proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-07-27 03:03:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

API token: add verification method

Browse Source 
which checks that the user and token exist and are not expired, and then
generates the string to be matched with the pmxcfs-stored token shadow
config file.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2020-01-21 13:54:05 +01:00 committed by Thomas Lamprecht
parent 3a540a697f
commit 35c3ca0fc8
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
PVE/AccessControl.pm
View File

@ -399,6 +399,39 @@ sub verify_ticket {
return wantarray ? ($username, $age, $tfa_info) : $username;
}
sub verify_token {
my ($api_token) = @_;
die "no API token specified\n" if !$api_token;
my ($tokenid, $value);
if ($api_token =~ /^(.*)=(.*)$/) {
$tokenid = $1;
$value = $2;
} else {
die "no tokenid specified\n";
}
my ($username, $token) = split_tokenid($tokenid);
my $usercfg = cfs_read_file('user.cfg');
check_user_enabled($usercfg, $username);
check_token_exist($usercfg, $username, $token);
my $ctime = time();
my $user = $usercfg->{users}->{$username};
die "account expired\n" if $user->{expire} && ($user->{expire} < $ctime);
my $token_info = $user->{tokens}->{$token};
die "token expired\n" if $token_info->{expire} && ($token_info->{expire} < $ctime);
die "invalid token value!\n" if !PVE::Cluster::verify_token($tokenid, $value);
return wantarray ? ($tokenid) : $tokenid;
}
# VNC tickets
# - they do not contain the username in plain text
# - they are restricted to a specific resource path (example: '/vms/100')