33 lines
2.2 KiB
Bash
Executable File
33 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Enroll TOTP for an identity (2FA must NOT be enforced yet — run
|
|
# cloudron-oidc-login.sh first, or admin totp_disable for seed-lost users).
|
|
# usage: cloudron-totp-enroll.sh <cloudron-username> [vault-item]
|
|
# Captures the seed into the vault item and verifies end-to-end.
|
|
set -euo pipefail
|
|
U="${1:?usage: cloudron-totp-enroll.sh <cloudron-username> [vault-item]}"
|
|
ITEM="${2:-$U Cloudron}"
|
|
BASE="https://my.knownelement.com"
|
|
BEARER_FILE="/tmp/.oidc-bearer-$U"
|
|
[ -f "$BEARER_FILE" ] || { echo "FAIL: run cloudron-oidc-login.sh $U first" >&2; exit 1; }
|
|
ACCESS=$(cat "$BEARER_FILE")
|
|
MYUID=$(curl -sk "$BASE/api/v1/profile" -H "Authorization: Bearer $ACCESS" | sed -n 's/.*"id":"\(uid-[^"]*\)".*/\1/p')
|
|
[ -n "$MYUID" ] || { echo "FAIL: bearer rejected" >&2; exit 2; }
|
|
SECRET=$(curl -sk "$BASE/api/v1/users/$MYUID/totp_setup" -H "Authorization: Bearer $ACCESS" | sed -n 's/.*"secret":"\([^"]*\)".*/\1/p')
|
|
if [ -z "$SECRET" ]; then
|
|
SECRET=$(curl -sk -X POST "$BASE/api/v1/users/$MYUID/totp_setup" -H "Authorization: Bearer $ACCESS" -H 'Content-Type: application/json' -d '{}' | sed -n 's/.*"secret":"\([^"]*\)".*/\1/p')
|
|
fi
|
|
[ -n "$SECRET" ] || { echo "FAIL: no totp secret returned" >&2; exit 3; }
|
|
CODE=$(bash "$(dirname "$0")/totp.sh" "$SECRET")
|
|
ENAB=$(curl -sk -X POST "$BASE/api/v1/users/$MYUID/totp_setup" -H "Authorization: Bearer $ACCESS" -H 'Content-Type: application/json' -d "{\"totpSecret\":\"$SECRET\",\"totpToken\":\"$CODE\"}")
|
|
case "$ENAB" in *Invalid*|*404*|*"No such route"*) echo "PARTIAL: enable said: $(printf '%s' "$ENAB" | head -c 100)";; esac
|
|
SM() { if [ "$(id -un)" = "TSGCOO" ]; then /data2/TSGCOO/.local/bin/sm "$@" </dev/null; else sudo -u TSGCOO /data2/TSGCOO/.local/bin/sm "$@" </dev/null; fi; }
|
|
SM setfield "$ITEM" totp_seed "$SECRET" >/dev/null
|
|
# end-to-end verify: fresh login with the stored seed
|
|
bash "$(dirname "$0")/cloudron-oidc-login.sh" "$U" "$ITEM" >/dev/null 2>&1
|
|
if [ -s "$BEARER_FILE" ]; then
|
|
WHO=$(curl -sk "$BASE/api/v1/profile" -H "Authorization: Bearer $(cat "$BEARER_FILE")" | sed -n 's/.*"username":"\([^"]*\)".*/\1/p')
|
|
[ "$WHO" = "$U" ] && echo "OK: $U 2FA enrolled, seed in vault ($ITEM), TOTP login verified as $WHO" \
|
|
&& exit 0
|
|
fi
|
|
echo "PARTIAL: verify failed — check state for $U"
|