bump version to 7.1-8

[pve-access-control.git] / src / PVE / AccessControl.pm

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index ace27971c27b565076cbb1a439da3b9b42102985..13065764ec20a8edcc4678f5feede3ecd7daebf8 100644 (file)
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -741,7 +741,9 @@ sub authenticate_2nd_old : prototype($$$) {
 
     my ($type, $tfa_data) = user_get_tfa($username, $realm, 0);
     if ($type) {
-       if ($type eq 'u2f') {
+       if ($type eq 'incompatible') {
+           die "old login api disabled, user has incompatible TFA entries\n";
+       } elsif ($type eq 'u2f') {
            # Note that if the user did not manage to complete the initial u2f registration
            # challenge we have a hash containing a 'challenge' entry in the user's tfa.cfg entry:
            $tfa_data = undef if exists $tfa_data->{challenge};
@@ -779,9 +781,9 @@ sub authenticate_2nd_new : prototype($$$$) {
        }
 
        my $realm_type = $realm_tfa && $realm_tfa->{type};
-       $realm_type = 'totp' if $realm_type eq 'oath'; # we used to call it that
        # verify realm type unless using recovery keys:
        if (defined($realm_type)) {
+           $realm_type = 'totp' if $realm_type eq 'oath'; # we used to call it that
            if ($realm_type eq 'yubico') {
                # Yubico auth will not be supported in rust for now...
                if (!defined($tfa_challenge)) {
@@ -880,25 +882,36 @@ sub authenticate_yubico_do : prototype($$$) {
 sub configure_u2f_and_wa : prototype($) {
     my ($tfa_cfg) = @_;
 
+    my $rpc_origin;
+    my $get_origin = sub {
+       return $rpc_origin if defined($rpc_origin);
+       my $rpcenv = PVE::RPCEnvironment::get();
+       if (my $origin = $rpcenv->get_request_host(1)) {
+           $rpc_origin = "https://$origin";
+           return $rpc_origin;
+       }
+       die "failed to figure out origin\n";
+    };
+
     my $dc = cfs_read_file('datacenter.cfg');
     if (my $u2f = $dc->{u2f}) {
-       my $origin = $u2f->{origin};
-       if (!defined($origin)) {
-           my $rpcenv = PVE::RPCEnvironment::get();
-           $origin = $rpcenv->get_request_host(1);
-           if ($origin) {
-               $origin = "https://$origin";
-           } else {
-               die "failed to figure out u2f origin\n";
-           }
-       }
-       $tfa_cfg->set_u2f_config({
-           origin => $origin,
-           appid => $u2f->{appid},
-       });
+       eval {
+           $tfa_cfg->set_u2f_config({
+               origin => $u2f->{origin} // $get_origin->(),
+               appid => $u2f->{appid},
+           });
+       };
+       warn "u2f unavailable, configuration error: $@\n" if $@;
     }
     if (my $wa = $dc->{webauthn}) {
-       $tfa_cfg->set_webauthn_config($wa);
+       eval {
+           $tfa_cfg->set_webauthn_config({
+               origin => $wa->{origin} // $get_origin->(),
+               rp => $wa->{rp},
+               id => $wa->{id},
+           });
+       };
+       warn "webauthn unavailable, configuration error: $@\n" if $@;
     }
 }