implement api token support

[pve-apiclient.git] / PVE / APIClient / LWP.pm

diff --git a/PVE/APIClient/LWP.pm b/PVE/APIClient/LWP.pm
index 20e3b56621dee188ed4cd129b2b96f31deb8ef5a..c18210d88887907cdcbf57161a94bcfd5404e128 100755 (executable)
--- a/PVE/APIClient/LWP.pm
+++ b/PVE/APIClient/LWP.pm
@@ -92,6 +92,23 @@ sub update_ticket {
     $agent->default_header('Cookie', $cookie);
 }
 
+sub two_factor_auth_login {
+    my ($self, $type, $challenge) = @_;
+
+    if ($type eq 'PVE:tfa') {
+       raise("TFA-enabled login currently works only with a TTY.") if !-t STDIN;
+       print "\nEnter OTP code for user $self->{username}: ";
+       my $tfa_response = <STDIN>;
+       chomp $tfa_response;
+       return $self->post('/api2/json/access/tfa', {response => $tfa_response});
+    } elsif ($type eq 'PVE:u2f') {
+       # TODO: implement u2f-enabled join
+       raise("U2F-enabled login is currently not implemented.");
+    } else {
+       raise("Authentication type '$type' not recognized, aborting!");
+    }
+}
+
 sub login {
     my ($self) = @_;
 
@@ -102,12 +119,13 @@ sub login {
     $uri->path('/api2/json/access/ticket');
 
     my $ua = $self->{useragent};
+    my $username = $self->{username} // 'unknown',
 
     delete $self->{last_unknown_fingerprint};
 
     my $exec_login = sub {
        return $ua->post($uri, {
-           username => $self->{username} || 'unknown',
+           username => $username,
            password => $self->{password} || ''});
     };
 
@@ -128,10 +146,17 @@ sub login {
     my $res = from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
 
     my $data = $extract_data->($res);
-
     $self->update_ticket($data->{ticket});
     $self->update_csrftoken($data->{CSRFPreventionToken});
 
+    # handle two-factor login
+    my $tfa_ticket_re = qr/^([^\s!]+)![^!]*(!([0-9a-zA-Z\/.=_\-+]+))?$/;
+    if ($data->{ticket} =~ m/$tfa_ticket_re/) {
+       my ($type, $challenge) = ($1, $2);
+       $data = $self->two_factor_auth_login($type, $challenge);
+       $self->update_ticket($data->{ticket});
+    }
+
     return $data;
 }
 
@@ -146,7 +171,7 @@ sub manual_verify_fingerprint {
        "X509 SHA256 key fingerprint is $fingerprint.\n" .
        "Are you sure you want to continue connecting (yes/no)? ";
 
-    my $answer = <>;
+    my $answer = <STDIN>;
 
     my $valid = ($answer =~ m/^\s*yes\s*$/i) ? 1 : 0;
 
@@ -167,12 +192,13 @@ sub call {
     delete $self->{last_unknown_fingerprint};
 
     my $ticket = $self->{ticket};
+    my $apitoken = $self->{apitoken};
 
     my $ua = $self->{useragent};
 
     # fixme: check ticket lifetime?
 
-    if (!$ticket && $self->{username} && $self->{password}) {
+    if (!$ticket && !$apitoken && $self->{username} && $self->{password}) {
        $self->login();
     }
 
@@ -321,9 +347,26 @@ sub new {
 
     $self->{useragent}->default_header('Accept-Encoding' => 'gzip'); # allow gzip
 
-    $self->update_ticket($param{ticket}) if $param{ticket};
+    if ($param{apitoken} && $param{password}) {
+       warn "password will be ignored in favor of API token\n";
+       delete $self->{password};
+    }
+    if ($param{ticket}) {
+       if ($param{apitoken}) {
+           warn "ticket will be ignored in favor of API token\n";
+       } else {
+           $self->update_ticket($param{ticket});
+       }
+    }
     $self->update_csrftoken($param{csrftoken}) if $param{csrftoken};
 
+    if ($param{apitoken}) {
+       my $agent = $self->{useragent};
+
+       $self->{apitoken} = $param{apitoken};
+
+       $agent->default_header('Authorization', $param{apitoken});
+    }
 
     return $self;
 }