This series adds XOAUTH2 support for SMTP notification targets, motivated by
Microsoft's
upcoming deprecation of basic authentication for SMTP [0]. Google and Microsoft
are supported as
OAuth2 providers.
OAuth2 refresh tokens may need to be rotated, therefore they are treated as
state, not config.
They are persisted in separate JSON files and managed entirely from the Rust
side. Each endpoint
has its own state file to avoid having to lock the entire file system everytime
a state update
is made.
The oauth2 crate is used with a local ureq backend (newtype over ureq::Agent).
oauth2's ureq
feature is currently patched out in Debian due to a ureq 2/3 version mismatch
(oauth2 still
depends on ureq 2.x, and Debian only packages 3.x).
Since tokens that are not used for extended periods of time may expire, token
refresh is triggered
proactively via pveupdate, additionally to every time a notification is sent,
to prevent
unused endpoints' tokens from expiring.
The UI part of the OAuth2 flow is made opt-in in order to allow adding it only
to PVE, and later
to PBS in a follow-up series.
This series requires the following version requirement bumps:
* pve-manager requires bumped proxmox-widget-toolkit and proxmox-perl-rs
* proxmox-perl-rs requires bumped proxmox-notify
Known issues:
- Microsoft OAuth2 support is untested (no test tenant, somehow impossible to
create a free test
account). It is implemented by following the Microsoft Entra ID docs, but
there might be something
I overlooked. I would highly appreciate it if someone was able to test it
with their account.
Changes since RFC:
proxmox-notify:
* Simplify state handling logic simplified by special-casing SMTP endpoints
instead of making it
generic
* Only pull oauth2 and ureq crates with the smtp feature
* Create state files in `/etc/pve/priv/notifications` subdirectory
* Create one state file per endpoint (as opposed to one for all) to avoid
races
* Fix TOCTOU errors by using `proxmox_sys::fs::file_get_optional_contents`
for IO
* Add logging and state-related error types
* Factor out SMTP transport building to its own function
pve-manager,proxmox-perl-rs:
* Pass SMTP endpoints configs as hash instead of flat list of parameters
pve-manager:
* Use `let` instead of `const` for JS variables
* Rename endpoint for triggering endpoint state refresh from
`refresh-targets` to
`trigger-state-refresh`
pve-docs:
* Add some more provider-related tips/warnings
* Explain what is meant by "manual intervention"
* Show how to add an XOAUTH2 SMTP endpoint via `pvesh`
[0]
https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835
[1]
https://git.proxmox.com/?p=debcargo-conf.git;a=blob;f=src/oauth2/debian/patches/disable-ureq.patch;h=828b883a83a86927c5cd32df055226a5e78e8bea;hb=refs/heads/proxmox/trixie
proxmox:
Arthur Bied-Charreton (7):
notify (smtp): Introduce xoauth2 module
notify (smtp): Introduce state module
notify (smtp): Factor out transport building logic into own function
notify (smtp): Update API with OAuth2 parameters
notify (smtp): Add state handling logic
notify (smtp): Add XOAUTH2 authentication support
notify (smtp): Add logging and state-related error types
proxmox-notify/Cargo.toml | 6 +-
proxmox-notify/debian/control | 14 +-
proxmox-notify/src/api/common.rs | 16 ++
proxmox-notify/src/api/smtp.rs | 120 ++++++++--
proxmox-notify/src/context/mod.rs | 6 +
proxmox-notify/src/context/pbs.rs | 8 +
proxmox-notify/src/context/pve.rs | 8 +
proxmox-notify/src/context/test.rs | 8 +
proxmox-notify/src/endpoints/smtp.rs | 237 +++++++++++++++++--
proxmox-notify/src/endpoints/smtp/state.rs | 76 ++++++
proxmox-notify/src/endpoints/smtp/xoauth2.rs | 167 +++++++++++++
proxmox-notify/src/lib.rs | 35 ++-
12 files changed, 649 insertions(+), 52 deletions(-)
create mode 100644 proxmox-notify/src/endpoints/smtp/state.rs
create mode 100644 proxmox-notify/src/endpoints/smtp/xoauth2.rs
proxmox-perl-rs:
Arthur Bied-Charreton (1):
notify (smtp): add oauth2 parameters to bindings
common/src/bindings/notify.rs | 82 ++++++++++++-----------------------
1 file changed, 28 insertions(+), 54 deletions(-)
proxmox-widget-toolkit:
Arthur Bied-Charreton (2):
utils: Add OAuth2 flow handlers
notifications: Add opt-in OAuth2 support for SMTP targets
src/Utils.js | 88 +++++++++++++++
src/panel/SmtpEditPanel.js | 200 +++++++++++++++++++++++++++++++--
src/window/EndpointEditBase.js | 1 +
3 files changed, 278 insertions(+), 11 deletions(-)
pve-manager:
Arthur Bied-Charreton (5):
notifications: Add OAuth2 parameters to schema and add/update
endpoints
notifications: Add trigger-state-refresh endpoint
notifications: Trigger notification target refresh in pveupdate
notifications: Handle OAuth2 callback in login handler
notifications: Opt into OAuth2 authentication
PVE/API2/Cluster/Notifications.pm | 144 +++++++++++++++++++++++++-----
bin/pveupdate | 9 ++
www/manager6/Utils.js | 10 +++
www/manager6/Workspace.js | 20 +++++
4 files changed, 160 insertions(+), 23 deletions(-)
pve-cluster:
Arthur Bied-Charreton (1):
notifications: Add refresh_targets subroutine to PVE::Notify
src/PVE/Notify.pm | 6 ++++++
1 file changed, 6 insertions(+)
pve-docs:
Arthur Bied-Charreton (1):
notifications: Add section about OAuth2 to SMTP targets docs
notifications.adoc | 99 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 99 insertions(+)
Summary over all repositories:
22 files changed, 1220 insertions(+), 140 deletions(-)
--
Generated by murpp 0.9.0
