Document twofactor_totp key validation OCS API

[karakayasemi]

What Needs to be Documented?

owncloud/twofactor_totp#38

Where Does This Need To Be Documented?

• I guess, under Available API's section in developer manual

What Type Of Content Change Is This? (Optional)

• New Content Addition
• Old Content Deprecation
• Existing Content Simplification
• Bug Fix to Existing Content

Which Manual Does This Relate To? (Optional)

• Developer Manual

[settermjd]

Hi, @karakayasemi. As part of completing this issue, I've installed the latest version of twofactor_totp from the ownCloud Marketplace (v0.6.0) in my development installation of ownCloud, but have been unable to replicate the stated change in functionality, as described in owncloud/twofactor_totp#38.

I tested the functionality using the following curl request:

curl --silent -u 'admin:admin' \
    http://localhost/ocs/v1.php/apps/twofactor_totp/api/v1/validate/admin/883998?format=json | jq

If "Activate TOTP" is checked and the second-factor authentication code has been verified, the following JSON response is returned:

{
  "ocs": {
    "meta": {
      "status": "failure",
      "statuscode": 997,
      "message": "Unauthorised",
      "totalitems": "",
      "itemsperpage": ""
    },
    "data": []
  }
}

However, if either:

• "Activate TOTP" is not checked; or
• "Activate TOTP" is checked but the second-factor authentication code has not been verified, then I receive the following response (which I'd rather expect, to be fair).

{
  "ocs": {
    "meta": {
      "status": "failure",
      "statuscode": 404,
      "message": "OK",
      "totalitems": "",
      "itemsperpage": ""
    },
    "data": {
      "result": false
    }
  }
}

Test Installation Details

Component	Version
ownCloud version	ownCloud 10.2.1 (stable)
Web server	Apache 2.4.29-1ubuntu4.6 amd64 (running on Ubuntu 18.04.2 LTS)
Database server	MariaDB 10.3.15-r0 (running on Alpine Linux edge, 3.10_alpha20190408)

[karakayasemi]

In your tests, you are activating totp for the admin and trying to use same admin account for api call. Currently, when 2FA is activated on an account, authorization with username-password is not possible via API's. The account should authenticate via App passwords when using API's. It is similar on clients. When 2FA is enabled for an user, the user can only login clients via app password.

So, either you can use app password on api call or you can disable 2FA for the admin and create another user for querying its totp validation.

[settermjd]

Thank you for the clarification.