Add support for logins to 1Password that require 2FA

[sfelf]

It doesn't appear to be possible to use this module if your 1Password account has 2FA enabled.

I believe the issue is on line 172 of the client.py file only the master password is being passed in and there isn't an option to pass in the 2FA token. When trying to use this package with an account that requires 2FA the value returned to the sess_key is b'Enter your six-digit authentication code: [ERROR] 2021/04/20 18:59:28 incorrect One-Time Password length. expected 6\n'.

Can you please add support for 2FA?

[dtpryce]

We can definitely have a look at this ... Will make a ticket and thanks for the pointers, think you're right :)

[dtpryce]

Can't see any mention of 2FA sign in here https://support.1password.com/command-line/ can you confirm the sign in steps using the cli and 2FA for me, please?

[dtpryce]

https://1password.community/discussion/97138/cli-always-requires-authentication-code like this?

[sfelf]

Yes the signin steps are:

$ op signin YYY
Enter the password for XXX at YYY.1password.com:
Enter your six-digit authentication code: 

[dtpryce]

Great, thanks ... I will make that ticket and find some time to add and test with our own accounts.

[dtpryce]

@sfelf just released an update that should fix your issue here - https://pypi.org/project/1password/0.5.0/.

Before you do install via pip please make sure to remove all environment variables in your profile and start with a fresh terminal. Also to be certain clear the op cache which can normally be removed using rm -rf ~/.config/op and then you can start using the client from the start so you'll need your secret key, master password and then your authenticator app at the ready :)

All future initiations of op = OnePassword() will ask for password and will only ask for the auth code when needed.

[sfelf]

@dtpryce Thanks so much for the quick turnaround. I was wondering if the fix was going to require switching to use pexpect instead of Popen.

Your fix seems to work as long as I don't pass in a value for account when instantiating OnePassword. I suspect this might be fixed by setting op_command if account is not None : https://github.com/wandera/1password-client/blob/fa9106ad9048b9535f3097f028f6aecfdd3da843/onepassword/client.py#L160-L169

Or perhaps the problem is that I am only passing in the account and the domain when instantiating OnePassword and only the account and the master_password are being passed on: https://github.com/wandera/1password-client/blob/fa9106ad9048b9535f3097f028f6aecfdd3da843/onepassword/client.py#L39-L40

I believe the account needs to be passed in when instantiating OnePassword if the user has multiple 1Password accounts configured but perhaps I am wrong.

[dtpryce]

Oh interesting ... Your using it that way :) I always go for user input tests but I'll have a look and see.

Might be a new issue.

[dtpryce]

Look like a simple indentation issue ... I will make a patch version so you can test out again.

[dtpryce]

Ok I tested using op = OnePassword(account="wandera") after first installation and worked, released in 0.5.1 https://pypi.org/project/1password/0.5.1/

[dtpryce]

@sfelf did it work?

[sfelf]

@dtpryce Yes, I am now able to pass in the account. I just submitted a PR to resolve an issue with 1Password believing that every successful login using OnePassword is from a new device.

[dtpryce]

Glad it works!!! They do send emails for each device that logs in but yes that's a good fix, I'll check it out and merge.

Any new issues with this client please log an issue :)

Have a great week.

[dtpryce]

@sfelf approved, merged, tested and release in 0.5.2. Great work and thanks for the contribution!