X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=blobdiff_plain;f=PVE%2FAPI2%2FAccessControl.pm;h=fee774a07c666ac6eaac5452ce00e8cb1fe94af1;hp=5e132920cdedf197728a22133a4413d3a0788ecb;hb=63358f40b36266a1d9df2fbb8477935d16b5f1c5;hpb=39e4e3634865021204477e20892d711856b7babc

diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index 5e13292..fee774a 100644
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -88,7 +88,7 @@ __PACKAGE__->register_method ({
 
 
 my $verify_auth = sub {
-    my ($rpcenv, $username, $pw_or_ticket, $path, $privs) = @_;
+    my ($rpcenv, $username, $pw_or_ticket, $otp, $path, $privs) = @_;
 
     my $normpath = PVE::AccessControl::normalize_path($path);
 
@@ -99,7 +99,7 @@ my $verify_auth = sub {
     } elsif (PVE::AccessControl::verify_vnc_ticket($pw_or_ticket, $username, $normpath, 1)) {
 	# valid vnc ticket
     } else {
-	$username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket);
+	$username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
     }
 
     my $privlist = [ PVE::Tools::split_list($privs) ];
@@ -111,14 +111,14 @@ my $verify_auth = sub {
 };
 
 my $create_ticket = sub {
-    my ($rpcenv, $username, $pw_or_ticket) = @_;
+    my ($rpcenv, $username, $pw_or_ticket, $otp) = @_;
 
     my $ticketuser;
     if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) &&
 	($ticketuser eq 'root@pam' || $ticketuser eq $username)) {
 	# valid ticket. Note: root@pam can create tickets for other users
     } else {
-	$username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket);
+	$username = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
     }
 
     my $ticket = PVE::AccessControl::assemble_ticket($username);
@@ -235,14 +235,22 @@ __PACKAGE__->register_method ({
 		description => "User name",
 		type => 'string',
 		maxLength => 64,
+		completion => \&PVE::AccessControl::complete_username,
 	    },
 	    realm =>  get_standard_option('realm', {
 		description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.",
-		optional => 1}),
+		optional => 1,
+		completion => \&PVE::AccessControl::complete_realm,
+	    }),
 	    password => { 
 		description => "The secret password. This can also be a valid ticket.",
 		type => 'string',
 	    },
+	    otp => {
+		description => "One-time password for Two-factor authentication.",
+		type => 'string',
+		optional => 1,
+	    },
 	    path => {
 		description => "Verify ticket, and check if user have access 'privs' on 'path'",
 		type => 'string',
@@ -281,10 +289,10 @@ __PACKAGE__->register_method ({
 	    $rpcenv->check_user_enabled($username);
 
 	    if ($param->{path} && $param->{privs}) {
-		$res = &$verify_auth($rpcenv, $username, $param->{password},
+		$res = &$verify_auth($rpcenv, $username, $param->{password}, $param->{otp},
 				     $param->{path}, $param->{privs});
 	    } else {
-		$res = &$create_ticket($rpcenv, $username, $param->{password});
+		$res = &$create_ticket($rpcenv, $username, $param->{password}, $param->{otp});
 	    }
 	};
 	if (my $err = $@) {
@@ -320,7 +328,9 @@ __PACKAGE__->register_method ({
     parameters => {
 	additionalProperties => 0,
 	properties => {
-	    userid => get_standard_option('userid'),
+	    userid => get_standard_option('userid', {
+		completion => \&PVE::AccessControl::complete_username,
+	    }),
 	    password => { 
 		description => "The new password.",
 		type => 'string',