KNEL/KNELAgentIdentityProvisioning
6
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

skills: cloudron.md records pointer

Browse Source
This commit is contained in:
TSYS Group COO
2026-09-08 06:03:06 -05:00
parent 814188e582
commit 1a1a7ca581
6 changed files with 230 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/agent-provisioning/scripts/cloudron-totp-enroll.sh
Executable
+32
View File
@@ -0,0 +1,32 @@
#!/bin/bash
# Enroll TOTP for an identity (2FA must NOT be enforced yet — run
# cloudron-oidc-login.sh first, or admin totp_disable for seed-lost users).
# usage: cloudron-totp-enroll.sh <cloudron-username> [vault-item]
# Captures the seed into the vault item and verifies end-to-end.
set -euo pipefail
U="${1:?usage: cloudron-totp-enroll.sh <cloudron-username> [vault-item]}"
ITEM="${2:-$U Cloudron}"
BASE="https://my.knownelement.com"
BEARER_FILE="/tmp/.oidc-bearer-$U"
[ -f "$BEARER_FILE" ] || { echo "FAIL: run cloudron-oidc-login.sh $U first" >&2; exit 1; }
ACCESS=$(cat "$BEARER_FILE")
MYUID=$(curl -sk "$BASE/api/v1/profile" -H "Authorization: Bearer $ACCESS" | sed -n 's/.*"id":"\(uid-[^"]*\)".*/\1/p')
[ -n "$MYUID" ] || { echo "FAIL: bearer rejected" >&2; exit 2; }
SECRET=$(curl -sk "$BASE/api/v1/users/$MYUID/totp_setup" -H "Authorization: Bearer $ACCESS" | sed -n 's/.*"secret":"\([^"]*\)".*/\1/p')
if [ -z "$SECRET" ]; then
SECRET=$(curl -sk -X POST "$BASE/api/v1/users/$MYUID/totp_setup" -H "Authorization: Bearer $ACCESS" -H 'Content-Type: application/json' -d '{}' | sed -n 's/.*"secret":"\([^"]*\)".*/\1/p')
fi
[ -n "$SECRET" ] || { echo "FAIL: no totp secret returned" >&2; exit 3; }
CODE=$(bash "$(dirname "$0")/totp.sh" "$SECRET")
ENAB=$(curl -sk -X POST "$BASE/api/v1/users/$MYUID/totp_setup" -H "Authorization: Bearer $ACCESS" -H 'Content-Type: application/json' -d "{\"totpSecret\":\"$SECRET\",\"totpToken\":\"$CODE\"}")
case "$ENAB" in *Invalid*|*404*|*"No such route"*) echo "PARTIAL: enable said: $(printf '%s' "$ENAB" | head -c 100)";; esac
SM() { if [ "$(id -un)" = "TSGCOO" ]; then /data2/TSGCOO/.local/bin/sm "$@" </dev/null; else sudo -u TSGCOO /data2/TSGCOO/.local/bin/sm "$@" </dev/null; fi; }
SM setfield "$ITEM" totp_seed "$SECRET" >/dev/null
# end-to-end verify: fresh login with the stored seed
bash "$(dirname "$0")/cloudron-oidc-login.sh" "$U" "$ITEM" >/dev/null 2>&1
if [ -s "$BEARER_FILE" ]; then
WHO=$(curl -sk "$BASE/api/v1/profile" -H "Authorization: Bearer $(cat "$BEARER_FILE")" | sed -n 's/.*"username":"\([^"]*\)".*/\1/p')
[ "$WHO" = "$U" ] && echo "OK: $U 2FA enrolled, seed in vault ($ITEM), TOTP login verified as $WHO" \
&& exit 0
fi
echo "PARTIAL: verify failed — check state for $U"