[pdm-devel] [PATCH datacenter-manager/proxmox v2 0/6] pbs client: fix PBS version 3 login ticket parsing compatibility

[Shannon Sterz]

On Wed Oct 1, 2025 at 11:33 AM CEST, Shannon Sterz wrote:
> On Tue Sep 30, 2025 at 2:34 PM CEST, Thomas Lamprecht wrote:
>> Am 30.09.25 um 14:19 schrieb Christian Ebner:
>>> On 9/30/25 1:49 PM, Wolfgang Bumiller wrote:
>>>> On Tue, Sep 30, 2025 at 10:02:01AM +0200, Christian Ebner wrote:
>>>>> This patches fix the ticket parsing when login to instances of PBS version 3
>>>>> or lower. For this, the current pve_compat flags for `Login` and `Client`
>>>>> are refactored to be an extendable enum variant instead, adding the ticket
>>>>> parsing backwards compatibility. In that compatibility mode, response parsing
>>>>> of the ticket does not interpret the presence of the `ticket-info` field as the
>>>>> ticket being a `http-only` ticket and fallsback to the PBS version 3 and 4
>>>>> compatible parsing, as the client never used `http-only` tickets.
>>>>
>>>> I thought this field was introduced only with http-only tickets, so why
>>>> is it not a reliable indicator and shouldn't *that* be fixed instead?
>>>
>>> I'm not so familiar with the actual code and the changes over time here, so that might as well be the case.
>>
>> FYI: Shannon is back at work tomorrow and this is not really _that_
>> pressing, so I'd wait at least until tomorrow to hopefully get some
>> better rationale.
>
> hi everyone and sorry if i am missing something (still catching up on
> mail), but i think this is basically a more in-depth approach to a fix i
> send a while back:
>
> https://lore.proxmox.com/pbs-devel/20250520085549.56525-1-s.sterz@proxmox.com/
>
> as chris has already pointed out in chat, there was a mishap on my end
> when refactoring the auth api and the old authentication flow would
> still send a `ticket-info` field alongside the `ticket` field.
> proxmox-login would then think it is in the new HttpOnly flow and not
> use the `ticket` field, even though it should.
>
> this was already fixed in commit f7d8b8f682 (auth-api: remove ticket
> info in old create ticket endpoint) [1], but it seems at least
> proxmox-backup-server 3.4.6-1 still sends the `ticket-info` as well. i
> rebuild pbs from latest stable-3 and stable-bookworm and there the
> parameter is correctly dropped.
>
> imo clients *should* use a ticket if they are provided with one and not
> get confused with additional parameters. which is what the patch linked
> above does. however, chris' approach to compatibility is a lot more
> extensible, so we could go down that road too.
>
> i'll check if my patch above works as inteded still and can resend a
> rebased version later today.
>
> [1]: https://git.proxmox.com/?p=proxmox.git;a=commitdiff;h=f7d8b8f682370cf0d8c3a0a238c958ceda2b8f7b

send the updated patch now:

https://lore.proxmox.com/all/20251001131102.266920-1-s.sterz@proxmox.com/T/#u