[pmg-devel] [PATCH widget-toolkit v1 1/2] window: add optional autocreate-role selector to openid realm edit

[Thomas Lamprecht]

Am 27.02.25 um 08:55 schrieb Markus Frank:
> The enableRoleSelector option enables the role selector, and
> roleSelector can be overridden with a specific role selector such as
> pmgRoleSelector (displayfield is used as a placeholder for the role
> selector).
> 
> Signed-off-by: Markus Frank <m.frank at proxmox.com>
> ---
>  src/panel/AuthView.js        |  4 ++++
>  src/window/AuthEditBase.js   |  6 ++++++
>  src/window/AuthEditOpenId.js | 35 +++++++++++++++++++++++------------
>  3 files changed, 33 insertions(+), 12 deletions(-)
> 
> diff --git a/src/panel/AuthView.js b/src/panel/AuthView.js
> index 7bebf0d..2f777fc 100644
> --- a/src/panel/AuthView.js
> +++ b/src/panel/AuthView.js
> @@ -14,6 +14,8 @@ Ext.define('Proxmox.panel.AuthView', {
>  
>      baseUrl: '/access/domains',
>      storeBaseUrl: '/access/domains',
> +    enableRoleSelector: false,
> +    roleSelector: 'displayfield',

meh, this "common" component really gets overly-specialized, would have been
probably much easier to maintain and flexible if we copied that over to PMG..

Anyhow, I'd favor changing the configuration for role-assignment, having just
a fixed one is IMO not really ideal, and as is the "autocreate-role" property
is confusing (no role gets autocreated) and not flexible enough.

I'd rather transform the backend into something like the diff below, maybe
skipping the from-claim for today as such a format then would be easy to
extend later anyway.

The UI component might be better off for now to get a generic extraColumn1/2
parameter to avoid having to add an over-specialized one for every product
specific feature (@Dominik, what do you think about that?).

----8<----
diff --git a/src/PMG/API2/OIDC.pm b/src/PMG/API2/OIDC.pm
index 92ff88d..f2cba60 100644
--- a/src/PMG/API2/OIDC.pm
+++ b/src/PMG/API2/OIDC.pm
@@ -204,7 +204,21 @@ __PACKAGE__->register_method ({
                    if (defined(my $family_name = $info->{'family_name'})) {
                        $entry->{lastname} = $family_name;
                    }
-                   $entry->{role} = $config->{'autocreate-role'} // 'audit';
+                   $entry->{role} = 'audit'; # default
+                   if (my $role_assignment_raw = $config->{'autocreate-role-assignment'}) {
+                       my $role_assignment =
+                           PVE::Plugin::Auth::OIDC::parse_autocreate_role_assignment($role_assignment_raw);
+
+                       if ($role_assignment->{source} eq 'fixed') {
+                           $entry->{role} = $role_assignment->{'fixed-role'};
+                       } elsif ($role_assignment->{source} eq 'fixed') {
+                           my $role_attr = $role_assignment->{'role-claim'};
+                           $entry->{role} = $info->{$role_attr}
+                               or die "required '$role_attr' role-claim attribute not found, cannot autocreate user\n";
+                       } else {
+                           die "unkown role assignment source '$role_assignment->{source}' - implement me";
+                       }
+                   }
                    $entry->{userid} = $username;
                    $entry->{username} = $unique_name;
                    $entry->{realm} = $realm;
diff --git a/src/PMG/Auth/OIDC.pm b/src/PMG/Auth/OIDC.pm
index 4129d47..26a1e3f 100755
--- a/src/PMG/Auth/OIDC.pm
+++ b/src/PMG/Auth/OIDC.pm
@@ -4,6 +4,8 @@ use strict;
 use warnings;
 
 use PVE::Tools;
+use PVE::JSONSchema qw(parse_property_string);
+
 use PMG::Auth::Plugin;
 
 use base qw(PMG::Auth::Plugin);
@@ -12,6 +14,44 @@ sub type {
     return 'oidc';
 }
 
+my $autocreate_role_assignment_format = {
+    source => {
+       type => 'string',
+       enum => ['fixed', 'from-claim'],
+       default => 'fixed',
+       description => "How the access role for a newly auto-created user should be selected.",
+    },
+    'fixed-role' => {
+       type => 'string',
+       enum => ['admin', 'qmanager', 'audit', 'helpdesk'],
+       default => 'audit',
+       optional => 1,
+       description => "The fixed role that should be assigned to auto-created users.",
+    },
+    'role-claim' => {
+       description => "OIDC claim used to assign the unique username.",
+       type => 'string',
+       default => 'role',
+       optional => 1,
+       pattern => qr/^[a-zA-Z0-9._:-]+$/,
+    },
+};
+
+
+sub parse_autocreate_role_assignment {
+    my ($raw) = @_;
+    return undef if !$raw or !length($raw);
+
+    my $role_assignment = parse_property_string($autocreate_role_assignment_format, $raw);
+    $role_assignment->{'fixed-role'} = 'audit'
+       if $role_assignment->{'source'} eq 'fixed' && !defined($role_assignment->{'fixed-role'});
+
+    $role_assignment->{'role-claim'} = 'role'
+       if $role_assignment->{'source'} eq 'from-clain' && !defined($role_assignment->{'role-claim'});
+
+    return $role_assignment;
+}
+
 sub properties {
     return {
        'issuer-url' => {
@@ -39,11 +79,10 @@ sub properties {
            type => 'boolean',
            default => 0,
        },
-       'autocreate-role' => {
-           description => "Automatically create users with a specific role.",
-           type => 'string',
-           enum => ['admin', 'qmanager', 'audit', 'helpdesk'],
-           default => 'audit',
+       'autocreate-role-assignment' => {
+           description => "Defines which role should be assigned to auto-created users.",
+           type => 'string', format => $autocreate_role_assignment_format,
+           default => 'source=fixed,fixed-role=auditor',
            optional => 1,
        },
        'username-claim' => {
@@ -84,7 +123,7 @@ sub options {
        'client-id' => {},
        'client-key' => { optional => 1 },
        autocreate => { optional => 1 },
-       'autocreate-role' => { optional => 1 },
+       'autocreate-role-assignment' => { optional => 1 },
        'username-claim' => { optional => 1, fixed => 1 },
        prompt => { optional => 1 },
        scopes => { optional => 1 },