[pve-devel] [PATCH common/access-control v2 0/5] improve LDAP DN and bind creds checking on creation/change

[Friedrich Weber]

Tested against slapd 2.4.47+dfsg-3+deb10u6 again, also with a base DN
with escaped UTF-8 -- connection check and authentication worked fine.

Also tested that updating the realm via API/pveum works now, thanks for
fixing this!

Tested-by: Friedrich Weber <f.weber at proxmox.com>

On 24/07/2023 11:03, Christoph Heiss wrote:
> tl;dr implements the result of the discussion in [0].
> 
> First, this removes the dreaded LDAP DN regex, replacing it instead with
> a proper schema format, which does validation using
> Net::LDAP::Util::canonical_dn().
> 
> Further, upon saving a LDAP realm in the UI, it tries to connect & bind
> using the provided credentials, providing the user with immediate
> feedback whether they are valid or not.
> 
> The same approach is already implemented in PBS [1].
> 
> Changes were tested against slapd 2.5.13+dfsg-5.
> 
> [0] https://lists.proxmox.com/pipermail/pve-devel/2023-May/056839.html
> [1] https://git.proxmox.com/?p=proxmox-backup.git;a=commitdiff;h=5210f3b5
> 
> v1: https://lists.proxmox.com/pipermail/pve-devel/2023-July/058274.html
> 
> Notable changes v1 -> v2:
>   * Fixed updating a LDAP realm via raw API/pveum/pvesh (see #5)
> 
> pve-common:
> 
> Christoph Heiss (3):
>   schema: add `ldap-dn` format for validating LDAP distinguished names
>   test: add test cases for new 'ldap-dn' schema format
>   ldap: handle errors explicitly everywhere instead of simply `die`ing
> 
>  debian/control              |  2 ++
>  src/PVE/JSONSchema.pm       | 12 +++++++++
>  src/PVE/LDAP.pm             | 11 ++++----
>  test/Makefile               |  1 +
>  test/ldap_dn_format_test.pl | 54 +++++++++++++++++++++++++++++++++++++
>  5 files changed, 75 insertions(+), 5 deletions(-)
> 
> pve-access-control:
> 
> Christoph Heiss (2):
>   ldap: validate LDAP DNs using the `ldap-dn` schema format
>   ldap: check bind credentials with LDAP directory directly on change
> 
>  src/PVE/API2/Domains.pm |  7 +++++--
>  src/PVE/Auth/LDAP.pm    | 28 ++++++++++++++++------------
>  2 files changed, 21 insertions(+), 14 deletions(-)
> 
> --
> 2.41.0
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
>