Expand with api to allow challenge response #317

New Issue

2026-10-05T04:12:49+02:00

adam commented

2026-10-05 04:12:49 +02:00

I'd like to allow two factor with Google authenticator.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/1589520-expand-with-api-to-allow-challenge-response?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

I'd like to allow two factor with Google authenticator. ## <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/1589520-expand-with-api-to-allow-challenge-response?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:12:50 +02:00

Might help to mention which API you mean specifically. Does Google run an IRC network with a two factor login authentication?

Might help to mention which API you mean specifically. Does Google run an IRC network with a two factor login authentication?

adam commented

2026-10-05 04:12:51 +02:00

Sorry, stupid auto correct. Should say auth api, ie don't fully log in until after additional communication.

Sorry, stupid auto correct. Should say auth api, ie don't fully log in until after additional communication.

adam commented

2026-10-05 04:12:51 +02:00

Scenario: log in as normal
*2fa msgs user.
User must present correct code via pm to *2fa before login continues.

Scenario: log in as normal *2fa msgs user. User must present correct code via pm to *2fa before login continues.

adam commented

2026-10-05 04:12:52 +02:00

Uhm. Isn't this already possible? Just return HALT from OnLoginAttempt() and your code has all the time it needs to do whatever it wants to the login attempt...?

Uhm. Isn't this already possible? Just `return HALT` from `OnLoginAttempt()` and your code has all the time it needs to do whatever it wants to the login attempt...?

adam commented

2026-10-05 04:12:53 +02:00

I believe this is too early for messaging. Can I use OnRaw to get additional PASS lines maybe?

I believe this is too early for messaging. Can I use OnRaw to get additional PASS lines maybe?

adam commented

2026-10-05 04:12:53 +02:00

OnUnknownUserRaw(). And you can keep the CSmartPtr<CAuthBase> that OnLoginAttempt() around as long as you want and only later call functions on it. (But please note that the socket timeout is still active and if you wait too long, the socket might already be gone again. You can stil call the "auth successful" functions after this, but they won't do anything. If this is a problem, you'd have to mess with / disable this timeout. Which isn't necesarily the best idea...)

`OnUnknownUserRaw()`. And you can keep the `CSmartPtr<CAuthBase>` that `OnLoginAttempt()` around as long as you want and only later call functions on it. (But please note that the socket timeout is still active and if you wait too long, the socket might already be gone again. You can stil call the "auth successful" functions after this, but they won't do anything. If this is a problem, you'd have to mess with / disable this timeout. Which isn't necesarily the best idea...)

adam commented

2026-10-05 04:12:54 +02:00

I'll attempt this, thanks. How would I keep the pointer if multiple clients are connected to one user.

I'll attempt this, thanks. How would I keep the pointer if multiple clients are connected to one user.

adam commented

2026-10-05 04:12:55 +02:00

Which pointer do you want to keep? All that OnLoginAttempt() gives you is a CAuthBase. From this you can get the username, password, socket and remote ip. The socket automatically becomes NULL if the other end e.g. disconnects or "dies from a timeout", so be sure to handle this correctly.

And the CSmartPtr can just be copied around like an int...

And remember that there is more than just IRC auth. This will also be called for web auth!

Which pointer do you want to keep? All that `OnLoginAttempt()` gives you is a CAuthBase. From this you can get the username, password, socket and remote ip. The socket automatically becomes NULL if the other end e.g. disconnects or "dies from a timeout", so be sure to handle this correctly. And the CSmartPtr can just be copied around like an int... And remember that there is more than just IRC auth. This will also be called for web auth!

adam commented

2026-10-05 04:12:55 +02:00

EWhat if two clients for the same user both have auth sessions. How do I get the correct AuthPointer to accept? Only thing I can think of is one PASS accepting all open AuthPointers for the user. That mightn't be a bad idea given all my networks.

EWhat if two clients for the same user both have auth sessions. How do I get the correct AuthPointer to accept? Only thing I can think of is one PASS accepting all open AuthPointers for the user. That mightn't be a bad idea given all my networks.

adam commented

2026-10-05 04:12:56 +02:00

Your OnLoginAttempt will be called once per client, each time with CAuthBase of that particular client. It's your module's job to determine, whether the client is authenticated or not, and which user is it authorized as.

Your `OnLoginAttempt` will be called once per client, each time with `CAuthBase` of that particular client. It's your module's job to determine, whether the client is authenticated or not, and which user is it authorized as.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#317