proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-07-15 03:28:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix #2947 login name for the LDAP/AD realm can be case-insensitive

Browse Source 
This is an optional for LDAP and AD realm.
The default behavior is case-sensitive.

Signed-off-by: Wolfgang Link <w.link@proxmox.com>
This commit is contained in:
Wolfgang Link 2020-09-08 14:09:45 +02:00 committed by Thomas Lamprecht
parent 9de25de807
commit eb41d20051
4 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
PVE/API2/AccessControl.pm
View File

@ -292,6 +292,7 @@ __PACKAGE__->register_method ({
my $username = $param->{username};
$username .= "\@$param->{realm}" if $param->{realm};
$username = PVE::AccessControl::lookup_username($username);
my $rpcenv = PVE::RPCEnvironment::get();
my $res;

22
PVE/AccessControl.pm
View File

@ -891,6 +891,28 @@ sub add_role_privs {
}
}
sub lookup_username {
my ($username) = @_;
$username =~ m!^(${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex})$!;
my $realm = $2;
my $domain_cfg = cfs_read_file("domains.cfg");
my $casesensitive = $domain_cfg->{ids}->{$realm}->{'case-sensitive'} // 1;
my $usercfg = cfs_read_file('user.cfg');
if (!$casesensitive) {
my @matches = grep { lc $username eq lc $_ } (keys %{$usercfg->{users}});
die "ambiguous case insensitive match of username '$username', cannot safely grant access!\n"
if scalar @matches > 1;
return $matches[0]
}
return $username;
}
sub normalize_path {
my $path = shift;

1
PVE/Auth/AD.pm
View File

@ -94,6 +94,7 @@ sub options {
group_classes => { optional => 1 },
'sync-defaults-options' => { optional => 1 },
mode => { optional => 1 },
'case-sensitive' => { optional => 1 },
};
}

7
PVE/Auth/LDAP.pm
View File

@ -129,6 +129,12 @@ sub properties {
optional => 1,
default => 'ldap',
},
'case-sensitive' => {
description => "username is case-sensitive",
type => 'boolean',
optional => 1,
default => 1,
}
};
}
@ -159,6 +165,7 @@ sub options {
group_classes => { optional => 1 },
'sync-defaults-options' => { optional => 1 },
mode => { optional => 1 },
'case-sensitive' => { optional => 1 },
};
}