[pmg-devel] [PATCH proxmox 1/1] login: fix userid check for '@quarantine' user tickets

[Dominik Csapak]

when logging into the pmg quarantine via LDAP, the user typically
enters a userid like 'foo at bar.com'. When receiving a valid ticket,
this contains a userid like 'foo at bar.com@quarantine'. To check if that's
correct, use our helper instead of manually checking for equality.

That helper also needs fixing: while it should be (optionally) possible
to enter the username with 'foo at bar.com@quarantine' (so we have to strip
the quarantine part from the expected userid), we also have to strip the
'@quarantine' part from the ticket response, since it contains that too.

Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
---
 proxmox-login/src/lib.rs | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/proxmox-login/src/lib.rs b/proxmox-login/src/lib.rs
index 4b2869a7..c67cd70b 100644
--- a/proxmox-login/src/lib.rs
+++ b/proxmox-login/src/lib.rs
@@ -58,7 +58,9 @@ fn normalize_url(mut api_url: String) -> String {
 }
 
 fn check_ticket_userid(ticket_userid: &str, expected_userid: &str) -> Result<(), ResponseError> {
-    if ticket_userid != expected_userid.trim_end_matches("@quarantine") {
+    if ticket_userid.trim_end_matches("@quarantine")
+        != expected_userid.trim_end_matches("@quarantine")
+    {
         return Err("returned ticket contained unexpected userid".into());
     }
     Ok(())
@@ -186,9 +188,7 @@ impl Login {
         let response: api::ApiResponse<api::CreateTicketResponse> = serde_json::from_slice(body)?;
         let response = response.data.ok_or("missing response data")?;
 
-        if response.username != self.userid {
-            return Err("ticket response contained unexpected userid".into());
-        }
+        check_ticket_userid(&response.username, &self.userid)?;
 
         // if a ticket was provided via a cookie, use it like a normal ticket
         if let Some(ticket) = cookie_ticket {
@@ -380,9 +380,7 @@ impl SecondFactorChallenge {
         let response: api::ApiResponse<api::CreateTicketResponse> = serde_json::from_slice(body)?;
         let response = response.data.ok_or("missing response data")?;
 
-        if response.username != self.userid {
-            return Err("ticket response contained unexpected userid".into());
-        }
+        check_ticket_userid(&response.username, &self.userid)?;
 
         // get the ticket from:
         // 1. the cookie if possible -> new HttpOnly authentication outside of the browser
-- 
2.47.3