Feature/2fa #277
Feature/2fa #277
Conversation
# Conflicts: # CHANGELOG.md
|
CLA Assistant Lite bot All contributors have signed the CLA ✍️ |
|
Can/does that message also get printed when the user switches to that account using |
It does not, as it only knows the user requires MFA when we validate the password. So I guess it also doesn't print if the user doesn't supply a password when creating the profile. |
|
Maybe we could validate upon switching too? Might be nice to know if your credentials are no longer good when you switch anyway. |
|
|
||
| If you choose not to store your password in the CLI, you must enter it for each command that requires a connection. | ||
|
|
||
| The Code42 CLI supports local accounts with MFA (multi-factor authentication) enabled. The Time-based One-Time |
There was a problem hiding this comment.
It would be great to be able to login only once. We have a story for this, right? For storing the token and only prompting when it expires
There was a problem hiding this comment.
The tokens only last like 20 seconds, so it's not really going to help too much to store it. Or do you mean store the key that is used to generate the tokens in authenticator apps?
There was a problem hiding this comment.
Ohh, you mean the v3 token?
| c42profile.authority_url, c42profile.username, password, None | ||
| ) | ||
| except Py42MFARequiredError: | ||
| echo( |
There was a problem hiding this comment.
Could we prompt at this point so that we can still validate?
There was a problem hiding this comment.
What do we need to validate? If we get the Py42MFARequired error, it means the password was correct but the token was missing.
| except Py42UnauthorizedError as err: | ||
| logger.log_error(str(err)) | ||
| raise Code42CLIError("Invalid credentials for user {}".format(username)) | ||
| if "INVALID_TIME_BASED_ONE_TIME_PASSWORD" in err.response.text: |
There was a problem hiding this comment.
This is fine for now but this seems like a common enough scenario that we should have a custom py42 error for this
Implements support for MFA accounts.
When a profile for an MFA user is created, the user will see the message:
Then any commands that initialize the sdk will either require the
--totp <token>option, or if the option isn't provided, the CLI will prompt for the token.