[pve-devel] r5590 - in pve-access-control/trunk: . PVE PVE/API2

svn-commits at proxmox.com svn-commits at proxmox.com
Wed Feb 23 09:30:06 CET 2011


Author: dietmar
Date: 2011-02-23 09:30:06 +0100 (Wed, 23 Feb 2011)
New Revision: 5590

Modified:
   pve-access-control/trunk/ChangeLog
   pve-access-control/trunk/PVE/API2/AccessControl.pm
   pve-access-control/trunk/PVE/API2/Domains.pm
   pve-access-control/trunk/PVE/API2/Role.pm
   pve-access-control/trunk/PVE/API2/User.pm
   pve-access-control/trunk/PVE/AccessControl.pm
   pve-access-control/trunk/PVE/RPCEnvironment.pm
   pve-access-control/trunk/pveum
Log:
* PVE/API2/AccessControl.pm (create_ticket): moved code from REST.pm



Modified: pve-access-control/trunk/ChangeLog
===================================================================
--- pve-access-control/trunk/ChangeLog	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/ChangeLog	2011-02-23 08:30:06 UTC (rev 5590)
@@ -1,3 +1,7 @@
+2011-02-23  Proxmox Support Team  <support at proxmox.com>
+
+	* PVE/API2/AccessControl.pm (create_ticket): moved code from REST.pm
+
 2011-02-22  Proxmox Support Team  <support at proxmox.com>
 
 	* PVE/AccessControl.pm: make 'domains.cfg' readable by www-data,

Modified: pve-access-control/trunk/PVE/API2/AccessControl.pm
===================================================================
--- pve-access-control/trunk/PVE/API2/AccessControl.pm	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/PVE/API2/AccessControl.pm	2011-02-23 08:30:06 UTC (rev 5590)
@@ -4,9 +4,11 @@
 use warnings;
 
 use PVE::SafeSyslog;
-use Apache2::Const qw(:http);
-
+use PVE::RPCEnvironment;
+use PVE::Cluster;
 use PVE::RESTHandler;
+use PVE::AccessControl;
+use PVE::JSONSchema qw(get_standard_option);
 use PVE::API2::Domains;
 use PVE::API2::User;
 use PVE::API2::Group;
@@ -74,7 +76,94 @@
 	    push @$res, { subdir => $subpath };
 	}
 
+	push @$res, { subdir => 'ticket' };
+
 	return $res;
     }});
 
+__PACKAGE__->register_method ({
+    name => 'create_ticket', 
+    path => 'ticket', 
+    method => 'POST',
+    permissions => { user => 'world' },
+    protected => 1, # else we can't access shadow files
+    description => "Create authentication ticket.",
+    parameters => {
+	additionalProperties => 0,
+	properties => {
+	    username => {
+		description => "User name",
+		type => 'string',
+		maxLength => 64,
+	    },
+	    realm =>  get_standard_option('realm', {
+		description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.",
+		optional => 1}),
+	    password => { 
+		description => "The secret password. This can also be a valid ticket.",
+		type => 'string',
+	    },
+	    path => {
+		description => "Only create ticket if user have access 'privs' on 'path'",
+		type => 'string',
+		requires => 'privs',
+		optional => 1,
+		maxLength => 64,
+	    },
+	    privs => { 
+		description => "Only create ticket if user have access 'privs' on 'path'",
+		type => 'string' , format => 'pve-priv-list',
+		requires => 'path',
+		optional => 1,
+		maxLength => 64,
+	    },
+	}
+    },
+    returns => {
+	type => "object",
+	properties => {
+	    ticket => { type => 'string' },
+	}
+    },
+    code => sub {
+	my ($param) = @_;
+    
+	my $username = $param->{username};
+	$username .= "\@$param->{realm}" if $param->{realm};
+
+	my $rpcenv = PVE::RPCEnvironment::get();
+	my $clientip = $rpcenv->get_client_ip() || '';
+
+	my $ticket;
+	eval {
+
+	    if ($param->{path} && $param->{privs}) {
+		my $privs = [ PVE::Tools::split_list($param->{privs}) ];
+		my $path = PVE::AccessControl::normalize_path($param->{path});
+		if (!($path && scalar(@$privs) && $rpcenv->check($username, $path, $privs))) {
+		    die "no permission ($param->{path}, $param->{privs})\n";
+		}
+	    }
+
+	    my $tmp;
+	    if (($tmp = PVE::AccessControl::verify_ticket($param->{password}, 1)) &&
+		($tmp eq $username)) {
+		# got valid ticket
+	    } else {
+		$username = PVE::AccessControl::authenticate_user($username, $param->{password});
+	    }
+	    $ticket = PVE::AccessControl::assemble_ticket($username);
+	};
+	if (my $err = $@) {
+	    syslog('err', "authentication failure; rhost=$clientip user=$username msg=$err");
+	    die $err;
+	}
+
+	PVE::Cluster::log_msg('info', 'root at pam', "successful auth for user '$username'");
+
+	return {
+	    ticket => $ticket,
+	};
+    }});
+
 1;

Modified: pve-access-control/trunk/PVE/API2/Domains.pm
===================================================================
--- pve-access-control/trunk/PVE/API2/Domains.pm	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/PVE/API2/Domains.pm	2011-02-23 08:30:06 UTC (rev 5590)
@@ -21,6 +21,7 @@
     path => '', 
     method => 'GET',
     description => "Authentication domain index.",
+    permissions => { user => 'world' },
     parameters => {
 	additionalProperties => 0,
 	properties => {},

Modified: pve-access-control/trunk/PVE/API2/Role.pm
===================================================================
--- pve-access-control/trunk/PVE/API2/Role.pm	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/PVE/API2/Role.pm	2011-02-23 08:30:06 UTC (rev 5590)
@@ -57,7 +57,7 @@
    	additionalProperties => 0,
 	properties => {
 	    roleid => { type => 'string', format => 'pve-roleid' },
-	    privs => { type => 'string', optional => 1 },
+	    privs => { type => 'string' , format => 'pve-priv-list', optional => 1 },
 	},
     },
     returns => { type => 'null' },

Modified: pve-access-control/trunk/PVE/API2/User.pm
===================================================================
--- pve-access-control/trunk/PVE/API2/User.pm	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/PVE/API2/User.pm	2011-02-23 08:30:06 UTC (rev 5590)
@@ -69,28 +69,6 @@
     }});
 
 __PACKAGE__->register_method ({
-    name => 'create_ticket', 
-    path => '{userid}/ticket', 
-    method => 'POST',
-    description => "Create authentication ticket.",
-    parameters => {
-	additionalProperties => 0,
-	properties => {
-	    userid => get_standard_option('userid'),
-	    password => { type => 'string' },
-	}
-    },
-    returns => { type => 'string' },
-    code => sub {
-	my ($param) = @_;
-    
-	my $user = PVE::AccessControl::authenticate_user($param->{userid}, $param->{password});
-	my $ticket = PVE::AccessControl::assemble_ticket($user);
-
-	return $ticket;
-    }});
-
-__PACKAGE__->register_method ({
     name => 'create_user', 
     protected => 1,
     path => '{userid}', 

Modified: pve-access-control/trunk/PVE/AccessControl.pm
===================================================================
--- pve-access-control/trunk/PVE/AccessControl.pm	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/PVE/AccessControl.pm	2011-02-23 08:30:06 UTC (rev 5590)
@@ -308,34 +308,29 @@
 sub authenticate_user {
     my ($username, $password) = @_;
 
-    eval {
-
-	die "no username specified\n" if !$username;
+    die "no username specified\n" if !$username;
  
-	my ($userid, $realm);
+    my ($userid, $realm);
 
-	($username, $userid, $realm) = verify_username($username);
+    ($username, $userid, $realm) = verify_username($username);
 
-	my $usercfg = cfs_read_file('user.cfg');
+    my $usercfg = cfs_read_file('user.cfg');
 
-	if (!user_enabled($usercfg, $username)) {
-	    sleep(2);
-	    die "no such user ('$username')\n"
-	}
+    if (!user_enabled($usercfg, $username)) {
+	sleep(2);
+	die "no such user ('$username')\n"
+    }
 
-	my $ctime = time();
-	my $expire = $usercfg->{users}->{$username}->{expire};
+    my $ctime = time();
+    my $expire = $usercfg->{users}->{$username}->{expire};
 
-	if ($expire && ($expire < $ctime)) {
-	    sleep(2);
-	    die "account expired\n"
-	}
+    if ($expire && ($expire < $ctime)) {
+	sleep(2);
+	die "account expired\n"
+    }
 
-	authenticate_user_domain($realm, $userid, $password);
-    };
+    authenticate_user_domain($realm, $userid, $password);
 
-    die "auth failed: $@" if $@;
-
     return $username;
 }
 
@@ -620,13 +615,15 @@
     return undef;
 }
 PVE::JSONSchema::register_standard_option('userid', {
-    description => "User ID (email address format)",
+    description => "User ID",
     type => 'string', format => 'pve-userid',
+    maxLength => 64,
 });
 
 PVE::JSONSchema::register_standard_option('realm', {
     description => "Authentication domain ID",
     type => 'string', format => 'pve-configid',
+    maxLength => 32,
 });
 
 PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);

Modified: pve-access-control/trunk/PVE/RPCEnvironment.pm
===================================================================
--- pve-access-control/trunk/PVE/RPCEnvironment.pm	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/PVE/RPCEnvironment.pm	2011-02-23 08:30:06 UTC (rev 5590)
@@ -135,12 +135,6 @@
     return PVE::AccessControl::user_enabled($cfg, $user);
 }
 
-sub realm_list {
-    my ($self) = @_;
-    
-    return $self->{realms};
-}
-
 # initialize environment - must be called once at program startup
 sub init {
     my ($class, $type, %params) = @_;
@@ -223,25 +217,6 @@
 		my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
 		$self->{user_cfg} = $cfg;
 	    }
-	    my $dcvers = PVE::Cluster::cfs_file_version('domains.cfg'); 
-	    if (!$self->{realms} || !defined($self->{domainsversion}) || 
-		!defined($dcvers) ||  ($dcvers ne $self->{domainsversion})) {
-		$self->{domainsversion} = $dcvers;
-		my $dcfg = PVE::Cluster::cfs_read_file('domains.cfg');
-		my $ra = [];
-		foreach my $realm (keys %$dcfg) {
-		    my $data = $dcfg->{$realm};
-		    my $entry = { 
-			id => $realm,
-			comment => $data->{comment} || $realm,
-		    };
-
-		    $entry->{default} = 1 if $data->{default};
-
-		    push @$ra, $entry;
-		}
-		$self->{realms} = $ra;
-	    }
 	}
     };
     if (my $err = $@) {
@@ -250,6 +225,18 @@
     }
 }
 
+sub set_client_ip {
+    my ($self, $ip) = @_;
+
+    $self->{client_ip} = $ip;
+}
+
+sub get_client_ip {
+    my ($self) = @_;
+
+    return $self->{client_ip};
+}
+
 sub set_language {
     my ($self, $lang) = @_;
 

Modified: pve-access-control/trunk/pveum
===================================================================
--- pve-access-control/trunk/pveum	2011-02-23 08:25:32 UTC (rev 5589)
+++ pve-access-control/trunk/pveum	2011-02-23 08:30:06 UTC (rev 5590)
@@ -14,6 +14,7 @@
 use PVE::API2::Group;
 use PVE::API2::Role;
 use PVE::API2::ACL;
+use PVE::API2::AccessControl;
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::CLIHandler;
 
@@ -54,10 +55,10 @@
 };
 
 my $cmddef = {
-    ticket => [ 'PVE::API2::User', 'create_ticket', ['userid'], undef,
+    ticket => [ 'PVE::API2::AccessControl', 'create_ticket', ['username'], undef,
 		sub {
-		    my $ticket = shift;
-		    print "$ticket\n";
+		    my ($res) = @_;
+		    print "$res->{ticket}\n";
 		}],
     useradd => [ 'PVE::API2::User', 'create_user', ['userid'] ],
     usermod => [ 'PVE::API2::User', 'update_user', ['userid'] ],



More information about the pve-devel mailing list