[pmg-devel] [PATCH pve-common/perl-rs/pmg-api/widget-toolkit/pmg-gui v6 0/12] fix #3892: OpenID Connect

[Mira Limbeck]

On 2/25/25 14:36, Markus Frank wrote:
> Patch-series to enable OpenID Connect Login for PMG
> 
> apply/compile order:
> 
> pve-common:
>  1 add Schema package with auth module that contains realm sync options
> 
> proxmox-perl-rs:
>  2 move openid code from pve-rs to common
>  3 remove empty PMG::RS::OpenId package to avoid confusion 
> 
> pmg-api:
>  4 config: add plugin system for authentication realms
>  5 config: add oidc type authentication realm
>  6 api: add/update/remove authentication realms like in PVE
>  7 api: oidc login similar to PVE
> 
> proxmox-widget-toolkit:
>  8 fix: window: AuthEditBase: rename variable 'realm' to 'type'
>  9 fix: panel: AuthView: change API path in pmx-domains model
> 10 form: RealmComboBox: add option to change the API path
> 
> pmg-gui:
> 11 login: add option to login with OIDC realm
> 12 add realms panel to user management
> 
> 
> 
> 
> I still need to add the option to create users for other realms than PMG
> in the API and WebUI. The autocreate option of the OIDC realm can be
> used instead for now. Also the autocreate-role option needs to be
> exposed to the WebUI. I will send these things as follow-up patches or
> in the next iteration if this series cannot be applied yet.
> 
> 
> 
> 
> v6:
> * renamed Realm to AuthRealm and renamed every domain variable to realm
> * changed realm API-path from access/domains to access/auth-realm
> * more v6-changes described in the individual patches
> 
> v5:
> * renamed openid/OpenId variables, filenames and modules to oidc/OIDC
>  wherever possible
> * renamed Authdomains to Realm
> 
> v4:
> * split "config: add plugin system for realms & add openid type realms"
>  patch into two patches
> * use the name 'OpenId' for filenames, but use 'OIDC' as realm type name
> * added autocreate-role option to set the role for automatically created
>  users in a realm, but currently not exposed in GUI (needs a lot of
>  changes in pmg-gui and proxmox-widget-toolkit)
> 
> 
> pve-common:
> 
> Markus Frank (1):
>   add Schema package with auth module that contains realm sync options
> 
>  src/Makefile           |  2 ++
>  src/PVE/Schema/Auth.pm | 46 ++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 48 insertions(+)
>  create mode 100644 src/PVE/Schema/Auth.pm
> 
> 
> proxmox-perl-rs:
> 
> Markus Frank (2):
>   move openid code from pve-rs to common
>   remove empty PMG::RS::OpenId package to avoid confusion
> 
>  common/pkg/Makefile      |  1 +
>  common/src/mod.rs        |  1 +
>  common/src/oidc/mod.rs   | 63 ++++++++++++++++++++++++++++++++++++++++
>  pmg-rs/Cargo.toml        |  1 +
>  pmg-rs/Makefile          |  1 -
>  pmg-rs/debian/control    |  1 +
>  pve-rs/src/openid/mod.rs | 32 +++++---------------
>  7 files changed, 75 insertions(+), 25 deletions(-)
>  create mode 100644 common/src/oidc/mod.rs
> 
> 
> pmg-api:
> 
> Markus Frank (4):
>   config: add plugin system for authentication realms
>   config: add oidc type authentication realm
>   api: add/update/remove authentication realms like in PVE
>   api: oidc login similar to PVE
> 
>  src/Makefile                  |   6 +
>  src/PMG/API2/AccessControl.pm |  17 ++-
>  src/PMG/API2/AuthRealm.pm     | 274 ++++++++++++++++++++++++++++++++++
>  src/PMG/API2/OIDC.pm          | 243 ++++++++++++++++++++++++++++++
>  src/PMG/API2/Users.pm         |   1 +
>  src/PMG/AccessControl.pm      |  40 +++++
>  src/PMG/Auth/OIDC.pm          | 101 +++++++++++++
>  src/PMG/Auth/PAM.pm           |  22 +++
>  src/PMG/Auth/PMG.pm           |  39 +++++
>  src/PMG/Auth/Plugin.pm        | 203 +++++++++++++++++++++++++
>  src/PMG/HTTPServer.pm         |   4 +-
>  src/PMG/RESTEnvironment.pm    |  14 ++
>  src/PMG/UserConfig.pm         |  24 ++-
>  src/PMG/Utils.pm              |  29 +++-
>  14 files changed, 1001 insertions(+), 16 deletions(-)
>  create mode 100644 src/PMG/API2/AuthRealm.pm
>  create mode 100644 src/PMG/API2/OIDC.pm
>  create mode 100755 src/PMG/Auth/OIDC.pm
>  create mode 100755 src/PMG/Auth/PAM.pm
>  create mode 100755 src/PMG/Auth/PMG.pm
>  create mode 100755 src/PMG/Auth/Plugin.pm
> 
> 
> widget-toolkit:
> 
> Markus Frank (3):
>   fix: window: AuthEditBase: rename variable 'realm' to 'type'
>   fix: panel: AuthView: change API path in pmx-domains model
>   form: RealmComboBox: add option to change the API path
> 
>  src/form/RealmComboBox.js  |  2 ++
>  src/panel/AuthView.js      | 20 ++++++++++++--------
>  src/window/AuthEditBase.js |  4 ++--
>  3 files changed, 16 insertions(+), 10 deletions(-)
> 
> 
> pmg-gui:
> 
> Markus Frank (2):
>   login: add option to login with OIDC realm
>   add realms panel to user management
> 
>  js/LoginView.js      | 209 ++++++++++++++++++++++++++++++++-----------
>  js/UserManagement.js |   7 ++
>  js/Utils.js          |  16 ++++
>  3 files changed, 181 insertions(+), 51 deletions(-)
> 

Gave it a quick test with Authentik as OIDC provider.
Login with a non-existent (on PMG) user without an email address works now.
Setting the username-claim to `email` fails with:
```
openid connect authentication failure; rhost=<host> msg=autocreate
openid connect user failed: verify entry failed
username: value does not match the regex pattern
```

And setting username-claim to `sub` fails with:
```
openid connect authentication failure; rhost=<host> msg=autocreate
openid connect user failed: verify entry
userid: value may only be 64 characters long
```

I've documented this in bugzilla [1].


[0] https://openid.net/specs/openid-connect-core-1_0.html#IDToken
[1] https://bugzilla.proxmox.com/show_bug.cgi?id=6200