bump version to 8.1.4

[pve-access-control.git] / src / PVE / Auth / LDAP.pm

diff --git a/src/PVE/Auth/LDAP.pm b/src/PVE/Auth/LDAP.pm
index 1b63954cdf91dce24bb27ca384fa02ea65391cfa..bf7e968cb1824065bd5225ce1fe53df50e8e0fb7 100755 (executable)
--- a/src/PVE/Auth/LDAP.pm
+++ b/src/PVE/Auth/LDAP.pm
@@ -166,22 +166,9 @@ sub options {
     };
 }
 
-my $valid_sync_attributes = {
-    username => 1,
-    enable => 1,
-    expire => 1,
-    firstname => 1,
-    lastname => 1,
-    email => 1,
-    comment => 1,
-    keys => 1,
-};
-
-my sub verify_sync_attribute {
+my sub verify_sync_attribute_value {
     my ($attr, $value) = @_;
 
-    die "cannot map to invalid user sync attribute '$attr'\n" if !$valid_sync_attributes->{$attr};
-
     # The attribute does not include the realm, so can't use PVE::Auth::Plugin::verify_username
     if ($attr eq 'username') {
        die "value '$value' does not look like a valid user name\n"
@@ -191,8 +178,11 @@ my sub verify_sync_attribute {
 
     return if $attr eq 'enable'; # for backwards compat, don't parse/validate
 
-    my $schema = PVE::JSONSchema::get_standard_option("user-$attr");
-    PVE::JSONSchema::validate($value, $schema, "invalid value '$value'\n");
+    if (my $schema = PVE::JSONSchema::get_standard_option("user-$attr")) {
+       PVE::JSONSchema::validate($value, $schema, "invalid value '$value'\n");
+    } else {
+       die "internal error: no schema for attribute '$attr' with value '$value' available!\n";
+    }
 }
 
 sub get_scheme_and_port {
@@ -296,12 +286,15 @@ sub get_users {
        email => 'email',
        comment => 'comment',
        keys => 'keys',
+       # NOTE: also ensure verify_sync_attribute_value can handle any new/changed attribute name
     };
+    # build on the fly as this is small and only called once per realm in a ldap-sync anyway
+    my $valid_sync_attributes = { map { $_ => 1 } values $ldap_attribute_map->%* };
 
     foreach my $attr (PVE::Tools::split_list($config->{sync_attributes})) {
        my ($ours, $ldap) = ($attr =~ m/^\s*(\w+)=(.*)\s*$/);
        if (!$valid_sync_attributes->{$ours}) {
-           warn "bad 'sync_attributes': cannot map to invalid attribute '$ours'\n";
+           warn "skipping bad 'sync_attributes' entry – '$ours' is not a valid target attribute\n";
            next;
        }
        $ldap_attribute_map->{$ldap} = $ours;
@@ -335,7 +328,7 @@ sub get_users {
        foreach my $attr (keys %$user_attributes) {
            if (my $ours = $ldap_attribute_map->{$attr}) {
                my $value = $user_attributes->{$attr}->[0];
-               eval { verify_sync_attribute($ours, $value) };
+               eval { verify_sync_attribute_value($ours, $value) };
                if (my $err = $@) {
                    warn "skipping attribute mapping '$attr'->'$ours' for user '$username' - $err";
                    next;