Added option to remove OTP 2FA.
Ylian Saint-Hilaire committed
Dec 11, 2021 at 16:08 UTC
db3659d665eac2898341dcdadc067f7038e73f9b
5 files changed
+11
-2
meshcentral-config-schema.json
+1
@@ -414,6 +414,7 @@
414
"email2factor": { "type": "boolean", "default": true, "description": "Set to false to disable email 2FA." },
415
"sms2factor": { "type": "boolean", "default": true, "description": "Set to false to disable SMS 2FA." },
416
"push2factor": { "type": "boolean", "default": true, "description": "Set to false to disable push notification 2FA." },
417
+ "otp2factor": { "type": "boolean", "default": true, "description": "Set to false to disable one-time-password 2FA." },
418
"force2factor": { "type": "boolean", "default": false, "description": "Requires that all accounts setup 2FA." },
419
"skip2factor": { "type": "string", "description": "IP addresses where 2FA login is skipped, for example: 127.0.0.1,192.168.2.0/24" },
420
"oldPasswordBan": { "type": "integer", "description": "Number of old passwords the server should remember and not allow the user to switch back to." },
meshuser.js
+6
@@ -3493,6 +3493,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3493
// Do not allow this command when logged in using a login token
3494
if (req.session.loginToken != null) break;
3495
3496
+ // Check of OTP 2FA is allowed
3497
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.otp2factor == false)) break;
3498
+
3499
if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
3500
3501
// Check if 2-step login is supported
@@ -3515,6 +3518,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
3518
// Do not allow this command when logged in using a login token
3519
if (req.session.loginToken != null) break;
3520
3521
+ // Check of OTP 2FA is allowed
3522
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.otp2factor == false)) break;
3523
+
3524
if ((user.siteadmin != 0xFFFFFFFF) && ((user.siteadmin & 1024) != 0)) return; // If this account is settings locked, return here.
3525
3526
// Check if 2-step login is supported
views/default-mobile.handlebars
+2
-2
@@ -1371,8 +1371,8 @@
1371
QV('p2AccountSecurity', ((features & 4) == 0) && (serverinfo.domainauth == false) && ((features & 4096) != 0) && (accountSettingsLocked == false)); // Hide Account Security if in single user mode or domain authentication, 2 factor auth not supported.
1372
QV('p2AccountImage', !accountSettingsLocked);
1373
QV('verifyEmailId', (userinfo.emailVerified !== true) && (userinfo.email != null) && (serverinfo.emailcheck == true));
1374
- QV('manageAuthApp', features & 4096);
1375
- QV('manageOtp', ((features & 4096) != 0) && ((userinfo.otpsecret == 1) || (userinfo.otphkeys > 0)));
1374
+ QV('manageAuthApp', (features & 4096) && ((userinfo.otpsecret == 1) || ((features2 & 0x00020000) == 0)));
1375
+ QV('manageOtp', (features & 4096) && ((userinfo.otpsecret == 1) || (userinfo.otphkeys > 0)));
1376
QV('authPhoneNumberCheck', (userinfo.phone != null));
1377
QV('authEmailSetupCheck', (userinfo.otpekey == 1) && (userinfo.email != null) && (userinfo.emailVerified == true));
1378
QV('authAppSetupCheck', userinfo.otpsecret == 1);
views/default.handlebars
+1
@@ -2120,6 +2120,7 @@
2120
QV('authPhoneNumberCheck', (userinfo.phone != null));
2121
QV('authEmailSetupCheck', (userinfo.otpekey == 1) && (userinfo.email != null) && (userinfo.emailVerified == true));
2122
QV('authAppSetupCheck', userinfo.otpsecret == 1);
2123
+ QV('manageAuthApp', (userinfo.otpsecret == 1) || ((features2 & 0x00020000) == 0));
2124
QV('authKeySetupCheck', userinfo.otphkeys > 0);
2125
QV('authPushAuthDevCheck', (userinfo.otpdev > 0) && ((features2 & 0x40) != 0));
2126
QV('authCodesSetupCheck', userinfo.otpkeys > 0);
webserver.js
+1
@@ -2848,6 +2848,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2848
if (domain.mailserver != null) { features2 += 0x00004000; } // Indicates email server is active
2849
if (domain.devicesearchbarserverandclientname) { features2 += 0x00008000; } // Search bar will find both server name and client name
2850
if (domain.ipkvm) { features2 += 0x00010000; } // Indicates support for IP KVM device groups
2851
+ if ((domain.passwordrequirements) && (domain.passwordrequirements.otp2factor == false)) { features2 += 0x00020000; } // Indicates support for OTP 2FA is disabled
2852
return { features: features, features2: features2 };
2853
}
2854