proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-08-15 15:04:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

oidc: enforce generic URI regex for the ACR value

Browse Source 
Restrict the acr-value regex a little bit so as to align the behavior
with PBS. The openid documentation says that the acr-value *should* be
an URI [0]. Added a regex that loosely disallows some of the reserved
URI characters specified in the RFC [1].

Values like:
 * "urn:mace:incommon:iap:silver"
 * "urn:comsolve.nl:idp:contract:rba:location"
SHOULD work, but values like:
 * "urn:#ace:incommon:iap:silver"
 * "urn:"omsolve.nl:idp:contract:rba:location"
should NOT work.

This is related to the fix [2] for bug #5190 in PBS, but different as
there we had to make the verifier more flexible, whereas here we make
it stricter – mostly to have both projects aligned to avoid confusion.

[0]: https://openid.net/specs/openid-connect-core-1_0.html
[1]: https://www.rfc-editor.org/rfc/rfc2396.txt
[2]: https://git.proxmox.com/?p=proxmox-backup.git;a=commit;h=e0222ce83c28397d493c70825e873943c1223c67

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
This commit is contained in:
Gabriel Goller 2024-02-06 11:11:01 +01:00 committed by Thomas Lamprecht
parent 744ec31426
commit b543394c93
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/PVE/Auth/OpenId.pm
View File

@ -59,7 +59,8 @@ sub properties {
'acr-values' => { 'acr-values' => {
description => "Specifies the Authentication Context Class Reference values that the" description => "Specifies the Authentication Context Class Reference values that the"
."Authorization Server is being requested to use for the Auth Request.", ."Authorization Server is being requested to use for the Auth Request.",
type => 'string', # format => 'some-safe-id-list', # FIXME: TODO type => 'string',
pattern => '^[^\x00-\x1F\x7F <>#"]*$', # Prohibit characters not allowed in URI RFC 2396.
optional => 1, optional => 1,
}, },
}; };