api: implement openid API

This moves compute_api_permission() into RPCEnvironment.pm.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/API2/AccessControl.pm b/src/PVE/API2/AccessControl.pm
index a77694b7561d64f080db9c4c26e22d6ffd7b0f1d..6dec66cea4294be283347b1cb5d0155b0e5d003a 100644 (file)
--- a/src/PVE/API2/AccessControl.pm
+++ b/src/PVE/API2/AccessControl.pm
@@ -19,9 +19,9 @@ use PVE::API2::User;
 use PVE::API2::Group;
 use PVE::API2::Role;
 use PVE::API2::ACL;
+use PVE::API2::OpenId;
 use PVE::Auth::Plugin;
 use PVE::OTP;
-use PVE::Tools;
 
 my $u2f_available = 0;
 eval {
@@ -56,6 +56,11 @@ __PACKAGE__->register_method ({
     path => 'domains',
 });
 
+__PACKAGE__->register_method ({
+    subclass => "PVE::API2::OpenId",
+    path => 'openid',
+});
+
 __PACKAGE__->register_method ({
     name => 'index',
     path => '',
@@ -165,55 +170,6 @@ my $create_ticket = sub {
     };
 };
 
-my $compute_api_permission = sub {
-    my ($rpcenv, $authuser) = @_;
-
-    my $usercfg = $rpcenv->{user_cfg};
-
-    my $res = {};
-    my $priv_re_map = {
-       vms => qr/VM\.|Permissions\.Modify/,
-       access => qr/(User|Group)\.|Permissions\.Modify/,
-       storage => qr/Datastore\.|Permissions\.Modify/,
-       nodes => qr/Sys\.|Permissions\.Modify/,
-       sdn => qr/SDN\.|Permissions\.Modify/,
-       dc => qr/Sys\.Audit|SDN\./,
-    };
-    map { $res->{$_} = {} } keys %$priv_re_map;
-
-    my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn'];
-
-    my $checked_paths = {};
-    foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
-       next if $checked_paths->{$path};
-       $checked_paths->{$path} = 1;
-
-       my $path_perm = $rpcenv->permissions($authuser, $path);
-
-       my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
-       if ($toplevel eq 'pool') {
-           foreach my $priv (keys %$path_perm) {
-               if ($priv =~ m/^VM\./) {
-                   $res->{vms}->{$priv} = 1;
-               } elsif ($priv =~ m/^Datastore\./) {
-                   $res->{storage}->{$priv} = 1;
-               } elsif ($priv eq 'Permissions.Modify') {
-                   $res->{storage}->{$priv} = 1;
-                   $res->{vms}->{$priv} = 1;
-               }
-           }
-       } else {
-           my $priv_regex = $priv_re_map->{$toplevel} // next;
-           foreach my $priv (keys %$path_perm) {
-               next if $priv !~ m/^($priv_regex)/;
-               $res->{$toplevel}->{$priv} = 1;
-           }
-       }
-    }
-
-    return $res;
-};
-
 __PACKAGE__->register_method ({
     name => 'get_ticket',
     path => 'ticket',
@@ -314,7 +270,7 @@ __PACKAGE__->register_method ({
            die PVE::Exception->new("authentication failure\n", code => 401);
        }
 
-       $res->{cap} = &$compute_api_permission($rpcenv, $username)
+       $res->{cap} = $rpcenv->compute_api_permission($username)
            if !defined($res->{NeedTFA});
 
        my $clinfo = PVE::Cluster::get_clinfo();
@@ -659,7 +615,7 @@ __PACKAGE__->register_method({
 
        return {
            ticket => PVE::AccessControl::assemble_ticket($authuser),
-           cap => &$compute_api_permission($rpcenv, $authuser),
+           cap => $rpcenv->compute_api_permission($authuser),
        }
     }});
 

diff --git a/src/PVE/API2/Makefile b/src/PVE/API2/Makefile
index 1bf8c059d15b7c03865dd2c7f02a767503ad4afd..4e49037b93309d16d24d20b30515a50c837caef2 100644 (file)
--- a/src/PVE/API2/Makefile
+++ b/src/PVE/API2/Makefile
@@ -5,7 +5,8 @@ API2_SOURCES=                   \
        ACL.pm                  \
        Role.pm                 \
        Group.pm                \
-       User.pm
+       User.pm                 \
+       OpenId.pm
 
 .PHONY: install
 install:

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
new file mode 100644 (file)
index 0000000..d755128
--- /dev/null
+++ b/src/PVE/API2/OpenId.pm
@@ -0,0 +1,211 @@
+package PVE::API2::OpenId;
+
+use strict;
+use warnings;
+
+use PVE::Tools qw(extract_param);
+use PVE::RS::OpenId;
+
+use PVE::Exception qw(raise raise_perm_exc raise_param_exc);
+use PVE::SafeSyslog;
+use PVE::RPCEnvironment;
+use PVE::Cluster qw(cfs_read_file);
+use PVE::AccessControl;
+use PVE::JSONSchema qw(get_standard_option);
+
+use PVE::RESTHandler;
+
+use base qw(PVE::RESTHandler);
+
+my $openid_state_path = "/var/lib/pve-manager";
+
+my $lookup_openid_auth = sub {
+    my ($realm, $redirect_url) = @_;
+
+    my $cfg = cfs_read_file('domains.cfg');
+    my $ids = $cfg->{ids};
+
+    die "authentication domain '$realm' does not exist\n" if !$ids->{$realm};
+
+    my $config = $ids->{$realm};
+    die "wrong realm type ($config->{type} != openid)\n" if $config->{type} ne "openid";
+
+    my $openid_config = {
+       issuer_url => $config->{'issuer-url'},
+       client_id => $config->{'client-id'},
+       client_key => $config->{'client-key'},
+    };
+
+    my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
+    return ($config, $openid);
+};
+
+__PACKAGE__->register_method ({
+    name => 'index',
+    path => '',
+    method => 'GET',
+    description => "Directory index.",
+    permissions => {
+       user => 'all',
+    },
+    parameters => {
+       additionalProperties => 0,
+       properties => {},
+    },
+    returns => {
+       type => 'array',
+       items => {
+           type => "object",
+           properties => {
+               subdir => { type => 'string' },
+           },
+       },
+       links => [ { rel => 'child', href => "{subdir}" } ],
+    },
+    code => sub {
+       my ($param) = @_;
+
+       return [
+           { subdir => 'auth-url' },
+           { subdir => 'login' },
+       ];
+    }});
+
+__PACKAGE__->register_method ({
+    name => 'auth_url',
+    path => 'auth-url',
+    method => 'POST',
+    protected => 1,
+    description => "Get the OpenId Authorization Url for the specified realm.",
+    parameters => {
+       additionalProperties => 0,
+       properties => {
+           realm => get_standard_option('realm'),
+           'redirect-url' => {
+               description => "Redirection Url. The client should set this to the used server url (location.origin).",
+               type => 'string',
+               maxLength => 255,
+           },
+       },
+    },
+    returns => {
+       type => "string",
+       description => "Redirection URL.",
+    },
+    permissions => { user => 'world' },
+    code => sub {
+       my ($param) = @_;
+
+       my $realm = extract_param($param, 'realm');
+       my $redirect_url = extract_param($param, 'redirect-url');
+
+       my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
+       my $url = $openid->authorize_url($openid_state_path , $realm);
+
+       return $url;
+    }});
+
+__PACKAGE__->register_method ({
+    name => 'login',
+    path => 'login',
+    method => 'POST',
+    protected => 1,
+    description => " Verify OpenID authorization code and create a ticket.",
+    parameters => {
+       additionalProperties => 0,
+       properties => {
+           'state' => {
+               description => "OpenId state.",
+               type => 'string',
+               maxLength => 1024,
+            },
+           code => {
+               description => "OpenId authorization code.",
+               type => 'string',
+               maxLength => 1024,
+            },
+           'redirect-url' => {
+               description => "Redirection Url. The client should set this to the used server url (location.origin).",
+               type => 'string',
+               maxLength => 255,
+           },
+       },
+    },
+    returns => {
+       properties => {
+           username => { type => 'string' },
+           ticket => { type => 'string' },
+           CSRFPreventionToken => { type => 'string' },
+           cap => { type => 'object' },  # computed api permissions
+           clustername => { type => 'string', optional => 1 },
+       },
+    },
+    permissions => { user => 'world' },
+    code => sub {
+       my ($param) = @_;
+
+       my $rpcenv = PVE::RPCEnvironment::get();
+
+       my $res;
+       eval {
+           my ($realm, $private_auth_state) = PVE::RS::OpenId::verify_public_auth_state(
+               $openid_state_path, $param->{'state'});
+
+           my $redirect_url = extract_param($param, 'redirect-url');
+
+           my ($config, $openid) = $lookup_openid_auth->($realm, $redirect_url);
+
+           my $info = $openid->verify_authorization_code($param->{code}, $private_auth_state);
+           my $subject = $info->{'sub'};
+
+           die "missing openid claim 'sub'\n" if !defined($subject);
+
+           my $unique_name = $subject; # default
+           if (defined(my $user_attr = $config->{'username-claim'})) {
+               if ($user_attr eq 'subject') {
+                   $unique_name = $subject;
+               } elsif ($user_attr eq 'username') {
+                   my $username = $info->{'preferred_username'};
+                   die "missing claim 'preferred_username'\n" if !defined($username);
+                   $unique_name =  $username;
+               } elsif ($user_attr eq 'email') {
+                   my $email = $info->{'email'};
+                   die "missing claim 'email'\n" if !defined($email);
+                   $unique_name = $email;
+               } else {
+                   die "got unexpected value for 'username-claim': '${user_attr}'\n";
+               }
+           }
+
+           my $username = "${unique_name}\@${realm}";
+
+           # test if user exists and is enabled
+           $rpcenv->check_user_enabled($username);
+
+           my $ticket = PVE::AccessControl::assemble_ticket($username);
+           my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username);
+           my $cap = $rpcenv->compute_api_permission($username);
+
+           $res = {
+               ticket => $ticket,
+               username => $username,
+               CSRFPreventionToken => $csrftoken,
+               cap => $cap,
+           };
+
+           my $clinfo = PVE::Cluster::get_clinfo();
+           if ($clinfo->{cluster}->{name} && $rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
+               $res->{clustername} = $clinfo->{cluster}->{name};
+           }
+       };
+       if (my $err = $@) {
+           my $clientip = $rpcenv->get_client_ip() || '';
+           syslog('err', "openid authentication failure; rhost=$clientip msg=$err");
+           # do not return any info to prevent user enumeration attacks
+           die PVE::Exception->new("authentication failure\n", code => 401);
+       }
+
+       PVE::Cluster::log_msg('info', 'root@pam', "successful openid auth for user '$res->{username}'");
+
+       return $res;
+    }});

diff --git a/src/PVE/RPCEnvironment.pm b/src/PVE/RPCEnvironment.pm
index 2e5a33b815764bd147e9269ade205411f7765815..8aae0940e5157cb7380c29fa801aaeb1517b4891 100644 (file)
--- a/src/PVE/RPCEnvironment.pm
+++ b/src/PVE/RPCEnvironment.pm
@@ -126,6 +126,55 @@ sub permissions {
     return &$compile_acl_path($self, $user, $path);
 }
 
+sub compute_api_permission {
+    my ($self, $authuser) = @_;
+
+    my $usercfg = $self->{user_cfg};
+
+    my $res = {};
+    my $priv_re_map = {
+       vms => qr/VM\.|Permissions\.Modify/,
+       access => qr/(User|Group)\.|Permissions\.Modify/,
+       storage => qr/Datastore\.|Permissions\.Modify/,
+       nodes => qr/Sys\.|Permissions\.Modify/,
+       sdn => qr/SDN\.|Permissions\.Modify/,
+       dc => qr/Sys\.Audit|SDN\./,
+    };
+    map { $res->{$_} = {} } keys %$priv_re_map;
+
+    my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage', '/sdn'];
+
+    my $checked_paths = {};
+    foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
+       next if $checked_paths->{$path};
+       $checked_paths->{$path} = 1;
+
+       my $path_perm = $self->permissions($authuser, $path);
+
+       my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
+       if ($toplevel eq 'pool') {
+           foreach my $priv (keys %$path_perm) {
+               if ($priv =~ m/^VM\./) {
+                   $res->{vms}->{$priv} = 1;
+               } elsif ($priv =~ m/^Datastore\./) {
+                   $res->{storage}->{$priv} = 1;
+               } elsif ($priv eq 'Permissions.Modify') {
+                   $res->{storage}->{$priv} = 1;
+                   $res->{vms}->{$priv} = 1;
+               }
+           }
+       } else {
+           my $priv_regex = $priv_re_map->{$toplevel} // next;
+           foreach my $priv (keys %$path_perm) {
+               next if $priv !~ m/^($priv_regex)/;
+               $res->{$toplevel}->{$priv} = 1;
+           }
+       }
+    }
+
+    return $res;
+}
+
 sub get_effective_permissions {
     my ($self, $user) = @_;