rlippmann
commented
10 months ago Hi Jacky,
As promised, here is what I've discovered about the process to do 2fa. I've omitted all the https://portal.adtpulse/myhome/version from all the URLs for brevity. first, when an invalid fingerprint is received, the browser gets a redirect to /mfa/mfaSignIn.jsp?workflow=challenge
In that page, there is some js source as follows:
<script type="text/javascript">
const workflow = "challenge";
window.g.mfa = {
xToken: '',
xPreAuthToken: '7987E5DCAFC24CD01C6F9D7598D329C7636194118616B100574ACA358067E0C3D1D84145769F6EBC51FBB9E557CCB56DFECA4749EF0AAB616E7CCABF8B37C2178F12995C5312A30722439450A7F33749A29DA9AA478B17FAE213805912B0AA604BBD8978E42092B81BF2D52ABF5450FDC492368326088AAD3B122AE664B6B278',
xLogin: "rml.adtpulse@gmail.com",
userEmail: "rml.adtpulse@gmail.com",
xClientType: "web",
env: "prod",
locale: "en_US",
partner: "adt",
sat: '3ac1a3c2-e771-4d28-82ef-2725a4a270fa',
proxyServletUrl: "/nga/serv/RunRRAProxy",
rootAddress: "",
workflow: workflow,
shouldForceMfaSetup: null,
supportPhoneNumber: "1 (800) 251-9581",
mockApi: false,
testCase: 0,
returnToPortalCb: returnToPortalCb
};
if (workflow === 'challenge' || workflow === 'initialSetup') {
// callback only for mfa sign in
window.g.mfa.returnToSignInCb = returnToSignInCb;
} else {
// callbacks only for mfa settings hosted in dialog
window.g.mfa.isDataLoadedCb = resizeAndRecenterDialog;
window.g.mfa.resizeDialogCb = resizeDialog;
window.g.mfa.registerDismissCallback = window.parent.registerDismissCallback;
}
</script>you'll need the variables defined in g.mfa to set http headers:
{
"name": "X-clientType",
"value": "web"
},
{
"name": "x-dtpc",
"value": "9$392570027_372h2vPKSEFMFGKUWAMVLCGWMCWRFOJDUMFROR-0e0"
},
{
"name": "X-format",
"value": "json"
},
{
"name": "X-locale",
"value": "en-US"
},
{
"name": "X-login",
"value": "rlippmann@hotmail.com"
},
{
"name": "X-preAuthToken",
"value": "D07734ACAC6C9F4139B16B4453ECCFAE9600B51FF1D74A932FDFFAFFF1727252BA986CC361FE20BFD29A01E9426011D19A0CA8A6A4DE96A8A969F2313DEBB1BC374C99D953986488DDC115729B64E49354B51F0705DA4E0337005A23C4288D73BDA7726B6E4DDF91727F5EE8C644D76C422786F9AC426405AF21501C64C9F8F4"
},
{
"name": "X-version",
"value": "7.0"
}I don't think the x-dtpc is necessary (it's some tracing code on ADT's side), and I'm not sure about X-version then, when you make the following request, you'll get some json back
request: /nga/serv/RunRRAProxy?href=rest/icontrol/ui/client/multiFactorAuth&sat=3ac1a3c2-e771-4d28-82ef-2725a4a270fa
(where sat is the value of the sat variable above)
response:
"state": {
"mfaEnabled": true,
"label": "Enabled (2 verification methods)",
"mfaProperties": [
{
"id": "SMS",
"type": "SMS",
"label": "(***) ***-5549",
"caption": "Text message to <span class=\"ic_strong\">(***) ***-5549</span>"
},
{
"id": "EMAIL",
"type": "EMAIL",
"label": "r***@h***.com",
"caption": "Email to <span class=\"ic_strong\">r***@h***.com</span>"
}
]
},
"commands": {
"requestOtpForRegisteredProperty": {
"params": {
"id": {
"label": "Select a verification method",
"options": [
{
"value": "SMS",
"type": "SMS",
"label": "by text to <span class=\"ic_strong\">(***) ***-5549</span>",
"caption": "Verify with text message"
},
{
"value": "EMAIL",
"type": "EMAIL",
"label": "by email to <span class=\"ic_strong\">r***@h***.com</span>",
"caption": "Verify with email"
}
],
"type": "select"
}
},
"method": "POST",
"action": "rest/adt/ui/client/multiFactorAuth/requestOtpForRegisteredProperty",
"label": "Request a verification code"
},
"validateOtp": {
"params": {
"otp": {
"type": "textInput",
"label": "Enter verification code"
}
},
"method": "POST",
"action": "rest/adt/ui/client/multiFactorAuth/validateOtp",
"label": "Validate verification code"
}
}
}the commands give you the http requests and the parameters, so to request the otp, you would do: POST /nga/serv/RunRRAProxy with parameter href=rest/adt/ui/client/multiFactorAuth/requestOtpForRegisteredProperty and sat={the sat from the script in the first step} id=EMAIL (or SMS, or whatever id's where in mfapropertries)
Note, the href parameters are relative URLs (i.e. don't need the https://portal.adtpulse.com/myhome/version
to validate: POST /nga/serv/RunRRAProxy href=rest/adt/ui/client/multiFactorAuth/validateOtp id={the one time password the user received)
to save it, do: GET /nga/serv/RunRRAProxy?only=client.multiFactorAuth&exclude=&sat={sat from script}&href=rest/adt/ui/updates&sat={sat from script}&
One thing I'm not sure of is when you set the fingerprint. I'm guessing the server somehow keeps a copy of it when you log in. I haven't seen it passed around in any of the session cookies.
Anyway, hope this helps. Let me know how it goes, I'm eager to implement it in HA.
mrjackyliang
github-actions[bot]
Pre-check confirmation
Your email address
robert.lippmann.development@gmail.com
Describe the new feature requested
Automatically generating the fingerprint for 2fa
Legal Agreements