proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-07-19 13:11:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

api: realm sync: cleanup code and refactor

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2020-03-21 15:55:30 +01:00
parent 5654260eab
commit cf109814a8
1 changed files with 30 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
PVE/API2/Domains.pm
View File

@ -250,15 +250,16 @@ __PACKAGE__->register_method ({
path => '{realm}/sync', path => '{realm}/sync',
method => 'POST', method => 'POST',
permissions => { permissions => {
description => "You need 'Realm.AllocateUser' on '/access/realm/<realm>' on the realm and 'User.Modify' permissions to '/access/groups/'.", description => "'Realm.AllocateUser' on '/access/realm/<realm>' and "
." 'User.Modify' permissions to '/access/groups/'.",
check => [ 'and', check => [ 'and',
[ 'userid-param', 'Realm.AllocateUser'], [ 'userid-param', 'Realm.AllocateUser' ],
[ 'userid-group', ['User.Modify']], [ 'userid-group', ['User.Modify'] ],
], ],
}, },
description => "Syncs users and/or groups from LDAP to user.cfg. ". description => "Syncs users and/or groups from the configured LDAP to user.cfg."
"NOTE: Synced groups will have the name 'name-\$realm', so ". ." NOTE: Synced groups will have the name 'name-\$realm', so make sure"
"make sure those groups do not exist to prevent overwriting.", ." those groups do not exist to prevent overwriting.",
protected => 1, protected => 1,
parameters => { parameters => {
additionalProperties => 0, additionalProperties => 0,
@ -285,63 +286,45 @@ __PACKAGE__->register_method ({
}, },
} }
}, },
returns => { type => 'string' }, returns => {
description => 'Worker Task-UPID',
type => 'string'
},
code => sub { code => sub {
my ($param) = @_; my ($param) = @_;
my $rpcenv = PVE::RPCEnvironment::get(); my $rpcenv = PVE::RPCEnvironment::get();
my $authuser = $rpcenv->get_user(); my $authuser = $rpcenv->get_user();
my $realm = $param->{realm}; my $realm = $param->{realm};
my $cfg = cfs_read_file($domainconfigfile); my $cfg = cfs_read_file($domainconfigfile);
my $ids = $cfg->{ids}; my $realmconfig = $cfg->{ids}->{$realm};
raise_param_exc({ 'realm' => 'Realm does not exist.' }) if !defined($ids->{$realm}); raise_param_exc({ 'realm' => 'Realm does not exist.' }) if !defined($realmconfig);
my $type = $ids->{$realm}->{type}; my $type = $realmconfig->{type};
if ($type ne 'ldap' && $type ne 'ad') { if ($type ne 'ldap' && $type ne 'ad') {
die "Only LDAP/AD realms can be synced.\n"; die "Cannot sync realm type '$type'! Only LDAP/AD realms can be synced.\n";
} }
my $scope = $param->{scope}; my $scope = $param->{scope};
my $sync_users; my $whatstring = $scope eq 'both' ? "users and groups" : $scope;
my $sync_groups;
my $errorstring = "syncing ";
if ($scope eq 'users') {
$errorstring .= "users ";
$sync_users = 1;
} elsif ($scope eq 'groups') {
$errorstring .= "groups ";
$sync_groups = 1;
} elsif ($scope eq 'both') {
$errorstring .= "users and groups ";
$sync_users = $sync_groups = 1;
}
$errorstring .= "failed.";
my $plugin = PVE::Auth::Plugin->lookup($ids->{$realm}->{type});
my $realmdata = $ids->{$realm};
my $users = {};
my $groups = {};
my $plugin = PVE::Auth::Plugin->lookup($type);
my $worker = sub { my $worker = sub {
print "starting sync for $realm\n"; print "starting sync for realm $realm\n";
if ($sync_groups) {
my $dnmap = {}; my ($synced_users, $dnmap) = $plugin->get_users($realmconfig, $realm);
($users, $dnmap) = $plugin->get_users($realmdata, $realm); my $synced_groups = {};
$groups = $plugin->get_groups($realmdata, $realm, $dnmap); if ($scope eq 'groups' || $scope eq 'both') {
} else { $synced_groups = $plugin->get_groups($realmconfig, $realm, $dnmap);
$users = $plugin->get_users($realmdata, $realm);
} }
PVE::AccessControl::lock_user_config( PVE::AccessControl::lock_user_config(sub {
sub {
my $usercfg = cfs_read_file("user.cfg"); my $usercfg = cfs_read_file("user.cfg");
print "got data from server, modifying users/groups\n"; print "got data from server, updating $whatstring\n";
if ($sync_users) { if ($sync_users) {
print "syncing users\n"; print "syncing users\n";
@ -419,9 +402,10 @@ __PACKAGE__->register_method ({
} }
} }
} }
cfs_write_file("user.cfg", $usercfg); cfs_write_file("user.cfg", $usercfg);
print "updated user.cfg\n"; print "successfully updated $whatstring configuration\n";
}, $errorstring); }, "syncing $whatstring failed");
}; };
return $rpcenv->fork_worker('ldapsync', $realm, $authuser, $worker); return $rpcenv->fork_worker('ldapsync', $realm, $authuser, $worker);