tets (6756a8bf) · Commits · tuxist / authdb

data/admin.html

+43 −0

Changes for data/admin.html: 43 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -63,6 +63,7 @@
		<li id="nav-domains" style="display:none"><a href="#" onclick="loadDomains(); return false;">Domains</a></li>
		<li id="nav-users" style="display:none"><a href="#" onclick="loadUsers(); return false;">Users</a></li>
		<li id="nav-groups" style="display:none"><a href="#" onclick="loadGroups(); return false;">Groups</a></li>
		<li id="nav-computers" style="display:none"><a href="#" onclick="loadComputers(); return false;">Computers</a></li>
		<li id="nav-clients"><a href="#" onclick="loadClients(); return false;">Clients</a></li>
		<li id="nav-services" style="display:none"><a href="#" onclick="loadServices(); return false;">Services</a></li>
		<li id="nav-gpos"><a href="#" onclick="loadGpos(); return false;">Policies</a></li>
		@@ -342,6 +343,8 @@ function editUserForm(uid) {
		html += '<td><input type="text" name="' + f.name + '" value="' + (f.value \|\| '') + '"></td></tr>';
		}
		}
		html += '<tr><td><label>Windows Login:</label></td><td><input type="checkbox" id="eu_windowslogin"' + (data.windowslogin ? ' checked' : '') + '> <span class="hint">An: Konto wird Windows-Konto (vergibt SID + Kerberos, Passwort nötig). Aus: zurück zu Web-only.</span></td></tr>';
		html += '<tr><td><label>Passwort:</label></td><td><input type="password" name="pwhash" id="eu_password" placeholder="nur zum Aktivieren von Windows Login / Passwortwechsel"></td></tr>';
		html += '<tr><td><label>ProfilBild:</label></td><td><input type="file" name="avatar" id="eu_avatar"></td></tr>';
		html += '<tr><td></td><td><input type="button" value="Save" onclick="submitEditUser(\'' + uid + '\')"></td></tr>';
		html += '</table></form>';
		@@ -352,12 +355,50 @@ function editUserForm(uid) {
		function submitEditUser(uid) {
		var form = document.getElementById("edituserform");
		var formData = new FormData(form);
		/* always send the desired Windows-login state so it can be toggled off too */
		formData.append("windowslogin", document.getElementById("eu_windowslogin").checked ? "1" : "0");
		ajaxPostMultipart("/settings/" + currentDomain + "/api/edituser/" + uid, formData, function(err, data) {
		if (err) { showError(err); return; }
		loadUsers();
		});
		}

		/* ---- Computers (AD machine accounts) ---- */
		function loadComputers() {
		currentView = loadComputers;
		setActiveNav('nav-computers');
		loadDomainSelector(function() {
		ajaxGet("/settings/" + currentDomain + "/api/listcomputers", function(err, data) {
		if (err) { showError(err); return; }
		var html = '<h3>Computers</h3>';
		html += '<p class="hint">Computer-Konten gejointer Windows-Maschinen. Löschen gibt den Namen frei — die Maschine kann danach neu joinen (Domain Rejoin).</p>';
		html += '<table class="admin-table userlist">';
		html += '<tr><th>Name</th><th>DNS-Hostname</th><th>Actions</th></tr>';
		var comps = data.computers \|\| [];
		for (var i = 0; i < comps.length; i++) {
		var c = comps[i];
		html += '<tr>';
		html += '<td>' + c.name + '</td>';
		html += '<td>' + (c.dnshostname \|\| '') + '</td>';
		html += '<td><ul><li><a class="button danger" href="#" onclick="removeComputer(\'' + c.id + '\'); return false;">Remove</a></li></ul></td>';
		html += '</tr>';
		}
		if (comps.length === 0)
		html += '<tr><td colspan="3"><em>keine Computer-Konten</em></td></tr>';
		html += '</table>';
		setContent(html);
		});
		});
		}

		function removeComputer(cid) {
		if (!confirm("Computer-Konto löschen? Die Maschine muss danach neu joinen.")) return;
		ajaxDelete("/settings/" + currentDomain + "/api/removecomputer/" + cid, function(err, data) {
		if (err) { showError(err); return; }
		loadComputers();
		});
		}

		/* ---- Domains ---- */
		var g_backendType = 0;

		@@ -1308,6 +1349,8 @@ window.onload = function() {
		document.getElementById('nav-users').style.display = '';
		if (data.superadmin \|\| gpo[GPO_MANAGE_GROUPS])
		document.getElementById('nav-groups').style.display = '';
		if (data.superadmin \|\| gpo[GPO_MANAGE_USERS])
		document.getElementById('nav-computers').style.display = '';
		if (data.superadmin \|\| gpo[GPO_MANAGE_SERVICES])
		document.getElementById('nav-services').style.display = '';
		if (data.superadmin \|\| gpo[GPO_EXPORT_IMPORT])

src/admin.cpp

+24 −0

Changes for src/admin.cpp: 24 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -485,6 +485,7 @@ namespace fenrirds {

		dsdb::AttrMap attrs;
		std::string pw;
		int wantWin = -1; /* -1 = unchanged, 0 = off, 1 = on */
		for (const auto &fd : curform.multipartData()) {
		if (fd.value.empty()) continue;
		std::string name;
		@@ -506,6 +507,7 @@ namespace fenrirds {
		else if (name == "description") attrs["description"] = {val};
		else if (name == "userprincipalname") attrs["userPrincipalName"] = {val};
		else if (name == "pwhash") { if (!val.empty()) pw = val; }
		else if (name == "windowslogin") wantWin = (val == "1" \|\| val == "true" \|\| val == "on") ? 1 : 0;
		else if (name == "avatar" && isFile) attrs["thumbnailPhoto"] = {val};
		}

		@@ -513,6 +515,20 @@ namespace fenrirds {
		if (!g_AdPlugin->dirModify(domain, uid, attrs, pw, err))
		throw AuthBackendError("editUser: " + err);

		/* toggle Windows login on/off if the checkbox state changed */
		if (wantWin >= 0) {
		dsdb::Entry cur;
		std::string e2;
		bool hasSid = g_AdPlugin->dirGet(domain, uid, cur, e2) && !cur.objectSid.empty();
		if (wantWin == 1 && !hasSid) {
		if (!g_AdPlugin->dirSetWindowsLogin(domain, uid, true, pw, e2))
		throw AuthBackendError("enable Windows login: " + e2);
		} else if (wantWin == 0 && hasSid) {
		if (!g_AdPlugin->dirSetWindowsLogin(domain, uid, false, "", e2))
		throw AuthBackendError("disable Windows login: " + e2);
		}
		}

		json_object *jobj = json_object_new_object();
		json_object_object_add(jobj, "status", json_object_new_string("ok"));
		sendJson(curreq, jobj);
		@@ -2533,6 +2549,14 @@ namespace fenrirds {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiEditUser(curreq, domain, param);
		} else if (strcmp(apiurl, "listcomputers") == 0) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiListComputers(curreq, domain);
		} else if (strcmp(apiurl, "removecomputer") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		checkGPO(sdat, "a1b2c3d4-452e-11f0-b1cc-1a2b3c4d5e02");
		apiRemoveComputer(curreq, domain, param);
		} else if (strcmp(apiurl, "listdomains") == 0) {
		apiListDomains(curreq);
		} else if (strcmp(apiurl, "checkpermissions") == 0) {