mirror of
https://git.proxmox.com/git/pve-access-control
synced 2025-10-04 05:09:24 +00:00
d9f02efe49
Previously `authentication_verify` just `die`d on error and would only return a boolean whether `priv/tfa.cfg` needs updating as a positive result. Since we want to support locking TOTP as well as a general TFA lock-out via the config, we also want to be able to tell when this occurs. Most of it is handled by the TFA rust crate already, but notifying users needs to be done on this end instead. In pve-rs we now have a different API for this: `authentication_verify2`, which, instead of die()ing on errors, always returns a hash containing the result as well as the flags 'tfa-limit-reached' and 'totp-limit-reached' which, if set, tell us to notify the user. However, doing so will introduce new fields in the `priv/tfa.cfg` in a struct marked as `deny_unknown_fields`, so in a cluster, the limits & notification handling should only be done once we can be sure that all nodes are up to date. These fields are only introduced on login errors, so for now, handle a failed result early without saving `priv/tfa.cfg`. The only case where saving the file was previously required was when *successfully* logging in with a recovery key, by which we cannot be reaching a limit, so this should still be safe. Once we can validate that all cluster nodes are up to date, we can implement the notification system. A commented-out code structure for this is included in this patch. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> |
||
|---|---|---|
| .. | ||
| source | ||
| changelog | ||
| compat | ||
| control | ||
| copyright | ||
| docs | ||
| postinst | ||
| rules | ||
| triggers | ||