[pbs-devel] [PATCH proxmox-backup v3 00/10] OpenID connect realms

[Fabian Grünbichler]

seems to work okay in general (and looks okay code-wise), some missing 
pieces:
- proxmox-openid-rs prints some information that looks like debug (full 
  returned info from provider)
- user-attr in proxmox-backup like in PVE
- GUI: user adding/editing needs some adaptation for openid (e.g., removing a 
  user prints a warning about unknown realm, but removes it anyway, 
  adding a user has no realm selection and requires a password)
- GUI: realm adding/editing is missing altogether

the check_acl_path change could be split and folded into the patches 
that first use that ACL path, but no hard feelings there..

the last patch probably requires some in-depth review, I only took a 
cursory glance (and it could be ordered before the patch with the fixme 
that it fixes)

On June 25, 2021 11:20 am, Dietmar Maurer wrote:
> This implements OpenID connect realms using the new
> "proxmox-openid-rs" crate.
> 
> Note: The new src/tools/memcom.rs is from Wolfgang.
> 
> Changes since v2:
>    fix CachedUserInfo by using a shared memory version counter
> 
> Changes since v1:
> - really fix commit message of first patch
> - change api endpoints (/access/openid/{login|auth-url})
> - merged all api implementation patches
> 
> Changes since preview version (for Fabian):
> - fix commit message
> - reserve namen 'pam' and 'pbs'
> - fix 'make deb'
> 
> 
> Dietmar Maurer (10):
>   depend on proxmox-openid-rs
>   config: new domains.cfg to configure openid realm
>   check_acl_path: add /access/domains and /access/openid
>   add API to manage openid realms
>   cli: add CLI to manage openid realms.
>   implement new helper is_active_user_id()
>   cleanup user/token is_active() check
>   api: add openid redirect/login API
>   ui: implement OpenId login
>   fix CachedUserInfo by using a shared memory version counter
> 
>  Cargo.toml                               |   2 +
>  src/api2/access.rs                       |   4 +-
>  src/api2/access/domain.rs                |  18 ++
>  src/api2/access/openid.rs                | 190 ++++++++++++++++
>  src/api2/config/access/mod.rs            |   8 +-
>  src/api2/config/access/openid.rs         | 274 +++++++++++++++++++++++
>  src/bin/proxmox-backup-manager.rs        |   1 +
>  src/bin/proxmox_backup_manager/mod.rs    |   2 +
>  src/bin/proxmox_backup_manager/openid.rs |  99 ++++++++
>  src/config.rs                            |   1 +
>  src/config/acl.rs                        |   8 +-
>  src/config/cached_user_info.rs           |  48 ++--
>  src/config/domains.rs                    | 173 ++++++++++++++
>  src/config/user.rs                       |  38 ++++
>  src/tools.rs                             |   3 +
>  src/tools/memcom.rs                      | 159 +++++++++++++
>  www/Application.js                       |   8 +-
>  www/LoginView.js                         | 100 ++++++++-
>  www/Utils.js                             |   8 +
>  19 files changed, 1115 insertions(+), 29 deletions(-)
>  create mode 100644 src/api2/access/openid.rs
>  create mode 100644 src/api2/config/access/openid.rs
>  create mode 100644 src/bin/proxmox_backup_manager/openid.rs
>  create mode 100644 src/config/domains.rs
>  create mode 100644 src/tools/memcom.rs
> 
> -- 
> 2.30.2
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
>