tfa: when modifying others, verify the current user's password

[pve-access-control.git] / src / PVE / API2 / TFA.pm

diff --git a/src/PVE/API2/TFA.pm b/src/PVE/API2/TFA.pm
index 2fbc7a8483bf7c452f9d4121864fb401d9492b3a..31e57415169407c9bbc63f47af448c44724c21f1 100644 (file)
--- a/src/PVE/API2/TFA.pm
+++ b/src/PVE/API2/TFA.pm
@@ -3,6 +3,8 @@ package PVE::API2::TFA;
 use strict;
 use warnings;
 
+use HTTP::Status qw(:constants);
+
 use PVE::AccessControl;
 use PVE::Cluster qw(cfs_read_file cfs_write_file);
 use PVE::JSONSchema qw(get_standard_option);
@@ -99,7 +101,7 @@ my $TFA_UPDATE_INFO_SCHEMA = {
 my sub root_permission_check : prototype($$$$) {
     my ($rpcenv, $authuser, $userid, $password) = @_;
 
-    ($userid, my $ruid, my $realm) = PVE::AccessControl::verify_username($userid);
+    ($userid, undef, my $realm) = PVE::AccessControl::verify_username($userid);
     $rpcenv->check_user_exist($userid);
 
     raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam';
@@ -109,16 +111,46 @@ my sub root_permission_check : prototype($$$$) {
        raise_param_exc({ 'password' => 'password is required to modify TFA data' })
            if !defined($password);
 
+       ($authuser, my $auth_username, my $auth_realm) =
+           PVE::AccessControl::verify_username($authuser);
+
        my $domain_cfg = cfs_read_file('domains.cfg');
-       my $cfg = $domain_cfg->{ids}->{$realm};
-       die "auth domain '$realm' does not exist\n" if !$cfg;
+       my $cfg = $domain_cfg->{ids}->{$auth_realm};
+       die "auth domain '$auth_realm' does not exist\n" if !$cfg;
        my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
-       $plugin->authenticate_user($cfg, $realm, $ruid, $password);
+       $plugin->authenticate_user($cfg, $auth_realm, $auth_username, $password);
     }
 
     return wantarray ? ($userid, $realm) : $userid;
 }
 
+# Set TFA to enabled if $tfa_cfg is passed, or to disabled if $tfa_cfg is undef,
+# When enabling we also merge the old user.cfg keys into the $tfa_cfg.
+my sub set_user_tfa_enabled : prototype($$$) {
+    my ($userid, $realm, $tfa_cfg) = @_;
+
+    PVE::AccessControl::lock_user_config(sub {
+       my $user_cfg = cfs_read_file('user.cfg');
+       my $user = $user_cfg->{users}->{$userid};
+       my $keys = $user->{keys};
+       # When enabling, we convert old-old keys,
+       # When disabling, we shouldn't actually have old keys anymore, so if they are there,
+       # they'll be removed.
+       if ($tfa_cfg && $keys && $keys !~ /^x(?:!.*)?$/) {
+           my $domain_cfg = cfs_read_file('domains.cfg');
+           my $realm_cfg = $domain_cfg->{ids}->{$realm};
+           die "auth domain '$realm' does not exist\n" if !$realm_cfg;
+
+           my $realm_tfa = $realm_cfg->{tfa};
+           $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_tfa) if $realm_tfa;
+
+           PVE::AccessControl::add_old_keys_to_realm_tfa($userid, $tfa_cfg, $realm_tfa, $keys);
+       }
+       $user->{keys} = $tfa_cfg ? 'x' : undef;
+       cfs_write_file("user.cfg", $user_cfg);
+    }, "enabling TFA for the user failed");
+}
+
 ### OLD API
 
 __PACKAGE__->register_method({
@@ -156,6 +188,9 @@ __PACKAGE__->register_method({
        if (!defined($tfa_type)) {
            raise('no u2f data available');
        }
+       if ($tfa_type eq 'incompatible') {
+           raise('tfa entries incompatible with old login api');
+       }
 
        eval {
            if ($tfa_type eq 'u2f') {
@@ -253,7 +288,7 @@ __PACKAGE__->register_method ({
        my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
        my $id = $param->{id};
        my $entry = $tfa_cfg->api_get_tfa_entry($param->{userid}, $id);
-       raise("No such tfa entry '$id'", 404) if !$entry;
+       raise("No such tfa entry '$id'", code => HTTP::Status::HTTP_NOT_FOUND) if !$entry;
        return $entry;
     }});
 
@@ -291,11 +326,15 @@ __PACKAGE__->register_method ({
        my $userid =
            root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
 
-       return PVE::AccessControl::lock_tfa_config(sub {
+       my $has_entries_left = PVE::AccessControl::lock_tfa_config(sub {
            my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
-           $tfa_cfg->api_delete_tfa($userid, $param->{id});
+           my $has_entries_left = $tfa_cfg->api_delete_tfa($userid, $param->{id});
            cfs_write_file('priv/tfa.cfg', $tfa_cfg);
+           return $has_entries_left;
        });
+       if (!$has_entries_left) {
+           set_user_tfa_enabled($userid, undef, undef);
+       }
     }});
 
 __PACKAGE__->register_method ({
@@ -406,6 +445,9 @@ __PACKAGE__->register_method ({
 
        return PVE::AccessControl::lock_tfa_config(sub {
            my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
+
+           set_user_tfa_enabled($userid, $realm, $tfa_cfg);
+
            PVE::AccessControl::configure_u2f_and_wa($tfa_cfg);
 
            my $response = $tfa_cfg->api_add_tfa_entry(