'; # force type
+    $cfg->{ids}->{pam}->{plugin} =  'PVE::Auth::PAM';
+    $cfg->{ids}->{pam}->{comment} = "Linux PAM standard authentication"
+       if !$cfg->{ids}->{pam}->{comment};
 
     return $cfg;
 };
@@ -157,9 +195,6 @@ sub parse_config {
 sub write_config {
     my ($class, $filename, $cfg) = @_;
 
-    delete $cfg->{ids}->{pve};
-    delete $cfg->{ids}->{pam};
-
     foreach my $realm (keys %{$cfg->{ids}}) {
        my $data = $cfg->{ids}->{$realm};
        if ($data->{comment}) {