proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-10-05 02:23:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

implement OpenID autocreate user feature

Browse Source 
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Dietmar Maurer 2021-06-30 08:10:07 +02:00 committed by Thomas Lamprecht
parent ac344d7df3
commit fbf4594aaf
1 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/PVE/API2/OpenId.pm
View File

@ -9,9 +9,10 @@ use PVE::RS::OpenId;
use PVE::Exception qw(raise raise_perm_exc raise_param_exc); use PVE::Exception qw(raise raise_perm_exc raise_param_exc);
use PVE::SafeSyslog; use PVE::SafeSyslog;
use PVE::RPCEnvironment; use PVE::RPCEnvironment;
use PVE::Cluster qw(cfs_read_file); use PVE::Cluster qw(cfs_read_file cfs_write_file);
use PVE::AccessControl; use PVE::AccessControl;
use PVE::JSONSchema qw(get_standard_option); use PVE::JSONSchema qw(get_standard_option);
use PVE::Auth::Plugin;
use PVE::RESTHandler; use PVE::RESTHandler;
@ -179,8 +180,34 @@ __PACKAGE__->register_method ({
my $username = "${unique_name}\@${realm}"; my $username = "${unique_name}\@${realm}";
# test if user exists and is enabled # first, check if $username respects our naming conventions
$rpcenv->check_user_enabled($username); PVE::Auth::Plugin::verify_username($username);
if ($config->{'autocreate'} && !$rpcenv->check_user_exist($username, 1)) {
PVE::AccessControl::lock_user_config(sub {
my $usercfg = cfs_read_file("user.cfg");
die "user '$username' already exists\n" if $usercfg->{users}->{$username};
my $entry = { enable => 1 };
if (defined(my $email = $info->{'email'})) {
$entry->{email} = $email;
}
if (defined(my $given_name = $info->{'given_name'})) {
$entry->{firstname} = $given_name;
}
if (defined(my $family_name = $info->{'family_name'})) {
$entry->{lastname} = $family_name;
}
$usercfg->{users}->{$username} = $entry;
cfs_write_file("user.cfg", $usercfg);
}, "autocreate openid user failed");
} else {
# test if user exists and is enabled
$rpcenv->check_user_enabled($username);
}
my $ticket = PVE::AccessControl::assemble_ticket($username); my $ticket = PVE::AccessControl::assemble_ticket($username);
my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username); my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username);