[pdm-devel] [PATCH datacenter-manager/proxmox v2 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility

[Shannon Sterz]

On Tue Sep 30, 2025 at 2:34 PM CEST, Thomas Lamprecht wrote:
> Am 30.09.25 um 14:19 schrieb Christian Ebner:
>> On 9/30/25 1:49 PM, Wolfgang Bumiller wrote:
>>> On Tue, Sep 30, 2025 at 10:02:01AM +0200, Christian Ebner wrote:
>>>> This patches fix the ticket parsing when login to instances of PBS version 3
>>>> or lower. For this, the current pve_compat flags for `Login` and `Client`
>>>> are refactored to be an extendable enum variant instead, adding the ticket
>>>> parsing backwards compatibility. In that compatibility mode, response parsing
>>>> of the ticket does not interpret the presence of the `ticket-info` field as the
>>>> ticket being a `http-only` ticket and fallsback to the PBS version 3 and 4
>>>> compatible parsing, as the client never used `http-only` tickets.
>>>
>>> I thought this field was introduced only with http-only tickets, so why
>>> is it not a reliable indicator and shouldn't *that* be fixed instead?
>>
>> I'm not so familiar with the actual code and the changes over time here, so that might as well be the case.
>
> FYI: Shannon is back at work tomorrow and this is not really _that_
> pressing, so I'd wait at least until tomorrow to hopefully get some
> better rationale.

hi everyone and sorry if i am missing something (still catching up on
mail), but i think this is basically a more in-depth approach to a fix i
send a while back:

https://lore.proxmox.com/pbs-devel/20250520085549.56525-1-s.sterz@proxmox.com/

as chris has already pointed out in chat, there was a mishap on my end
when refactoring the auth api and the old authentication flow would
still send a `ticket-info` field alongside the `ticket` field.
proxmox-login would then think it is in the new HttpOnly flow and not
use the `ticket` field, even though it should.

this was already fixed in commit f7d8b8f682 (auth-api: remove ticket
info in old create ticket endpoint) [1], but it seems at least
proxmox-backup-server 3.4.6-1 still sends the `ticket-info` as well. i
rebuild pbs from latest stable-3 and stable-bookworm and there the
parameter is correctly dropped.

imo clients *should* use a ticket if they are provided with one and not
get confused with additional parameters. which is what the patch linked
above does. however, chris' approach to compatibility is a lot more
extensible, so we could go down that road too.

i'll check if my patch above works as inteded still and can resend a
rebased version later today.

[1]: https://git.proxmox.com/?p=proxmox.git;a=commitdiff;h=f7d8b8f682370cf0d8c3a0a238c958ceda2b8f7b