+libpve-access-control (7.2-3) bullseye; urgency=medium
+
+ * api: token: use userid-group as API perm check to avoid being overly
+ strict through a misguided use of user id for non-root users.
+
+ * perm check: forbid undefined/empty ACL path for future proofing of against
+ above issue
+
+ -- Proxmox Support Team <support@proxmox.com> Mon, 20 Jun 2022 15:51:14 +0200
+
+libpve-access-control (7.2-2) bullseye; urgency=medium
+
+ * permissions: merge propagation flag for multiple roles on a path that
+ share privilege in a deterministic way, to avoid that it gets lost
+ depending on perl's random sort, which would result in returing less
+ privileges than an auth-id actually had.
+
+ * permissions: avoid that token and user privilege intersection is to strict
+ for user permissions that have propagation disabled.
+
+ -- Proxmox Support Team <support@proxmox.com> Fri, 03 Jun 2022 14:02:30 +0200
+
+libpve-access-control (7.2-1) bullseye; urgency=medium
+
+ * user check: fix expiration/enable order
+
+ -- Proxmox Support Team <support@proxmox.com> Tue, 31 May 2022 13:43:37 +0200
+
+libpve-access-control (7.1-8) bullseye; urgency=medium
+
+ * fix #3668: realm-sync: replace 'full' & 'purge' with 'remove-
+ vanished'
+
+ -- Proxmox Support Team <support@proxmox.com> Thu, 28 Apr 2022 17:02:46 +0200
+
+libpve-access-control (7.1-7) bullseye; urgency=medium
+
+ * userid-group check: distinguish create and update
+
+ * api: get user: declare token schema
+
+ -- Proxmox Support Team <support@proxmox.com> Mon, 21 Mar 2022 16:15:23 +0100
+
+libpve-access-control (7.1-6) bullseye; urgency=medium
+
+ * fix #3768: warn on bad u2f or webauthn settings
+
+ * tfa: when modifying others, verify the current user's password
+
+ * tfa list: account for admin permissions
+
+ * fix realm sync permissions
+
+ * fix token permission display bug
+
+ * include SDN permissions in permission tree
+
+ -- Proxmox Support Team <support@proxmox.com> Fri, 21 Jan 2022 14:20:42 +0100
+
+libpve-access-control (7.1-5) bullseye; urgency=medium
+
+ * openid: fix username-claim fallback
+
+ -- Proxmox Support Team <support@proxmox.com> Thu, 25 Nov 2021 07:57:38 +0100
+
+libpve-access-control (7.1-4) bullseye; urgency=medium
+
+ * set current origin in the webauthn config if no fixed origin was
+ configured, to support webauthn via subdomains
+
+ -- Proxmox Support Team <support@proxmox.com> Mon, 22 Nov 2021 14:04:06 +0100
+
+libpve-access-control (7.1-3) bullseye; urgency=medium
+
+ * openid: allow arbitrary username-claims
+
+ * openid: support configuring the prompt, scopes and ACR values
+
+ -- Proxmox Support Team <support@proxmox.com> Fri, 19 Nov 2021 08:11:52 +0100
+
+libpve-access-control (7.1-2) bullseye; urgency=medium
+
+ * catch incompatible tfa entries with a nice error
+
+ -- Proxmox Support Team <support@proxmox.com> Wed, 17 Nov 2021 13:44:45 +0100
+
+libpve-access-control (7.1-1) bullseye; urgency=medium
+
+ * tfa: map HTTP 404 error in get_tfa_entry correctly
+
+ -- Proxmox Support Team <support@proxmox.com> Mon, 15 Nov 2021 15:33:22 +0100
+
+libpve-access-control (7.0-7) bullseye; urgency=medium
+
+ * fix #3513: pass configured proxy to OpenID
+
+ * use rust based parser for TFA config
+
+ * use PBS-like auth api call flow,
+
+ * merge old user.cfg keys to tfa config when adding entries
+
+ * implement version checks for new tfa config writer to ensure all
+ cluster nodes are ready to avoid login issues
+
+ * tickets: add tunnel ticket
+
+ -- Proxmox Support Team <support@proxmox.com> Thu, 11 Nov 2021 18:17:49 +0100
+
libpve-access-control (7.0-6) bullseye; urgency=medium
* fix regression in user deletion when realm does not enforce TFA
* add realm sub commands to pveum CLI tool
- * api: domains: add user group sync API enpoint
+ * api: domains: add user group sync API endpoint
* allow one to sync and import users and groups from LDAP/AD based realms
libpve-access-control (5.1-9) unstable; urgency=medium
* store the tfa type in user.cfg allowing to get it without proxying the call
- to a higher priviledged daemon.
+ to a higher privileged daemon.
* tfa: realm required TFA should lock out users without TFA configured, as it
was done before Proxmox VE 5.4
libpve-access-control (3.0-3) unstable; urgency=low
- * Add new role PVETemplateUser (and VM.Clone priviledge)
+ * Add new role PVETemplateUser (and VM.Clone privilege)
-- Proxmox Support Team <support@proxmox.com> Mon, 29 Apr 2013 11:42:15 +0200
libpve-access-control (1.0-18) unstable; urgency=low
- * fix bug #151: corretly parse username inside ticket
+ * fix bug #151: correctly parse username inside ticket
* fix bug #152: allow user to change his own password
libpve-access-control (1.0-3) unstable; urgency=low
* add support for delayed parameter parsing - We need that to disable
- file upload for normal API request (avoid DOS attacs)
+ file upload for normal API request (avoid DOS attacks)
-- Proxmox Support Team <support@proxmox.com> Fri, 02 Dec 2011 09:56:10 +0100
projects / pve-access-control.git / blobdiff