`fcli fod session login`: Support MFA Authentication for FoD Username/Password Login (TOTP and Future Email/SMS MFA)

[SangameshV]

Enhancement Request

Currently, fcli fod session login command supports username/password, PAT, and client ID/client secret authentication flows. However, for FoD tenants with MFA enabled, users relying on username/password authentication may not be able to authenticate through fcli, even though the FoD API exposes security_code and do_totp fields that appear to support MFA-based authentication.

Based on discussions with the FoD team, an initial enhancement would be to support TOTP-based MFA authentication through the FoD login flow by allowing users to provide a TOTP code when performing username/password authentication. The proposed user experience is similar to the existing interactive password option.
fcli fod session login --url <FoD_URL> --tenant <tenant> --user <user> --password <password> --totp

When a TOTP value is provided interactively, fcli would submit the appropriate FoD API request fields (for example, security_code with do_totp=true).

Future Consideration

The email discussion also identified a possible need to support email/SMS-based MFA codes if the FoD API provides a mechanism to trigger MFA code delivery. The exact implementation is currently unclear and depends on additional confirmation from the FoD team regarding available API capabilities.

Potentials Approaches incude:

1. Extending the login command with an additional MFA code option, such as:
   fcli fod session login --mfa-code
2. Introducing a dedicated command to request a code before login
   fcli fod session request-mfa-code

This should remain a follow-up enhancement once FoD API capabilities are confirmed.

Expected Benefits:

• Enables username/password authentication workflows for FoD tenants that require MFA.
• Supports customers who cannot feasibly migrate all users to PAT-based authentication.
• Aligns fcli authentication capabilities more closely with FoD API MFA support.
• Provides a foundation for supporting additional MFA mechanisms in the future.

Initial Scope:

• Add support for TOTP-based MFA in fcli fod session login.
• Limit support to username/password authentication flows.
• Evaluate email/SMS MFA support separately once FoD API capabilities are confirmed.