typo fixup

[pve-access-control.git] / PVE / AccessControl.pm

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index 0c59334e9075598dfe259d9f5e45378434a71340..06c649d2e4ddaa2ed006bdedf5d31f88053ccea4 100644 (file)
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -308,10 +308,10 @@ sub verify_ticket {
        return $auth_failure->();
     }
 
-    my ($username, $challenge);
+    my ($username, $tfa_info);
     if ($data =~ m{^u2f!([^!]+)!([0-9a-zA-Z/.=_\-+]+)$}) {
        # Ticket for u2f-users:
-       ($username, $challenge) = ($1, $2);
+       ($username, my $challenge) = ($1, $2);
        if ($challenge eq 'verified') {
            # u2f challenge was completed
            $challenge = undef;
@@ -320,6 +320,15 @@ sub verify_ticket {
            # so we treat this ticket as invalid:
            return $auth_failure->();
        }
+       $tfa_info = {
+           type => 'u2f',
+           challenge => $challenge,
+       };
+    } elsif ($data =~ /^tfa!(.*)$/) {
+       # TOTP and Yubico don't require a challenge so this is the generic
+       # 'missing 2nd factor ticket'
+       $username = $1;
+       $tfa_info = { type => 'tfa' };
     } else {
        # Regular ticket (full access)
        $username = $data;
@@ -327,7 +336,7 @@ sub verify_ticket {
 
     return undef if !PVE::Auth::Plugin::verify_username($username, $noerr);
 
-    return wantarray ? ($username, $age, $challenge) : $username;
+    return wantarray ? ($username, $age, $tfa_info) : $username;
 }
 
 # VNC tickets
@@ -515,22 +524,32 @@ sub authenticate_user {
     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
     $plugin->authenticate_user($cfg, $realm, $ruid, $password);
 
-    my $u2f;
-
     my ($type, $tfa_data) = user_get_tfa($username, $realm);
     if ($type) {
        if ($type eq 'u2f') {
            # Note that if the user did not manage to complete the initial u2f registration
            # challenge we have a hash containing a 'challenge' entry in the user's tfa.cfg entry:
-           $u2f = $tfa_data if !exists $tfa_data->{challenge};
+           $tfa_data = undef if exists $tfa_data->{challenge};
+       } elsif (!defined($otp)) {
+           # The user requires a 2nd factor but has not provided one. Return success but
+           # don't clear $tfa_data.
        } else {
            my $keys = $tfa_data->{keys};
            my $tfa_cfg = $tfa_data->{config};
            verify_one_time_pw($type, $username, $keys, $tfa_cfg, $otp);
+           $tfa_data = undef;
+       }
+
+       # Return the type along with the rest:
+       if ($tfa_data) {
+           $tfa_data = {
+               type => $type,
+               data => $tfa_data,
+           };
        }
     }
 
-    return wantarray ? ($username, $u2f) : $username;
+    return wantarray ? ($username, $tfa_data) : $username;
 }
 
 sub domain_set_password {
@@ -1354,7 +1373,7 @@ sub remove_vm_from_pool {
     lock_user_config($delVMfromPoolFn, "pool cleanup for VM $vmid failed");
 }
 
-my $CUSTOM_TFA_TYPES = {
+my $USER_CONTROLLED_TFA_TYPES = {
     u2f => 1,
     oath => 1,
 };
@@ -1401,7 +1420,7 @@ sub user_set_tfa {
        # The 'yubico' type requires yubico server settings, which have to be configured on the
        # realm, so this is not supported here:
        die "domain '$realm' does not support TFA type '$type'\n"
-           if defined($data) && !$CUSTOM_TFA_TYPES->{$type};
+           if defined($data) && !$USER_CONTROLLED_TFA_TYPES->{$type};
     }
 
     # Custom TFA entries are stored in priv/tfa.cfg as they can be more complet: u2f uses a
@@ -1415,7 +1434,7 @@ sub user_set_tfa {
        $tfa->{data} = $data;
        cfs_write_file('priv/tfa.cfg', $tfa_cfg);
 
-       $user->{keys} = 'x';
+       $user->{keys} = "x!$type";
     } else {
        delete $tfa_cfg->{users}->{$userid};
        cfs_write_file('priv/tfa.cfg', $tfa_cfg);
@@ -1444,7 +1463,8 @@ sub user_get_tfa {
     $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_tfa)
        if $realm_tfa;
 
-    if ($keys ne 'x') {
+    # new style config starts with an 'x' and optionally contains a !<type> suffix
+    if ($keys !~ /^x(?:!.*)?$/) {
        # old style config, find the type via the realm
        return if !$realm_tfa;
        return ($realm_tfa->{type}, {