search

jaark / twofactor_yubikey

Yubikey Two-factor authentication provider for NextCloud
GNU Affero General Public License v3.0
21 stars 7 forks source link

Print server response in to nextcloud log if error occurs #9

Open Tarry91 opened 6 years ago

Tarry91 commented 6 years ago

It would be helpful to print some information to the nextcloud log if verifiying an OTP fails. I think especially about the "status" string as described here -->https://developers.yubico.com/OTP/Specifications/OTP_validation_protocol.html This would be helpful for administrators debugging login issues of users.

If the Try an OTP feature on the admin page is used the error codes could be displayed directly additionaly to printing it to the log.

Copying from the yubicloud API documentation:

name meaning
OK The OTP is valid.
BAD_OTP The OTP is invalid format.
REPLAYED_OTP The OTP has already been seen by the service.
BAD_SIGNATURE The HMAC signature verification failed.
MISSING_PARAMETER The request lacks a parameter.
NO_SUCH_CLIENT The request id does not exist.
OPERATION_NOT_ALLOWED The request id is not allowed to verify OTPs.
BACKEND_ERROR Unexpected error in our server. Please contact us if you see this error.
NOT_ENOUGH_ANSWERS Server could not get requested number of syncs during before timeout
REPLAYED_REQUEST Server has seen the OTP/Nonce combination before
jaark commented 5 years ago

Basic server response is now added when testing Yubikey server configuration and when adding a key to your account. No response information is (deliberately) given during normal authentication as doing so would risk providing sensitive information to an attacker.