Add support for 2FA in cmk

[rohityadavcloud]

Add support for 2FA in cmk -> automate login and inputs.

[rohityadavcloud]

@harikrishna-patnala could you advise how we can detect if 2FA is enabled or an API needs some kind of inputs -> any way to implement that in a better UX way for cmk ?

[rohityadavcloud]

I checked with help from @harikrishna-patnala and found that:

1. APIs called using apikey/secretkey bypass the 2FA checks; for most ACS/cmk users cmk will not prompt for 2FA code.

2. For APIs called using username/password for 2FA enabled systems, it suggests users what to run, for example:

(mbx-419-rohit) 🐵 > list volumes
🙈 Error: (HTTP 511, error code <nil>) Unable to process the API request due to :Two factor authentication 2FA is enabled but not verified, please verify 2FA using validateUserTwoFactorAuthenticationCode API before calling other APIs. Existing session is invalidated.
(mbx-419-rohit) 🐵 > validate usertwofactorauthenticationcode -h
validateUserTwoFactorAuthenticationCode: Checks the 2FA code for the user.
Required params: codefor2fa,
API Params               Type     Description
==========               ====     ===========
codefor2fa               string   two factor authentication code
(mbx-419-rohit) 🐵 > validate usertwofactorauthenticationcode codefor2fa=105826
{
  "success": true
}

This means 2FA support in cmk isn't a blocker for cmk / 2FA users. They can still call this manually as the CLI/prompt suggests.

[rohityadavcloud]

Ideally the improvement in cmk would be to do the following:

1. This applies only when username and password is provided, upon login the response contains whether 2FA is enabled or not: { "loginresponse": { "username": "rohit", "userid": "9e9ba412-d3ca-4bf4-aead-768c0b09531f", "domainid": "d3806260-e766-11ee-b2c1-525400b612b4", "timeout": 1800, "account": "rohit", "firstname": "Rohit", "lastname": "Yadav", "type": "0", "timezone": "UTC", "timezoneoffset": "0.0", "registered": "false", "sessionkey": "9Gyo6QrVnC4UNd_S9Em64rjlBwE", "is2faenabled": "true", "is2faverified": "false", "providerfor2fa": "totp", "issuerfor2fa": "CloudStack" } }

2. Next, the validate API should be called after taking user input of the 2FA code such as:

URL: http://172.20.0.86:8080/client/api/?codefor2fa=217258&command=validateUserTwoFactorAuthenticationCode&response=json

Query String Parameters must pass: codefor2fa: 217258 command: validateUserTwoFactorAuthenticationCode

3. Upon successful code the following is returned, otherwise cmk may prompt additional input: { "validateusertwofactorauthenticationcoderesponse": { "success": true } }