[pmg-devel] [PATCH pve-common/perl-rs/pmg-api/widget-toolkit/pmg-gui v5 0/10] fix #3892: OpenID Connect

[Stoiko Ivanov]

Thanks for the fast iteration on this!

applied the patches and compared them to your v4 - looks good from my
perspective and quick tests!

gave it another spin - my tests worked ok - one small glitch (wrong
syslog() call), and one thing that still needs a closer check (empty e-mail
addresses for OIDC users when 'autocreate' is set - see the comment on
patch 7/10.

if you send a v6, please add a hint to the patches which are based on code
from PVE where the code for PVE is (as suggested in the comment on 1/10).

On Tue, Feb 18, 2025 at 05:18:55PM +0100, Markus Frank wrote:
> Patch-series to enable OpenID Connect Login for PMG
> 
> apply/compile order:
> 
> pve-common: 
>  1 add Schema package with auth module that contains realm sync options
> 
> proxmox-perl-rs:
>  2 move openid code from pve-rs to common
>  3 remove empty PMG::RS::OpenId package to avoid confusion 
> 
> pmg-api:
>  4 config: add plugin system for realms
>  5 config: add oidc type realm
>  6 api: add/update/remove realms like in PVE
>  7 api: oidc login similar to PVE
> 
> proxmox-widget-toolkit:
>  8 fix: window: AuthEditBase: rename variable 'realm' to 'type'
> 
> pmg-gui:
>  9 login: add option to login with OIDC realm
> 10 add panel for realms to User Management
> 
> 
> v5:
> * renamed openid/OpenId variables, filenames and modules to oidc/OIDC
>  wherever possible
> * renamed Authdomains to Realm
> 
> v4:
> * split "config: add plugin system for realms & add openid type realms"
>  patch into two patches
> * use the name 'OpenId' for filenames, but use 'OIDC' as realm type name
> * added autocreate-role option to set the role for automatically created
>  users in a realm, but currently not exposed in GUI (needs a lot of
>  changes in pmg-gui and proxmox-widget-toolkit)
> 
> 
> 
> pve-common:
> 
> Markus Frank (1):
>   add Schema package with auth module that contains realm sync options
> 
>  src/Makefile           |  2 ++
>  src/PVE/Schema/Auth.pm | 82 ++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 84 insertions(+)
>  create mode 100644 src/PVE/Schema/Auth.pm
> 
> 
> proxmox-perl-rs:
> 
> Markus Frank (2):
>   move openid code from pve-rs to common
>   remove empty PMG::RS::OpenId package to avoid confusion
> 
>  common/pkg/Makefile      |  1 +
>  common/src/mod.rs        |  1 +
>  common/src/oidc/mod.rs   | 63 ++++++++++++++++++++++++++++++++++++++++
>  pmg-rs/Cargo.toml        |  1 +
>  pmg-rs/Makefile          |  1 -
>  pmg-rs/debian/control    |  1 +
>  pve-rs/src/openid/mod.rs | 32 +++++---------------
>  7 files changed, 75 insertions(+), 25 deletions(-)
>  create mode 100644 common/src/oidc/mod.rs
> 
> 
> pmg-api:
> 
> Markus Frank (4):
>   config: add plugin system for realms
>   config: add oidc type realm
>   api: add/update/remove realms like in PVE
>   api: oidc login similar to PVE
> 
>  src/Makefile                  |   6 +
>  src/PMG/API2/AccessControl.pm |  17 ++-
>  src/PMG/API2/OIDC.pm          | 243 ++++++++++++++++++++++++++++++
>  src/PMG/API2/Realm.pm         | 274 ++++++++++++++++++++++++++++++++++
>  src/PMG/AccessControl.pm      |  33 ++++
>  src/PMG/Auth/OIDC.pm          |  95 ++++++++++++
>  src/PMG/Auth/PAM.pm           |  22 +++
>  src/PMG/Auth/PMG.pm           |  39 +++++
>  src/PMG/Auth/Plugin.pm        | 199 ++++++++++++++++++++++++
>  src/PMG/HTTPServer.pm         |   2 +
>  src/PMG/RESTEnvironment.pm    |  14 ++
>  src/PMG/UserConfig.pm         |  25 ++--
>  src/PMG/Utils.pm              |  29 +++-
>  13 files changed, 981 insertions(+), 17 deletions(-)
>  create mode 100644 src/PMG/API2/OIDC.pm
>  create mode 100644 src/PMG/API2/Realm.pm
>  create mode 100755 src/PMG/Auth/OIDC.pm
>  create mode 100755 src/PMG/Auth/PAM.pm
>  create mode 100755 src/PMG/Auth/PMG.pm
>  create mode 100755 src/PMG/Auth/Plugin.pm
> 
> 
> widget-toolkit:
> 
> Markus Frank (1):
>   fix: window: AuthEditBase: rename variable 'realm' to 'type'
> 
>  src/window/AuthEditBase.js | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> 
> pmg-gui:
> 
> Markus Frank (2):
>   login: add option to login with OIDC realm
>   add panel for realms to User Management
> 
>  js/LoginView.js      | 208 ++++++++++++++++++++++++++++++++-----------
>  js/UserManagement.js |   6 ++
>  js/Utils.js          |  23 +++++
>  3 files changed, 186 insertions(+), 51 deletions(-)
> 
> -- 
> 2.39.5
> 
> 
> 
> _______________________________________________
> pmg-devel mailing list
> pmg-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel
> 
>