use PVE::API2::Group;
use PVE::API2::Role;
use PVE::API2::ACL;
+use PVE::OTP;
+use PVE::Tools;
my $u2f_available = 0;
eval {
my $create_ticket = sub {
my ($rpcenv, $username, $pw_or_ticket, $otp) = @_;
- my $ticketuser;
+ my ($ticketuser, $u2fdata);
if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) &&
($ticketuser eq 'root@pam' || $ticketuser eq $username)) {
# valid ticket. Note: root@pam can create tickets for other users
} else {
- $username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
+ ($username, $u2fdata) = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
+ }
+
+ my %extra;
+ my $ticket_data = $username;
+ if (defined($u2fdata)) {
+ my $u2f = get_u2f_instance($rpcenv, $u2fdata->@{qw(publicKey keyHandle)});
+ my $challenge = $u2f->auth_challenge()
+ or die "failed to get u2f challenge\n";
+ $challenge = decode_json($challenge);
+ $extra{U2FChallenge} = $challenge;
+ $ticket_data = "u2f!$username!$challenge->{challenge}";
}
- my $ticket = PVE::AccessControl::assemble_ticket($username);
+ my $ticket = PVE::AccessControl::assemble_ticket($ticket_data);
my $csrftoken = PVE::AccessControl::assemble_csrf_prevention_token($username);
return {
ticket => $ticket,
username => $username,
CSRFPreventionToken => $csrftoken,
+ %extra,
};
};
ticket => { type => 'string', optional => 1},
CSRFPreventionToken => { type => 'string', optional => 1 },
clustername => { type => 'string', optional => 1 },
+ # cap => computed api permissions, unless there's a u2f challenge
}
},
code => sub {
die PVE::Exception->new("authentication failure\n", code => 401);
}
- $res->{cap} = &$compute_api_permission($rpcenv, $username);
+ $res->{cap} = &$compute_api_permission($rpcenv, $username)
+ if !defined($res->{U2FChallenge});
if (PVE::Corosync::check_conf_exists(1)) {
if ($rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
return $u2f;
}
+sub verify_user_tfa_config {
+ my ($type, $tfa_cfg, $value) = @_;
+
+ if (!defined($type)) {
+ die "missing tfa 'type'\n";
+ }
+
+ if ($type ne 'oath') {
+ die "invalid type for custom tfa authentication\n";
+ }
+
+ my $secret = $tfa_cfg->{keys}
+ or die "missing TOTP secret\n";
+ $tfa_cfg = $tfa_cfg->{config};
+ # Copy the hash to verify that we have no unexpected keys without modifying the original hash.
+ $tfa_cfg = {%$tfa_cfg};
+
+ # We can only verify 1 secret but oath_verify_otp allows multiple:
+ if (scalar(PVE::Tools::split_list($secret)) != 1) {
+ die "only exactly one secret key allowed\n";
+ }
+
+ my $digits = delete($tfa_cfg->{digits}) // 6;
+ my $step = delete($tfa_cfg->{step}) // 30;
+ # Maybe also this?
+ # my $algorithm = delete($tfa_cfg->{algorithm}) // 'sha1';
+
+ if (length(my $more = join(', ', keys %$tfa_cfg))) {
+ die "unexpected tfa config keys: $more\n";
+ }
+
+ PVE::OTP::oath_verify_otp($value, $secret, $step, $digits);
+}
+
__PACKAGE__->register_method ({
name => 'change_tfa',
path => 'tfa',
method => 'PUT',
permissions => {
- description => 'A user can change their own u2f token.',
+ description => 'A user can change their own u2f or totp token.',
check => [ 'or',
['userid-param', 'self'],
[ 'and',
},
response => {
optional => 1,
- description => 'The response to the current registration challenge.',
+ description =>
+ 'Either the the response to the current u2f registration challenge,'
+ .' or, when adding TOTP, the currently valid TOTP value.',
type => 'string',
},
+ key => {
+ optional => 1,
+ description => 'When adding TOTP, the shared secret value.',
+ type => 'string',
+ # This is what pve-common's PVE::OTP::oath_verify_otp accepts.
+ # Should we move this to pve-common's JSONSchema as a named format?
+ pattern => qr/[A-Z2-7=]{16}|[A-Fa-f0-9]{40}/,
+ },
+ config => {
+ optional => 1,
+ description => 'A TFA configuration. This must currently be of type TOTP of not set at all.',
+ type => 'string',
+ format => 'pve-tfa-config',
+ maxLength => 128,
+ },
}
},
returns => { type => 'object' },
my $action = delete $param->{action};
my $response = delete $param->{response};
my $password = delete($param->{password}) // '';
+ my $key = delete($param->{key});
+ my $config = delete($param->{config});
my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
$rpcenv->check_user_exist($userid);
PVE::AccessControl::user_set_tfa($userid, $realm, undef, undef);
PVE::Cluster::log_msg('info', $authuser, "deleted u2f data for user '$userid'");
} elsif ($action eq 'new') {
- my $u2f = get_u2f_instance($rpcenv);
- my $challenge = $u2f->registration_challenge()
- or raise("failed to get u2f challenge");
- $challenge = decode_json($challenge);
- PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', $challenge);
- return $challenge;
+ if (defined($config)) {
+ $config = PVE::Auth::Plugin::parse_tfa_config($config);
+ my $type = delete($config->{type});
+ my $tfa_cfg = {
+ keys => $key,
+ config => $config,
+ };
+ verify_user_tfa_config($type, $tfa_cfg, $response);
+ PVE::AccessControl::user_set_tfa($userid, $realm, $type, $tfa_cfg);
+ } else {
+ # The default is U2F:
+ my $u2f = get_u2f_instance($rpcenv);
+ my $challenge = $u2f->registration_challenge()
+ or raise("failed to get u2f challenge");
+ $challenge = decode_json($challenge);
+ PVE::AccessControl::user_set_tfa($userid, $realm, 'u2f', $challenge);
+ return $challenge;
+ }
} elsif ($action eq 'confirm') {
raise_param_exc('response' => "confirm action requires the 'response' parameter to be set")
if !defined($response);
projects / pve-access-control.git / blobdiff