jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

directoryserver: leave it to client to decide totp check

Browse Source 
initially, the idea was to make the server enforce it. this is more secure. however,
we have 3 kinds of clients - an external cloudron dashboard which needs totp,
an external cloudron app, which doesn't have totp and external apps that don't have totp either.

given that the directory server is IP restricted, this is a reasonable compromise until
we move wholesale to oidc.

a directoryserver setting like "enforce totp" also does not work since this policy will be
applied to all clients.
This commit is contained in:
Girish Ramakrishnan
2024-01-07 20:38:36 +01:00
parent 7bb68ea6b5
commit 4ddcd547ba
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/test/directoryserver-test.js
View File

@@ -141,8 +141,8 @@ describe('Directory Server (LDAP)', function () {
await users.enableTwoFactorAuthentication(admin.id, totpToken, auditSource);
});
it('fails without 2fa', async function () {
const [error] = await safe(ldapBind(`cn=${admin.id},ou=users,dc=cloudron`, admin.password));
it('fails with empty 2fa', async function () {
const [error] = await safe(ldapBind(`cn=${admin.id}+totptoken=,ou=users,dc=cloudron`, admin.password));
expect(error).to.be.a(ldap.InvalidCredentialsError);
expect(error.lde_message).to.be('A totpToken must be provided');
});
@@ -153,6 +153,10 @@ describe('Directory Server (LDAP)', function () {
expect(error.lde_message).to.be('Invalid totpToken');
});
it('fails with no 2fa', async function () {
await ldapBind(`cn=${admin.id},ou=users,dc=cloudron`, admin.password);
});
it('succeeds with valid 2fa', async function () {
const totpToken = speakeasy.totp({ secret: twofa.secret, encoding: 'base32' });
await ldapBind(`cn=${admin.email}+totpToken=${totpToken},ou=users,dc=cloudron`, admin.password);