[pve-devel] [PATCH access-control] verify_ticket: make tfa return info a hash
Wolfgang Bumiller
w.bumiller at proxmox.com
Mon Apr 8 13:58:27 CEST 2019
Signed-off-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
---
PVE/API2/AccessControl.pm | 71 ++++++++++++++++++++++++++++-------------------
PVE/AccessControl.pm | 33 +++++++++++++++++-----
2 files changed, 69 insertions(+), 35 deletions(-)
diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index f336696..2caa4af 100644
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -125,23 +125,32 @@ my $verify_auth = sub {
my $create_ticket = sub {
my ($rpcenv, $username, $pw_or_ticket, $otp) = @_;
- my ($ticketuser, $u2fdata);
- if (($ticketuser = PVE::AccessControl::verify_ticket($pw_or_ticket, 1)) &&
- ($ticketuser eq 'root at pam' || $ticketuser eq $username)) {
+ my ($ticketuser, undef, $tfa_info) = PVE::AccessControl::verify_ticket($pw_or_ticket, 1);
+ if (defined($ticketuser) && ($ticketuser eq 'root at pam' || $ticketuser eq $username)) {
+ if (defined($tfa_info)) {
+ die "incomplete ticket\n";
+ }
# valid ticket. Note: root at pam can create tickets for other users
} else {
- ($username, $u2fdata) = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
+ ($username, $tfa_info) = PVE::AccessControl::authenticate_user($username, $pw_or_ticket, $otp);
}
my %extra;
my $ticket_data = $username;
- if (defined($u2fdata)) {
- my $u2f = get_u2f_instance($rpcenv, $u2fdata->@{qw(publicKey keyHandle)});
- my $challenge = $u2f->auth_challenge()
- or die "failed to get u2f challenge\n";
- $challenge = decode_json($challenge);
- $extra{U2FChallenge} = $challenge;
- $ticket_data = "u2f!$username!$challenge->{challenge}";
+ if (defined($tfa_info)) {
+ $extra{NeedTFA} = 1;
+ if ($tfa_info->{type} eq 'u2f') {
+ my $u2finfo = $tfa_info->{data};
+ my $u2f = get_u2f_instance($rpcenv, $u2finfo->@{qw(publicKey keyHandle)});
+ my $challenge = $u2f->auth_challenge()
+ or die "failed to get u2f challenge\n";
+ $challenge = decode_json($challenge);
+ $extra{U2FChallenge} = $challenge;
+ $ticket_data = "u2f!$username!$challenge->{challenge}";
+ } else {
+ # General half-login / 'missing 2nd factor' ticket:
+ $ticket_data = "tfa!$username";
+ }
}
my $ticket = PVE::AccessControl::assemble_ticket($ticket_data);
@@ -302,7 +311,7 @@ __PACKAGE__->register_method ({
}
$res->{cap} = &$compute_api_permission($rpcenv, $username)
- if !defined($res->{U2FChallenge});
+ if !defined($res->{NeedTFA});
if (PVE::Corosync::check_conf_exists(1)) {
if ($rpcenv->check($username, '/', ['Sys.Audit'], 1)) {
@@ -616,27 +625,35 @@ __PACKAGE__->register_method({
my ($param) = @_;
my $rpcenv = PVE::RPCEnvironment::get();
- my $challenge = $rpcenv->get_u2f_challenge()
- or raise('no active challenge');
my $authuser = $rpcenv->get_user();
my ($username, undef, $realm) = PVE::AccessControl::verify_username($authuser);
- my ($tfa_type, $u2fdata) = PVE::AccessControl::user_get_tfa($username, $realm);
- if (!defined($tfa_type) || $tfa_type ne 'u2f') {
+ my ($tfa_type, $tfa_data) = PVE::AccessControl::user_get_tfa($username, $realm);
+ if (!defined($tfa_type)) {
raise('no u2f data available');
}
- my $keyHandle = $u2fdata->{keyHandle};
- my $publicKey = $u2fdata->{publicKey};
- raise("incomplete u2f setup")
- if !defined($keyHandle) || !defined($publicKey);
+ eval {
+ if ($tfa_type eq 'u2f') {
+ my $challenge = $rpcenv->get_u2f_challenge()
+ or raise('no active challenge');
- my $u2f = get_u2f_instance($rpcenv, $publicKey, $keyHandle);
- $u2f->set_challenge($challenge);
+ my $keyHandle = $tfa_data->{keyHandle};
+ my $publicKey = $tfa_data->{publicKey};
+ raise("incomplete u2f setup")
+ if !defined($keyHandle) || !defined($publicKey);
- eval {
- my ($counter, $present) = $u2f->auth_verify($param->{response});
- # Do we want to do anything with these?
+ my $u2f = get_u2f_instance($rpcenv, $publicKey, $keyHandle);
+ $u2f->set_challenge($challenge);
+
+ my ($counter, $present) = $u2f->auth_verify($param->{response});
+ # Do we want to do anything with these?
+ } else {
+ # sanity check before handing off to the verification code:
+ my $keys = $tfa_data->{keys} or die "missing tfa keys\n";
+ my $config = $tfa_data->{config} or die "bad tfa entry\n";
+ PVE::AccessControl::verify_one_time_pw($tfa_type, $authuser, $keys, $config, $param->{response});
+ }
};
if (my $err = $@) {
my $clientip = $rpcenv->get_client_ip() || '';
@@ -644,10 +661,8 @@ __PACKAGE__->register_method({
die PVE::Exception->new("authentication failure\n", code => 401);
}
- # create a new ticket for the user:
- my $ticket_data = "u2f!$authuser!verified";
return {
- ticket => PVE::AccessControl::assemble_ticket($ticket_data),
+ ticket => PVE::AccessControl::assemble_ticket($authuser),
cap => &$compute_api_permission($rpcenv, $authuser),
}
}});
diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index af1bd6a..bec962f 100644
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -308,10 +308,10 @@ sub verify_ticket {
return $auth_failure->();
}
- my ($username, $challenge);
+ my ($username, $tfa_info);
if ($data =~ m{^u2f!([^!]+)!([0-9a-zA-Z/.=_\-+]+)$}) {
# Ticket for u2f-users:
- ($username, $challenge) = ($1, $2);
+ ($username, my $challenge) = ($1, $2);
if ($challenge eq 'verified') {
# u2f challenge was completed
$challenge = undef;
@@ -320,6 +320,15 @@ sub verify_ticket {
# so we treat this ticket as invalid:
return $auth_failure->();
}
+ $tfa_info = {
+ type => 'u2f',
+ challenge => $challenge,
+ };
+ } elsif ($data =~ /^tfa!(.*)$/) {
+ # TOTP and Yubico don't require a challenge so this is the generic
+ # 'missing 2nd factor ticket'
+ $username = $1;
+ $tfa_info = { type => 'tfa' };
} else {
# Regular ticket (full access)
$username = $data;
@@ -327,7 +336,7 @@ sub verify_ticket {
return undef if !PVE::Auth::Plugin::verify_username($username, $noerr);
- return wantarray ? ($username, $age, $challenge) : $username;
+ return wantarray ? ($username, $age, $tfa_info) : $username;
}
# VNC tickets
@@ -515,22 +524,32 @@ sub authenticate_user {
my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
$plugin->authenticate_user($cfg, $realm, $ruid, $password);
- my $u2f;
-
my ($type, $tfa_data) = user_get_tfa($username, $realm);
if ($type) {
if ($type eq 'u2f') {
# Note that if the user did not manage to complete the initial u2f registration
# challenge we have a hash containing a 'challenge' entry in the user's tfa.cfg entry:
- $u2f = $tfa_data if !exists $tfa_data->{challenge};
+ $tfa_data = undef if exists $tfa_data->{challenge};
+ } elsif (!defined($otp)) {
+ # The user requires a 2nd factor but has not provided one. Return success but
+ # don't clear $tfa_data.
} else {
my $keys = $tfa_data->{keys};
my $tfa_cfg = $tfa_data->{config};
verify_one_time_pw($type, $username, $keys, $tfa_cfg, $otp);
+ $tfa_data = undef;
+ }
+
+ # Return the type along with the rest:
+ if ($tfa_data) {
+ $tfa_data = {
+ type => $type,
+ data => $tfa_data,
+ };
}
}
- return wantarray ? ($username, $u2f) : $username;
+ return wantarray ? ($username, $tfa_data) : $username;
}
sub domain_set_password {
--
2.11.0
More information about the pve-devel
mailing list