Description

The code now checks if the user has TOTP configured. If so, the input is split by the last index of the '/' character, instead of every occurrence of the character. The #14 issue should be resolved in this branch. If there is no TOTP configured for the user, the logic remains the same as in the current master branch.

This code introduces two additional configuration options: realmapiusername and realmapiassword, which are required for the IsTOTPConfigured function to run flawlessly. These configurations describe a Keycloak service user that should be present in the realm and has at least the realm-management->view-users role assigned. This user is used to call the Keycloak admin API and check if the SSH user has TOTP configured.

Notes:

• There must be a Keycloak API user with realm-management->view-users role assigned if TOTP is configured.
• The config.toml should not be readable by non-admin users of the system (for example permissions should be set to 640) to prevent compromise Keycloak API user.
• Usernames must be unique within the Keycloak realm.
• There is a new dependency (gocloak)

Doubts:

• Not sure if the IsTOTPConfigured function should be in a separeted package file
• The configuration has changed, so the documentation should be updated (I can update the README if you want)

Fixes #14

Type of change

• Breaking change (new feature that would cause existing config to break TOTP)
• Breaking change (new dependency - gocloak)
• This change requires a documentation update

How Has This Been Tested?

• Running existing tests

This was tested by configuring PAM with this module to use a Keycloak instance. A bunch of users were tested with TOPT configured as well as with no TOTP configuration. Multiple occurrences of '/' were added to users passwords to test if splitting works correctly.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
  • I can update the README if you want me to
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have rebased my branch to include the latest changes from master