Proxmox/pve-apiclient
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-apiclient.git synced 2025-03-11 00:58:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix #2227: enable totp codes to be passed in cli

Browse Source 
this patch enables to pass totp codes during cluster join if tfa has
been enabled for root@pam (or any other user actually, but having it enabled on
root causes problems during cluster join).

u2f support is not yet implemented.

Co-developed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Co-developed-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
This commit is contained in:
Oguz Bektas 2019-08-16 13:51:34 +02:00 committed by Thomas Lamprecht
parent 6d06eacaaf
commit f195667216
1 changed files with 25 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
PVE/APIClient/LWP.pm
View File

@ -92,6 +92,23 @@ sub update_ticket {
$agent->default_header('Cookie', $cookie);
}
sub two_factor_auth_login {
my ($self, $type, $challenge) = @_;
if ($type eq 'PVE:tfa') {
raise("TFA-enabled login currently works only with a TTY.") if !-t STDIN;
print "\nEnter OTP code for user $self->{username}: ";
my $tfa_response = <STDIN>;
chomp $tfa_response;
return $self->post('/api2/json/access/tfa', {response => $tfa_response});
} elsif ($type eq 'PVE:u2f') {
# TODO: implement u2f-enabled join
raise("U2F-enabled login is currently not implemented.");
} else {
raise("Authentication type '$type' not recognized, aborting!");
}
}
sub login {
my ($self) = @_;
@ -129,15 +146,17 @@ sub login {
my $res = from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
my $data = $extract_data->($res);
# TODO: make it possible to use tfa
if ($data->{ticket} =~ m/^PVE:tfa!/) {
raise("Two Factor Auth is not yet implemented! Try disabling TFA for the user '$username'.\n");
}
$self->update_ticket($data->{ticket});
$self->update_csrftoken($data->{CSRFPreventionToken});
# handle two-factor login
my $tfa_ticket_re = qr/^([^\s!]+)![^!]*(!([0-9a-zA-Z\/.=_\-+]+))?$/;
if ($data->{ticket} =~ m/$tfa_ticket_re/) {
my ($type, $challenge) = ($1, $2);
$data = $self->two_factor_auth_login($type, $challenge);
$self->update_ticket($data->{ticket});
}
return $data;
}