[pve-devel] [PATCH access-control] api: Prevent TFA from being set up for openid users

[pve-devel] [PATCH access-control] api: Prevent TFA from being set up for openid users

[Markus Frank]

Currently it is possible to set up TFA for an OpenID user (as root user),
but it is never requested during the login process for that user.
This patch prevents this and displays an error message with the instruction
to set up TFA using the OpenId server.

Signed-off-by: Markus Frank <m.frank@proxmox.com>
---
 src/PVE/API2/TFA.pm | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/PVE/API2/TFA.pm b/src/PVE/API2/TFA.pm
index 13ffc59..5e7e9eb 100644
--- a/src/PVE/API2/TFA.pm
+++ b/src/PVE/API2/TFA.pm
@@ -381,6 +381,13 @@ __PACKAGE__->register_method ({
 	my ($userid, $realm) =
 	    root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
 
+	my $domain_cfg = cfs_read_file('domains.cfg');
+	my $realm_cfg = $domain_cfg->{ids}->{$realm};
+	if ($realm_cfg->{type} eq "openid") {
+	    die "Users of the realm '$realm' with type 'openid' cannot use TFA."
+		." Using the OpenID server to set up TFA is recommended.\n";
+	}
+
 	my $type = delete $param->{type};
 	my $value = delete $param->{value};
 	if ($type eq 'yubico') {
-- 
2.39.2

Re: [pve-devel] [PATCH access-control] api: Prevent TFA from being set up for openid users

[Fabian Grünbichler]

doesn't apply anymore!

On March 13, 2024 2:18 pm, Markus Frank wrote:
> Currently it is possible to set up TFA for an OpenID user (as root user),
> but it is never requested during the login process for that user.
> This patch prevents this and displays an error message with the instruction
> to set up TFA using the OpenId server.
> 
> Signed-off-by: Markus Frank <m.frank@proxmox.com>
> ---
>  src/PVE/API2/TFA.pm | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/src/PVE/API2/TFA.pm b/src/PVE/API2/TFA.pm
> index 13ffc59..5e7e9eb 100644
> --- a/src/PVE/API2/TFA.pm
> +++ b/src/PVE/API2/TFA.pm
> @@ -381,6 +381,13 @@ __PACKAGE__->register_method ({
>  	my ($userid, $realm) =
>  	    root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
>  
> +	my $domain_cfg = cfs_read_file('domains.cfg');
> +	my $realm_cfg = $domain_cfg->{ids}->{$realm};
> +	if ($realm_cfg->{type} eq "openid") {
> +	    die "Users of the realm '$realm' with type 'openid' cannot use TFA."
> +		." Using the OpenID server to set up TFA is recommended.\n";
> +	}
> +
>  	my $type = delete $param->{type};
>  	my $value = delete $param->{value};
>  	if ($type eq 'yubico') {
> -- 
> 2.39.2
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 
> 


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel