[pdm-devel] [PATCH datacenter-manager 2/3] server: pbs-client: check and fallback to PBS v3 ticket compat mode

[Christian Ebner]

Since the proxmox-login ticket parsing assumes the ticket to be
http-only if it contains the ticket-info field, but the PBS v3 API
does return that in any case, signal the client to fallback to the
old authentication flow.

This is currently only used during adding of a new remote, namely to
scan the remote and login for PBS API token creation/setting of its
ACLs.

Signed-off-by: Christian Ebner <c.ebner at proxmox.com>
---
 server/src/connection.rs | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/server/src/connection.rs b/server/src/connection.rs
index 5530812..14f878e 100644
--- a/server/src/connection.rs
+++ b/server/src/connection.rs
@@ -179,14 +179,19 @@ async fn connect_or_login(
         connect(remote, target_endpoint)
     } else {
         let (client, _info) = prepare_connect_client(remote, target_endpoint)?;
-        match client
-            .login(proxmox_login::Login::new(
-                client.api_url().to_string(),
-                remote.authid.to_string(),
-                remote.token.to_string(),
-            ))
-            .await
-        {
+        let mut login = proxmox_login::Login::new(
+            client.api_url().to_string(),
+            remote.authid.to_string(),
+            remote.token.to_string(),
+        );
+
+        //FIXME: drop once PBS3 is EOL
+        if remote.ty == RemoteType::Pbs {
+            // Forces both, PBSv4 and PBSv3 to use the same logic (since no http-only for PBSv4)
+            login = login.set_compatibility(CompatMode::Pbs3Ticket);
+        }
+
+        match client.login(login).await {
             Ok(Some(_)) => bail!("two factor auth not supported"),
             Ok(None) => {}
             Err(err) => match err {
-- 
2.47.3