Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Does not patch rest api #1 #4

Merged
merged 2 commits into from
Jan 12, 2021
Merged

Does not patch rest api #1 #4

merged 2 commits into from
Jan 12, 2021

Conversation

Jitheesh
Copy link
Contributor

  • Disable new admin token generate end point functionality for 2fa
  • allow merchants to use existing token generate service without enabling 2fa

@markshust
Copy link
Owner

Thank you @Jitheesh. Can you please list out steps that I can take to test this?

@Jitheesh
Copy link
Contributor Author

Hi @markshust

In 2.4.1, Magento changed api end point for admin token generate.

`Two-Factor Authentication is implemented for Magento Web APIs with the following changes:

AdminTokenServiceInterface::createAdminAccessToken() throws an exception when the Admin user doesn’t have personal 2FA configured, and also indicates that the confirmationh email has been sent.
AdminTokenServiceInterface::createAdminAccessToken() throws an exception that indicates which provider is configured for the user and suggests a provider-specific login endpoint.
2FA provider-specific endpoints allow each Admin user to configure a personal 2FA and provides tokens for username, password, and OTP (2FA code).`

So to disable 2fa from token generate api, I've re-enabled our previous token generate end point. ie, if you disable 2fa for token generate, you can continue to use existing end point. Otherwise you should configure 2fa and integrate new end point.

Test steps

  1. upgrade Magento to 2.4.1
  2. Try to generate admin token using rest api end point
    POST /V1/integration/admin/token
  3. Magento will return error
  4. Open store configuration and disable 2fa for token generate
  5. Try to generate admin token, it will respond with token

@alexbejan-mavfarm
Copy link

I can confirm that this fix works, can we merge it?

Copy link
Owner

@markshust markshust left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much for this PR! I'll try to make these updates very shortly, nothing technically changed besides some code styling issues.

Plugin/BypassWebApiTwoFactorAuth.php Outdated Show resolved Hide resolved
Plugin/BypassWebApiTwoFactorAuth.php Outdated Show resolved Hide resolved
etc/adminhtml/system.xml Outdated Show resolved Hide resolved
Plugin/BypassWebApiTwoFactorAuth.php Outdated Show resolved Hide resolved
Plugin/BypassWebApiTwoFactorAuth.php Outdated Show resolved Hide resolved
Plugin/BypassWebApiTwoFactorAuth.php Outdated Show resolved Hide resolved
@markshust
Copy link
Owner

I'm taking the updates, will be pushed momentarily

@markshust markshust linked an issue Jan 12, 2021 that may be closed by this pull request
@markshust markshust merged commit 635bbfe into markshust:master Jan 12, 2021
@Jitheesh
Copy link
Contributor Author

Thanks @markshust for your code styling suggestions, It is really helpful.

@cmacdonald-au
Copy link

Sorry to be "that guy who's late to the party with a problem" but these changes fail to parse with PHP7.3

Typed props only appeared in 7.4 - and I wouldn't mention it at all, except composer specifies php>=7.3

@markshust
Copy link
Owner

Thanks @cmacdonald-au and @Rud5G -- definitely a mistake on my part. Fixed that in #6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Does not patch rest api
5 participants