[pmg-devel] [PATCH pve-common/perl-rs/pmg-api/widget-toolkit/pmg-gui v6 0/12] fix #3892: OpenID Connect

[Markus Frank]

Patch-series to enable OpenID Connect Login for PMG

apply/compile order:

pve-common:
 1 add Schema package with auth module that contains realm sync options

proxmox-perl-rs:
 2 move openid code from pve-rs to common
 3 remove empty PMG::RS::OpenId package to avoid confusion 

pmg-api:
 4 config: add plugin system for authentication realms
 5 config: add oidc type authentication realm
 6 api: add/update/remove authentication realms like in PVE
 7 api: oidc login similar to PVE

proxmox-widget-toolkit:
 8 fix: window: AuthEditBase: rename variable 'realm' to 'type'
 9 fix: panel: AuthView: change API path in pmx-domains model
10 form: RealmComboBox: add option to change the API path

pmg-gui:
11 login: add option to login with OIDC realm
12 add realms panel to user management




I still need to add the option to create users for other realms than PMG
in the API and WebUI. The autocreate option of the OIDC realm can be
used instead for now. Also the autocreate-role option needs to be
exposed to the WebUI. I will send these things as follow-up patches or
in the next iteration if this series cannot be applied yet.




v6:
* renamed Realm to AuthRealm and renamed every domain variable to realm
* changed realm API-path from access/domains to access/auth-realm
* more v6-changes described in the individual patches

v5:
* renamed openid/OpenId variables, filenames and modules to oidc/OIDC
 wherever possible
* renamed Authdomains to Realm

v4:
* split "config: add plugin system for realms & add openid type realms"
 patch into two patches
* use the name 'OpenId' for filenames, but use 'OIDC' as realm type name
* added autocreate-role option to set the role for automatically created
 users in a realm, but currently not exposed in GUI (needs a lot of
 changes in pmg-gui and proxmox-widget-toolkit)


pve-common:

Markus Frank (1):
  add Schema package with auth module that contains realm sync options

 src/Makefile           |  2 ++
 src/PVE/Schema/Auth.pm | 46 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 src/PVE/Schema/Auth.pm


proxmox-perl-rs:

Markus Frank (2):
  move openid code from pve-rs to common
  remove empty PMG::RS::OpenId package to avoid confusion

 common/pkg/Makefile      |  1 +
 common/src/mod.rs        |  1 +
 common/src/oidc/mod.rs   | 63 ++++++++++++++++++++++++++++++++++++++++
 pmg-rs/Cargo.toml        |  1 +
 pmg-rs/Makefile          |  1 -
 pmg-rs/debian/control    |  1 +
 pve-rs/src/openid/mod.rs | 32 +++++---------------
 7 files changed, 75 insertions(+), 25 deletions(-)
 create mode 100644 common/src/oidc/mod.rs


pmg-api:

Markus Frank (4):
  config: add plugin system for authentication realms
  config: add oidc type authentication realm
  api: add/update/remove authentication realms like in PVE
  api: oidc login similar to PVE

 src/Makefile                  |   6 +
 src/PMG/API2/AccessControl.pm |  17 ++-
 src/PMG/API2/AuthRealm.pm     | 274 ++++++++++++++++++++++++++++++++++
 src/PMG/API2/OIDC.pm          | 243 ++++++++++++++++++++++++++++++
 src/PMG/API2/Users.pm         |   1 +
 src/PMG/AccessControl.pm      |  40 +++++
 src/PMG/Auth/OIDC.pm          | 101 +++++++++++++
 src/PMG/Auth/PAM.pm           |  22 +++
 src/PMG/Auth/PMG.pm           |  39 +++++
 src/PMG/Auth/Plugin.pm        | 203 +++++++++++++++++++++++++
 src/PMG/HTTPServer.pm         |   4 +-
 src/PMG/RESTEnvironment.pm    |  14 ++
 src/PMG/UserConfig.pm         |  24 ++-
 src/PMG/Utils.pm              |  29 +++-
 14 files changed, 1001 insertions(+), 16 deletions(-)
 create mode 100644 src/PMG/API2/AuthRealm.pm
 create mode 100644 src/PMG/API2/OIDC.pm
 create mode 100755 src/PMG/Auth/OIDC.pm
 create mode 100755 src/PMG/Auth/PAM.pm
 create mode 100755 src/PMG/Auth/PMG.pm
 create mode 100755 src/PMG/Auth/Plugin.pm


widget-toolkit:

Markus Frank (3):
  fix: window: AuthEditBase: rename variable 'realm' to 'type'
  fix: panel: AuthView: change API path in pmx-domains model
  form: RealmComboBox: add option to change the API path

 src/form/RealmComboBox.js  |  2 ++
 src/panel/AuthView.js      | 20 ++++++++++++--------
 src/window/AuthEditBase.js |  4 ++--
 3 files changed, 16 insertions(+), 10 deletions(-)


pmg-gui:

Markus Frank (2):
  login: add option to login with OIDC realm
  add realms panel to user management

 js/LoginView.js      | 209 ++++++++++++++++++++++++++++++++-----------
 js/UserManagement.js |   7 ++
 js/Utils.js          |  16 ++++
 3 files changed, 181 insertions(+), 51 deletions(-)

-- 
2.39.5