Support TOTP login with 2FA-enabled accounts
ClosedPublic

Authored by cdywan on Jun 27 2019, 7:56 AM.

Details

Summary

The docs for the Rocket.Chat realtime API Ruqola is using unfortunately don't include handling of 2FA-enabled accounts. Login actually seems to succeed because only a 403 error code is handled when in fact totp-required is returned as a response. It's worth noting codes can apparently be both numeric and strings.
A peek at the iOS client revealed how a login message needs to be constructed. Unlike the login method of the REST API endpoint the code isn't just added to the top-level.

On the UI side of things, an additional Code input needs to be shown in the login page.

BUG: 409212

Diff Detail

Repository
R865 Ruqola
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.
cdywan requested review of this revision.Jun 27 2019, 7:56 AM
cdywan created this revision.

For info I started to create 1.0RC1 so this patch will not go in 1.0, but it will go to 1.1

autotests/rocketchatmessagetest.cpp
398

don't use QStringLiteral() but QString()

+

create an autotest when code is not QString()

src/apps/qml/Login.qml
169

Please add a better i18n : "2FA" is not know by everyone.

173

We need to investigate if there is a settings for inform us that 2FA is enabled on server.

I don't want to keep it visible all the time when it's not enabled.

src/ruqolacore/ddpapi/ddpclient.cpp
830

const

831

const

840

We don't failed when we have an error ?

src/ruqolacore/rocketchataccount.h
82

Perhaps we can use an other name as code, doubleAuthenticationFactorCode ?

src/ruqolacore/rocketchataccountsettings.cpp
171

if (mCode != code) {
....
}

src/ruqolacore/rocketchatmessage.cpp
483

Please add url where you find info how to generate it.

src/ruqolacore/rocketchatmessage.h
94

coding style QString &code

mlaurent requested changes to this revision.Jun 27 2019, 11:51 AM
This revision now requires changes to proceed.Jun 27 2019, 11:51 AM
cdywan marked 10 inline comments as done.Jun 27 2019, 3:18 PM
cdywan added inline comments.
src/apps/qml/Login.qml
169

I changed it to You have enabled second factor authentication. Please enter the generated code or a backup code. which is the terminology used within Rocket.Chat's web UI and made the Label red and bold since it's an error message, including line wrapping in case the window is small. The PasswordLineEdit now says Two-factor authentication code or backup code to further clarify that it's not the same as the password.

173

We know that 2FA is required to login when login with just the password fails. And this is account-specific, not server-specific.

I added a DDPClient.LoginCodeRequired state to distinguish that case and also show a message explaining what happened.

src/ruqolacore/ddpapi/ddpclient.cpp
840

Nice catch! We definitely should fail here!

src/ruqolacore/rocketchataccount.h
82

It's indeed called code in the realtime API. But I changed all variables/ accessors to twoFactorAuthenticationCode.

cdywan updated this revision to Diff 60731.Jun 27 2019, 3:19 PM
cdywan marked 4 inline comments as done.

See inline comments.

mlaurent added inline comments.Jun 28 2019, 5:09 AM
autotests/rocketchatmessagetest.cpp
407

Missing autotest file I seems in this patch

cdywan updated this revision to Diff 60756.Jun 28 2019, 8:19 AM
cdywan marked an inline comment as done.

Added loginCode.ref.

cdywan updated this revision to Diff 60759.EditedJun 28 2019, 9:50 AM
  • Rebased.
  • Added handling for totp-invalid which is returned when the code is invalid or expired.
mlaurent accepted this revision.Jun 28 2019, 12:06 PM

I will commit for you too in 1.0 it seems to work fine.

This revision is now accepted and ready to land.Jun 28 2019, 12:06 PM
This revision was automatically updated to reflect the committed changes.