Skip to content

Commit a3feccf

Browse files
harikrishna-patnalayadvr
harikrishna-patnala
and
yadvr
authored
User two factor authentication (apache#6924)
Co-authored-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1 parent 90c92f2 commit a3feccf

File tree

88 files changed

+3498
-101
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

88 files changed

+3498
-101
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ jobs:
7575
smoke/test_list_ids_parameter
7676
smoke/test_loadbalance
7777
smoke/test_login
78+
smoke/test_2fa
7879
smoke/test_metrics_api
7980
smoke/test_migration
8081
smoke/test_multipleips_per_nic

‎api/src/main/java/com/cloud/exception/CloudTwoFactorAuthenticationException.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package com.cloud.exception;
18+
19+
import com.cloud.utils.SerialVersionUID;
20+
import com.cloud.utils.exception.CloudRuntimeException;
21+
22+
public class CloudTwoFactorAuthenticationException extends CloudRuntimeException {
23+
private static final long serialVersionUID = SerialVersionUID.CloudTwoFactorAuthenticationException;
24+
25+
public CloudTwoFactorAuthenticationException(String message) {
26+
super(message);
27+
}
28+
29+
public CloudTwoFactorAuthenticationException(String message, Throwable th) {
30+
super(message, th);
31+
}
32+
}

‎api/src/main/java/com/cloud/user/AccountService.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
// under the License.
1717
package com.cloud.user;
1818

19+
import java.util.List;
1920
import java.util.Map;
2021

2122
import org.apache.cloudstack.acl.ControlledEntity;
@@ -33,6 +34,7 @@
3334
import com.cloud.offering.DiskOffering;
3435
import com.cloud.offering.NetworkOffering;
3536
import com.cloud.offering.ServiceOffering;
37+
import org.apache.cloudstack.auth.UserTwoFactorAuthenticator;
3638

3739
public interface AccountService {
3840

@@ -124,4 +126,18 @@ User createUser(String userName, String password, String firstName, String lastN
124126
public Map<String, String> getKeys(GetUserKeysCmd cmd);
125127

126128
public Map<String, String> getKeys(Long userId);
129+
130+
/**
131+
* Lists user two-factor authentication provider plugins
132+
* @return list of providers
133+
*/
134+
List<UserTwoFactorAuthenticator> listUserTwoFactorAuthenticationProviders();
135+
136+
/**
137+
* Finds user two factor authenticator provider by domain ID
138+
* @param domainId domain id
139+
* @return backup provider
140+
*/
141+
UserTwoFactorAuthenticator getUserTwoFactorAuthenticationProvider(final Long domainId);
142+
127143
}

‎api/src/main/java/com/cloud/user/User.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,4 +90,8 @@ public enum Source {
9090
public String getExternalEntity();
9191

9292
public void setExternalEntity(String entity);
93+
94+
public boolean isUser2faEnabled();
95+
96+
public String getKeyFor2fa();
9397
}

‎api/src/main/java/com/cloud/user/UserAccount.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
package com.cloud.user;
1818

1919
import java.util.Date;
20+
import java.util.Map;
2021

2122
import org.apache.cloudstack.api.InternalIdentity;
2223

@@ -67,4 +68,21 @@ public interface UserAccount extends InternalIdentity {
6768
public String getExternalEntity();
6869

6970
public void setExternalEntity(String entity);
71+
72+
public boolean isUser2faEnabled();
73+
74+
public void setUser2faEnabled(boolean user2faEnabled);
75+
76+
public String getKeyFor2fa();
77+
78+
public void setKeyFor2fa(String keyFor2fa);
79+
80+
public String getUser2faProvider();
81+
82+
public void setUser2faProvider(String user2faProvider);
83+
84+
public Map<String, String> getDetails();
85+
86+
public void setDetails(Map<String, String> details);
87+
7088
}

‎api/src/main/java/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,10 @@ public class ApiConstants {
239239
public static final String IP_ADDRESSES = "ipaddresses";
240240
public static final String IP6_ADDRESS = "ip6address";
241241
public static final String IP_ADDRESS_ID = "ipaddressid";
242+
public static final String IS_2FA_ENABLED = "is2faenabled";
243+
public static final String IS_2FA_VERIFIED = "is2faverified";
244+
245+
public static final String IS_2FA_MANDATED = "is2famandated";
242246
public static final String IS_ASYNC = "isasync";
243247
public static final String IP_AVAILABLE = "ipavailable";
244248
public static final String IP_LIMIT = "iplimit";
@@ -1003,13 +1007,19 @@ public class ApiConstants {
10031007

10041008
public static final String ADMINS_ONLY = "adminsonly";
10051009
public static final String ANNOTATION_FILTER = "annotationfilter";
1010+
public static final String CODE_FOR_2FA = "codefor2fa";
1011+
public static final String PROVIDER_FOR_2FA = "providerfor2fa";
1012+
public static final String ISSUER_FOR_2FA = "issuerfor2fa";
1013+
public static final String MANDATE_2FA = "mandate2fa";
1014+
public static final String SECRET_CODE = "secretcode";
10061015
public static final String LOGIN = "login";
10071016
public static final String LOGOUT = "logout";
10081017
public static final String LIST_IDPS = "listIdps";
10091018

10101019
public static final String PUBLIC_MTU = "publicmtu";
10111020
public static final String PRIVATE_MTU = "privatemtu";
10121021
public static final String MTU = "mtu";
1022+
public static final String LIST_APIS = "listApis";
10131023

10141024
/**
10151025
* This enum specifies IO Drivers, each option controls specific policies on I/O.

‎api/src/main/java/org/apache/cloudstack/api/ApiErrorCode.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
public enum ApiErrorCode {
2424

2525
UNAUTHORIZED(401),
26+
UNAUTHORIZED2FA(511),
2627
METHOD_NOT_ALLOWED(405),
2728
MALFORMED_PARAMETER_ERROR(430),
2829
PARAM_ERROR(431),

‎api/src/main/java/org/apache/cloudstack/api/auth/APIAuthenticationType.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@
1717
package org.apache.cloudstack.api.auth;
1818

1919
public enum APIAuthenticationType {
20-
LOGIN_API, LOGOUT_API, READONLY_API
20+
LOGIN_API, LOGOUT_API, READONLY_API, LOGIN_2FA_API
2121
}

‎api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,11 @@
4242
import com.cloud.utils.Pair;
4343
import com.cloud.utils.exception.CloudRuntimeException;
4444

45-
@APICommand(name = "listConfigurations", description = "Lists all configurations.", responseObject = ConfigurationResponse.class,
45+
@APICommand(name = ListCfgsByCmd.APINAME, description = "Lists all configurations.", responseObject = ConfigurationResponse.class,
4646
requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
4747
public class ListCfgsByCmd extends BaseListCmd {
48+
49+
public static final String APINAME = "listConfigurations";
4850
public static final Logger s_logger = Logger.getLogger(ListCfgsByCmd.class.getName());
4951

5052

‎api/src/main/java/org/apache/cloudstack/api/command/admin/user/UpdateUserCmd.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ public class UpdateUserCmd extends BaseCmd {
7979
@Parameter(name = ApiConstants.USERNAME, type = CommandType.STRING, description = "Unique username")
8080
private String username;
8181

82+
@Parameter(name = ApiConstants.MANDATE_2FA, type = CommandType.BOOLEAN, description = "Provide true to mandate the user to use two factor authentication has to be enabled." +
83+
"This parameter is only used to mandate 2FA, not to disable 2FA", since = "4.18.0.0")
84+
private Boolean mandate2FA;
85+
8286
@Inject
8387
private RegionService _regionService;
8488

@@ -126,6 +130,10 @@ public String getUsername() {
126130
return username;
127131
}
128132

133+
public Boolean getMandate2FA() {
134+
return mandate2FA;
135+
}
136+
129137
/////////////////////////////////////////////////////
130138
/////////////// API Implementation///////////////////
131139
/////////////////////////////////////////////////////

0 commit comments

Comments
 (0)