[pve-devel] r5408 - in pve-access-control/trunk: . PVE PVE/API2
svn-commits at proxmox.com
svn-commits at proxmox.com
Fri Jan 21 10:17:00 CET 2011
Author: dietmar
Date: 2011-01-21 10:17:00 +0100 (Fri, 21 Jan 2011)
New Revision: 5408
Modified:
pve-access-control/trunk/ChangeLog
pve-access-control/trunk/PVE/API2/User.pm
pve-access-control/trunk/PVE/AccessControl.pm
pve-access-control/trunk/pveum
Log:
* PVE/AccessControl.pm: register a JSONSchema standard option for
'userid'.
* pveum: allow to pass passwords with environment variable
PVE_PW_TICKET
* pveum (auth): new method to verify credentials/privileges (used
by our kvm patches and vncterm)
Modified: pve-access-control/trunk/ChangeLog
===================================================================
--- pve-access-control/trunk/ChangeLog 2011-01-21 07:31:10 UTC (rev 5407)
+++ pve-access-control/trunk/ChangeLog 2011-01-21 09:17:00 UTC (rev 5408)
@@ -1,3 +1,13 @@
+2011-01-21 root <root at maui.maurer-it.com>
+
+ * PVE/AccessControl.pm: register a JSONSchema standard option for
+ 'userid'.
+
+ * pveum: allow to pass passwords with environment variable
+ PVE_PW_TICKET
+ * pveum (auth): new method to verify credentials/privileges (used
+ by our kvm patches and vncterm)
+
2011-01-12 root <root at maui.maurer-it.com>
* PVE/AccessControl.pm: use new PVE::Cluster class and read data
Modified: pve-access-control/trunk/PVE/API2/User.pm
===================================================================
--- pve-access-control/trunk/PVE/API2/User.pm 2011-01-21 07:31:10 UTC (rev 5407)
+++ pve-access-control/trunk/PVE/API2/User.pm 2011-01-21 09:17:00 UTC (rev 5408)
@@ -5,6 +5,7 @@
use PVE::Cluster qw (cfs_read_file cfs_write_file);
use PVE::Tools qw(split_list);
use PVE::AccessControl;
+use PVE::JSONSchema qw(get_standard_option);
use PVE::SafeSyslog;
@@ -58,7 +59,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string' , format => 'pve-userid'},
+ userid => get_standard_option('userid'),
password => { type => 'string' },
}
},
@@ -81,7 +82,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string', format => 'pve-userid' },
+ userid => get_standard_option('userid'),
password => { type => 'string', optional => 1 },
groups => { type => 'string', optional => 1, format => 'pve-groupid-list'},
},
@@ -135,7 +136,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string', format => 'pve-userid' },
+ userid => get_standard_option('userid'),
},
},
returns => {},
@@ -163,7 +164,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string', format => 'pve-userid' },
+ userid => get_standard_option('userid'),
password => { type => 'string', optional => 1 },
groups => { type => 'string', optional => 1, format => 'pve-groupid-list' },
append => {
@@ -239,7 +240,7 @@
parameters => {
additionalProperties => 0,
properties => {
- userid => { type => 'string', format => 'pve-userid' },
+ userid => get_standard_option('userid'),
}
},
returns => { type => 'null' },
Modified: pve-access-control/trunk/PVE/AccessControl.pm
===================================================================
--- pve-access-control/trunk/PVE/AccessControl.pm 2011-01-21 07:31:10 UTC (rev 5407)
+++ pve-access-control/trunk/PVE/AccessControl.pm 2011-01-21 09:17:00 UTC (rev 5408)
@@ -544,7 +544,12 @@
return undef;
}
+PVE::JSONSchema::register_standard_option('userid', {
+ description => "User ID (email address format)",
+ type => 'string', format => 'pve-userid',
+});
+
PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);
sub verify_groupname {
my ($groupname, $noerr) = @_;
Modified: pve-access-control/trunk/pveum
===================================================================
--- pve-access-control/trunk/pveum 2011-01-21 07:31:10 UTC (rev 5407)
+++ pve-access-control/trunk/pveum 2011-01-21 09:17:00 UTC (rev 5408)
@@ -4,6 +4,7 @@
use Getopt::Long;
use PVE::Tools qw(run_command);
use PVE::Cluster;
+use PVE::SafeSyslog;
use PVE::AccessControl;
use File::Path qw(make_path remove_tree);
use Term::ReadLine;
@@ -13,7 +14,7 @@
use PVE::API2::Group;
use PVE::API2::Role;
use PVE::API2::ACL;
-
+use PVE::JSONSchema qw(get_standard_option);
use PVE::CLIHandler;
use base qw(PVE::CLIHandler);
@@ -22,6 +23,8 @@
$ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
+initlog ('pveum', 'daemon');
+
#fixme: logging?
die "please run as root\n" if $> != 0;
@@ -40,6 +43,8 @@
my $read_password = sub {
+ return $ENV{PVE_PW_TICKET} if defined($ENV{PVE_PW_TICKET});
+
my $term = new Term::ReadLine ('pveum');
my $attribs = $term->Attribs;
$attribs->{redisplay_function} = $attribs->{shadow_redisplay};
@@ -49,12 +54,58 @@
return $input;
};
+__PACKAGE__->register_method ({
+ name => 'auth',
+ path => 'auth',
+ method => 'GET',
+ description => "Helper method to authenticate users and verify access permissions. This is called by external tools like kvm and vncterm. Simply raises an exception when authentication fails or the user does not have the requested privileges.",
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ userid => get_standard_option('userid'),
+ password => {
+ type => 'string',
+ description => "Password (or ticket). This can be passed via an environment variable 'PVE_PW_TICKET'.",
+ },
+ permissions => {
+ type => 'string' , format => 'pve-priv-list',
+ description => "The list of privileges to check for.",
+ },
+ path => {
+ type => 'string',
+ description => "Path to identify object."
+ }
+ }
+ },
+ returns => { type => 'null' },
+ code => sub {
+ my ($param) = @_;
+
+ my $user = PVE::AccessControl::authenticate_user($param->{userid}, $param->{password});
+
+ # check permissions
+
+ my $path = PVE::AccessControl::normalize_path($param->{path});
+ my $cfg = PVE::Cluster::cfs_read_file("user.cfg");
+ my $perm = PVE::AccessControl::permission($cfg, $user, $path);
+
+ foreach my $priv (PVE::AccessControl::split_list($param->{permissions})) {
+ die "missing privileg '$priv'\n" if !$perm->{$priv};
+ };
+
+ PVE::Cluster::log_msg('info', "root", "successful auth for user '$user'");
+
+ return undef;
+ }});
+
+
my $cmddef = {
ticket => [ 'PVE::API2::User', 'create_ticket', ['userid'], undef,
sub {
my $ticket = shift;
print "$ticket\n";
}],
+ auth => [ __PACKAGE__, 'auth', ['path', 'userid', 'permissions'] ],
useradd => [ 'PVE::API2::User', 'create_user', ['userid'] ],
usermod => [ 'PVE::API2::User', 'update_user', ['userid'] ],
userdel => [ 'PVE::API2::User', 'delete_user', ['userid'] ],
More information about the pve-devel
mailing list