Add support for LDAP cn=...+totptoken=.. support

src/externalldap.js

@@ -2,6 +2,7 @@
 
 exports = module.exports = {
     verifyPassword,
+    verifyPasswordAndTotpToken,
     maybeCreateUser,
 
     testConfig,
@@ -44,6 +45,7 @@ function translateUser(ldapConfig, ldapUser) {
     return {
         username: ldapUser[ldapConfig.usernameField].toLowerCase(),
         email: ldapUser.mail || ldapUser.mailPrimaryAddress,
+        twoFactorAuthenticationEnabled: !!ldapUser.twoFactorAuthenticationEnabled,
         displayName: ldapUser.displayName || ldapUser.cn // user.giveName + ' ' + user.sn
     };
 }
@@ -279,6 +281,32 @@ async function verifyPassword(user, password) {
     return translateUser(externalLdapConfig, ldapUsers[0]);
 }
 
+async function verifyPasswordAndTotpToken(user, password, totpToken) {
+    assert.strictEqual(typeof user, 'object');
+    assert.strictEqual(typeof password, 'string');
+    assert.strictEqual(typeof totpToken, 'string');
+
+    const externalLdapConfig = await settings.getExternalLdapConfig();
+    if (externalLdapConfig.provider === 'noop') throw new BoxError(BoxError.BAD_STATE, 'not enabled');
+
+    const ldapUsers = await ldapUserSearch(externalLdapConfig, { filter: `${externalLdapConfig.usernameField}=${user.username}` });
+    if (ldapUsers.length === 0) throw new BoxError(BoxError.NOT_FOUND);
+    if (ldapUsers.length > 1) throw new BoxError(BoxError.CONFLICT);
+
+    const client = await getClient(externalLdapConfig, { bind: false });
+
+    // inject totptoken into first attribute
+    const rdns = ldapUsers[0].dn.split(',');
+    const totpTokenDn = `${rdns[0]}+totptoken=${totpToken},` + rdns.slice(1).join(',');
+
+    const [error] = await safe(util.promisify(client.bind.bind(client))(totpTokenDn, password));
+    client.unbind();
+    if (error instanceof ldap.InvalidCredentialsError) throw new BoxError(BoxError.INVALID_CREDENTIALS);
+    if (error) throw new BoxError(BoxError.EXTERNAL_ERROR, error);
+
+    return translateUser(externalLdapConfig, ldapUsers[0]);
+}
+
 async function startSyncer() {
     const externalLdapConfig = await settings.getExternalLdapConfig();
     if (externalLdapConfig.provider === 'noop') throw new BoxError(BoxError.BAD_STATE, 'not enabled');