From ae549f5012a7fbb544eceab8c616f08302ed0132 Mon Sep 17 00:00:00 2001 From: Davide Principi Date: Thu, 12 Oct 2023 12:35:24 +0200 Subject: [PATCH 1/2] User management portal - Configure and start api-moduled instance to serve backend API - Configure Traefik path-based route for the web portal - Implement basic API: login and change-password handlers --- README.md | 23 ++++++++ build-images.sh | 6 +-- .../actions/configure-module/80start_amld | 44 +++++++++++++++ .../destroy-module/50cleanup_amld_route | 19 +++++++ .../api-moduled/handlers/change-password/post | 54 +++++++++++++++++++ .../change-password/validate-input.json | 18 +++++++ .../change-password/validate-output.json | 21 ++++++++ imageroot/api-moduled/handlers/login/post | 45 ++++++++++++++++ .../handlers/login/validate-input.json | 18 +++++++ imageroot/api-moduled/public/.gitignore | 0 10 files changed, 244 insertions(+), 4 deletions(-) create mode 100644 imageroot/actions/configure-module/80start_amld create mode 100755 imageroot/actions/destroy-module/50cleanup_amld_route create mode 100755 imageroot/api-moduled/handlers/change-password/post create mode 100644 imageroot/api-moduled/handlers/change-password/validate-input.json create mode 100644 imageroot/api-moduled/handlers/change-password/validate-output.json create mode 100755 imageroot/api-moduled/handlers/login/post create mode 100644 imageroot/api-moduled/handlers/login/validate-input.json create mode 100644 imageroot/api-moduled/public/.gitignore diff --git a/README.md b/README.md index 7b86294..c26238e 100644 --- a/README.md +++ b/README.md @@ -74,3 +74,26 @@ Create user `first.user` as member of `mygroup1` Change First User's password api-cli run module/openldap1/alter-user --data '{"user":"first.user","password":"Neth,123"}' + +## User management web portal + +The `openldap` module provides a public web portal where LDAP users can +authenticate and change their passwords. + +The module registers a Traefik path route, with the domain name as suffix. +For instance: + + https:///users-admin/domain.test/ + +The backend of the module runs under the `api-moduled.service` Systemd +unit supervision. Refer also to `api-moduled` documentation, provided by +`ns8-core` repository. + +API implementation code is under `imageroot/api-moduled/handlers/`, which +is mapped to an URL like + + https:///users-admin/domain.test/api/ + +The `.json` files define the API input/output syntax validation, using the +JSON schema language. As such they can give an idea of request/response +payload structure. diff --git a/build-images.sh b/build-images.sh index 7a79f7f..05dd1dc 100644 --- a/build-images.sh +++ b/build-images.sh @@ -30,13 +30,11 @@ else touch ui/dist/index.html fi -# Add imageroot directory to the container image buildah add "${container}" imageroot /imageroot buildah add "${container}" ui/dist /ui -# Setup the entrypoint, ask to reserve one TCP port with the label and set a rootless container buildah config --entrypoint=/ \ - --label='org.nethserver.authorizations=ldapproxy@node:accountprovider cluster:accountprovider' \ - --label="org.nethserver.tcp-ports-demand=1" \ + --label='org.nethserver.authorizations=ldapproxy@node:accountprovider cluster:accountprovider traefik@node:routeadm' \ + --label="org.nethserver.tcp-ports-demand=2" \ --label="org.nethserver.rootfull=0" \ --label="org.nethserver.images=${repobase}/openldap-server:${IMAGETAG:-latest}" \ --label 'org.nethserver.flags=core_module account_provider' \ diff --git a/imageroot/actions/configure-module/80start_amld b/imageroot/actions/configure-module/80start_amld new file mode 100644 index 0000000..ae8fbe3 --- /dev/null +++ b/imageroot/actions/configure-module/80start_amld @@ -0,0 +1,44 @@ +#!/usr/bin/env python3 + +# +# Copyright (C) 2023 Nethesis S.r.l. +# SPDX-License-Identifier: GPL-3.0-or-later +# + +import agent +import agent.tasks +import sys +import os +import string +import secrets + + +_, amld_port, _ = (os.environ['TCP_PORTS'] + ',,').split(",", 2) + +agent.assert_exp(int(amld_port) > 0) # Ensure TCP port for api-moduled was allocated + +alphabet = string.ascii_letters + string.digits + '+-/,.-_^' +amld_secret = ''.join([secrets.choice(alphabet) for i in range(32)]) + +agent.write_envfile("api-moduled.env", { + "AMLD_JWT_REALM": os.environ["LDAP_DOMAIN"], + "AMLD_JWT_SECRET": amld_secret, + "AMLD_BIND_ADDRESS": ":" + amld_port, + "AMLD_EXPORT_ENV": "NODE_ID LDAP_DOMAIN REDIS_ADDRESS" +}) + +# Configure Traefik to route "/user-admin/" path requests to +# the api-moduled backend service: +response = agent.tasks.run( + agent_id=agent.resolve_agent_id('traefik@node'), + action='set-route', + data={ + 'instance': os.environ['MODULE_ID'] + '-amld', + 'url': 'http://127.0.0.1:' + amld_port, + 'path': '/users-admin/' + os.environ['LDAP_DOMAIN'], + 'http2https': True, + 'strip_prefix': True, + }, +) + +agent.run_helper("systemctl", "-T", "--user", "enable", "--now", "api-moduled.service") diff --git a/imageroot/actions/destroy-module/50cleanup_amld_route b/imageroot/actions/destroy-module/50cleanup_amld_route new file mode 100755 index 0000000..8f03050 --- /dev/null +++ b/imageroot/actions/destroy-module/50cleanup_amld_route @@ -0,0 +1,19 @@ +#!/usr/bin/env python3 + +# +# Copyright (C) 2023 Nethesis S.r.l. +# SPDX-License-Identifier: GPL-3.0-or-later +# + +import os +import agent +import agent.tasks + +# Remove traefik route +response = agent.tasks.run( + agent_id=agent.resolve_agent_id('traefik@node'), + action='delete-route', + data={ + 'instance': os.environ['MODULE_ID'] + '-amld' + }, +) diff --git a/imageroot/api-moduled/handlers/change-password/post b/imageroot/api-moduled/handlers/change-password/post new file mode 100755 index 0000000..2046d0d --- /dev/null +++ b/imageroot/api-moduled/handlers/change-password/post @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 + +# +# Copyright (C) 2023 Nethesis S.r.l. +# SPDX-License-Identifier: GPL-3.0-or-later +# + +import json +import sys +import os +import agent +import subprocess + +from agent.ldapproxy import Ldapproxy +from agent.ldapclient import Ldapclient + +request = json.load(sys.stdin) + +odomain = Ldapproxy().get_domain(os.environ["LDAP_DOMAIN"]) + +oldapcli = Ldapclient.factory(**odomain) + +try: + ouser = oldapcli.get_user_entry(os.environ["JWT_ID"]) +except agent.ldapclient.exceptions.LdapclientEntryNotFound: + json.dump({"status": "failure", "message": "user_not_found"}, fp=sys.stdout) + sys.exit(0) + +oldapcli.ldapconn.unbind() # close LDAP connection FD + +# First attempt: try to change the password with simple bind, using the +# user's credentials +proc_lpasswd = subprocess.run(["podman", "exec", "-i", "openldap", + "ldappasswd", "-e", "ppolicy", "-S", "-W", "-E", "-x", "-D", ouser["dn"]], + input=request["current_password"] + "\n" + request["new_password"] + "\n" + request["new_password"] + "\n", + text=True, capture_output=True) + +if proc_lpasswd.returncode == 49 and "Password expired" in proc_lpasswd.stderr: + print(agent.SD_WARNING + f"User {os.environ['JWT_ID']} is changing their expired password", file=sys.stderr) + # Second attempt: use SASL EXTERNAL authentication to get admin + # privileges and work around the expired password bind error. As + # admins have ACL "write" permission on userPassword field, the + # password quality checks are still applied: + proc_lpasswd = subprocess.run(["podman", "exec", "-i", "openldap", + "ldappasswd", "-e", "ppolicy", "-T", "/dev/stdin", ouser["dn"]], + input=request["new_password"], text=True, capture_output=True) + +# Log the last command output: it might contain troubleshoot information! +print(proc_lpasswd.stdout, file=sys.stderr) + +if proc_lpasswd.returncode == 0: + json.dump({"status": "success", "message": "password_changed"}, fp=sys.stdout) +else: + json.dump({"status": "failure", "message": proc_lpasswd.stdout or f"ldap_error_{proc_lpasswd.returncode}"}, fp=sys.stdout) diff --git a/imageroot/api-moduled/handlers/change-password/validate-input.json b/imageroot/api-moduled/handlers/change-password/validate-input.json new file mode 100644 index 0000000..98ed9dd --- /dev/null +++ b/imageroot/api-moduled/handlers/change-password/validate-input.json @@ -0,0 +1,18 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "change-password input", + "$id": "http://schema.nethserver.org/ns8-openldap/api-moduled/handlers/change-password/validate-input.json", + "type": "object", + "required": [ + "current_password", + "new_password" + ], + "properties": { + "current_password": { + "type": "string" + }, + "new_password": { + "type": "string" + } + } +} \ No newline at end of file diff --git a/imageroot/api-moduled/handlers/change-password/validate-output.json b/imageroot/api-moduled/handlers/change-password/validate-output.json new file mode 100644 index 0000000..3806803 --- /dev/null +++ b/imageroot/api-moduled/handlers/change-password/validate-output.json @@ -0,0 +1,21 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "change-password output", + "$id": "http://schema.nethserver.org/ns8-openldap/api-moduled/handlers/change-password/validate-output.json", + "type": "object", + "required": [ + "status", + "message" + ], + "properties": { + "status": { + "enum": [ + "success", + "failure" + ] + }, + "message": { + "type": "string" + } + } +} diff --git a/imageroot/api-moduled/handlers/login/post b/imageroot/api-moduled/handlers/login/post new file mode 100755 index 0000000..65cae9e --- /dev/null +++ b/imageroot/api-moduled/handlers/login/post @@ -0,0 +1,45 @@ +#!/usr/bin/env python3 + +# +# Copyright (C) 2023 Nethesis S.r.l. +# SPDX-License-Identifier: GPL-3.0-or-later +# + +import json +import sys +import os +import agent +import subprocess + +from agent.ldapproxy import Ldapproxy +from agent.ldapclient import Ldapclient + +request = json.load(sys.stdin) + +odomain = Ldapproxy().get_domain(os.environ["LDAP_DOMAIN"]) + +oldapcli = Ldapclient.factory(**odomain) + +try: + user_dn = oldapcli.get_user_entry(request['username'])["dn"] + ouser = oldapcli.get_user(request['username']) +except agent.ldapclient.exceptions.LdapclientEntryNotFound: + sys.exit(2) # User not found + +proc_whoami = subprocess.run(["podman", "exec", "-i", "openldap", + "ldapwhoami", "-x", "-e", "ppolicy", "-D", user_dn, "-y", "/dev/stdin"], + input=request["password"], text=True, capture_output=True) + +oclaims = { + "uid": ouser["user"], + "groups": ouser["groups"], +} + +if proc_whoami.returncode == 49 and "Password expired" in proc_whoami.stderr: + # Password must be changed immediately: return a token limited to + # password changing: + oclaims["scope"] = ["change-password"] +elif proc_whoami.returncode != 0: + sys.exit(3) # Login failed + +json.dump(oclaims, fp=sys.stdout) diff --git a/imageroot/api-moduled/handlers/login/validate-input.json b/imageroot/api-moduled/handlers/login/validate-input.json new file mode 100644 index 0000000..83027d6 --- /dev/null +++ b/imageroot/api-moduled/handlers/login/validate-input.json @@ -0,0 +1,18 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "login input", + "$id": "http://schema.nethserver.org/ns8-openldap/api-moduled/handlers/login/validate-input.json", + "type": "object", + "required": [ + "username", + "password" + ], + "properties": { + "username": { + "type": "string" + }, + "password": { + "type": "string" + } + } +} diff --git a/imageroot/api-moduled/public/.gitignore b/imageroot/api-moduled/public/.gitignore new file mode 100644 index 0000000..e69de29 From 7d0d52ef19dfec6560ec982e4736bd3be510929d Mon Sep 17 00:00:00 2001 From: Davide Principi Date: Mon, 16 Oct 2023 19:49:28 +0200 Subject: [PATCH 2/2] Advertise "users-admin" service The users management portal can be discovered like other services and if its settings are added, or changed the `service-users-admin-changed` event is raised. --- README.md | 10 ++++++++ .../actions/configure-module/80start_amld | 23 +++++++++++++++++++ imageroot/actions/import-module/80start_amld | 1 + imageroot/actions/restore-module/80start_amld | 1 + 4 files changed, 35 insertions(+) mode change 100644 => 100755 imageroot/actions/configure-module/80start_amld create mode 120000 imageroot/actions/import-module/80start_amld create mode 120000 imageroot/actions/restore-module/80start_amld diff --git a/README.md b/README.md index 62e159e..590922a 100644 --- a/README.md +++ b/README.md @@ -95,6 +95,16 @@ For instance: https:///users-admin/domain.test/ +The backend endpoint is advertised as `users-admin` service and can be +discovered in the usual ways, as documented in [Service +discovery](https://nethserver.github.io/ns8-core/modules/service_providers/#service-discovery). +For instance: + + api-cli run module/mymodule1/list-service-providers --data '{"service":"users-admin", "filter":{"domain":"dp.nethserver.net","node":"1"}}' + +The event `service-users-admin-changed` is raised when the serivice +becomes available or is changed. + The backend of the module runs under the `api-moduled.service` Systemd unit supervision. Refer also to `api-moduled` documentation, provided by `ns8-core` repository. diff --git a/imageroot/actions/configure-module/80start_amld b/imageroot/actions/configure-module/80start_amld old mode 100644 new mode 100755 index ae8fbe3..69fba78 --- a/imageroot/actions/configure-module/80start_amld +++ b/imageroot/actions/configure-module/80start_amld @@ -11,7 +11,12 @@ import sys import os import string import secrets +import json +agent_id = os.environ['AGENT_ID'] +node_id = int(os.environ['NODE_ID']) +domain = os.environ['LDAP_DOMAIN'] +ip_address = os.environ['LDAP_IPADDR'] _, amld_port, _ = (os.environ['TCP_PORTS'] + ',,').split(",", 2) @@ -41,4 +46,22 @@ response = agent.tasks.run( }, ) +# Add the `users-admin` service discovery information, and advertise this +# new service instance: +rdb = agent.redis_connect(privileged=True) +trx = rdb.pipeline() +trx.delete(agent_id + '/srv/http/users-admin') +trx.hset(agent_id + '/srv/http/users-admin', mapping={ + "port": amld_port, + "url": f"http://{ip_address}:{amld_port}", + "domain": domain, + "node": node_id, +}) +trx.publish(agent_id + '/event/service-users-admin-changed', json.dumps({ + 'domain': domain, + 'node': node_id, + 'key': agent_id + '/srv/http/users-admin', +})) +trx.execute() + agent.run_helper("systemctl", "-T", "--user", "enable", "--now", "api-moduled.service") diff --git a/imageroot/actions/import-module/80start_amld b/imageroot/actions/import-module/80start_amld new file mode 120000 index 0000000..b7be522 --- /dev/null +++ b/imageroot/actions/import-module/80start_amld @@ -0,0 +1 @@ +../configure-module/80start_amld \ No newline at end of file diff --git a/imageroot/actions/restore-module/80start_amld b/imageroot/actions/restore-module/80start_amld new file mode 120000 index 0000000..b7be522 --- /dev/null +++ b/imageroot/actions/restore-module/80start_amld @@ -0,0 +1 @@ +../configure-module/80start_amld \ No newline at end of file