starred/proxmoxer
1
0
Fork 0
mirror of https://github.com/proxmoxer/proxmoxer.git synced 2026-04-25 07:06:00 +03:00
Code Issues 19 Projects Releases 10 Packages Wiki Activity

[GH-ISSUE #156] Weird OTP problem #82

New issue
Closed
opened 2026-02-27 15:46:19 +03:00 by kerem · 12 comments
kerem commented 2026-02-27 15:46:19 +03:00
Owner
Copy link

Originally created by @addelovein on GitHub (Jan 24, 2024).
Original GitHub issue: https://github.com/proxmoxer/proxmoxer/issues/156

Originally assigned to: @jhollowe on GitHub.

Most likely im doing something wrong...

import proxmoxer
username = "user@pve"
passwd = "pass123"
totp=639359
print( username, passwd, totp )
proxmox = proxmoxer.ProxmoxAPI(
                    host="MYHOST",
                    user=username,
                    password=passwd,
                    otp=totp,
                    verify_ssl=True,
                    port=443
                )
print(proxmox.get("cluster/options"))

Returns
proxmoxer.core.AuthenticationError: Couldn't authenticate user: user@pve to https://MYHOST:443/api2/json/access/ticket

If i remove OTP and try a user without TFA... It logs in.
The user that fails can log in directly to proxmox using OTP
The failing user works if i remove TFA from proxmox and OTP here...

Am i missing someting? Going a bit crazy here....

Originally created by @addelovein on GitHub (Jan 24, 2024). Original GitHub issue: https://github.com/proxmoxer/proxmoxer/issues/156 Originally assigned to: @jhollowe on GitHub. Most likely im doing something wrong... ``` import proxmoxer username = "user@pve" passwd = "pass123" totp=639359 print( username, passwd, totp ) proxmox = proxmoxer.ProxmoxAPI( host="MYHOST", user=username, password=passwd, otp=totp, verify_ssl=True, port=443 ) print(proxmox.get("cluster/options")) ``` **Returns** proxmoxer.core.AuthenticationError: Couldn't authenticate user: user@pve to https://MYHOST:443/api2/json/access/ticket If i remove OTP and try a user without TFA... It logs in. The user that fails can log in directly to proxmox using OTP The failing user works if i remove TFA from proxmox and OTP here... Am i missing someting? Going a bit crazy here....
kerem 2026-02-27 15:46:19 +03:00
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@addelovein commented on GitHub (Jan 24, 2024):

    proxmox = proxmoxer.ProxmoxAPI(
              ^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\core.py", line 210, in __init__
    self._backend = importlib.import_module(f".backends.{backend}", "proxmoxer").Backend(
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\backends\https.py", line 302, in __init__
    self.auth = ProxmoxHTTPAuth(
                ^^^^^^^^^^^^^^^^
  File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\backends\https.py", line 59, in __init__
    self._get_new_tokens(password=password, otp=otp)
  File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\backends\https.py", line 77, in _get_new_tokens
    raise AuthenticationError(
proxmoxer.core.AuthenticationError: Couldn't authenticate use```
<!-- gh-comment-id:1907237352 --> @addelovein commented on GitHub (Jan 24, 2024): ``` File "c:\Users\AddeLovein\source\repos\pveclient\test.py", line 6, in <module> proxmox = proxmoxer.ProxmoxAPI( ^^^^^^^^^^^^^^^^^^^^^ File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\core.py", line 210, in __init__ self._backend = importlib.import_module(f".backends.{backend}", "proxmoxer").Backend( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\backends\https.py", line 302, in __init__ self.auth = ProxmoxHTTPAuth( ^^^^^^^^^^^^^^^^ File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\backends\https.py", line 59, in __init__ self._get_new_tokens(password=password, otp=otp) File "C:\Users\AddeLovein\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\proxmoxer\backends\https.py", line 77, in _get_new_tokens raise AuthenticationError( proxmoxer.core.AuthenticationError: Couldn't authenticate use```
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@jhollowe commented on GitHub (Jan 24, 2024):

Please try having the OTP be a strongstring rather than an integer. I don't know if that is the issue, but I think it might be

<!-- gh-comment-id:1907317973 --> @jhollowe commented on GitHub (Jan 24, 2024): Please try having the OTP be a ~~strong~~string rather than an integer. I don't know if that is the issue, but I think it might be
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@addelovein commented on GitHub (Jan 24, 2024):

strong

Same issue if I declare totp with totp="292695"

<!-- gh-comment-id:1907608391 --> @addelovein commented on GitHub (Jan 24, 2024): > strong Same issue if I declare totp with totp="292695"
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@jhollowe commented on GitHub (Jan 27, 2024):

Can you look at the network traffic in your browser and see what data the api2/json/access/ticket request has?

<!-- gh-comment-id:1913038314 --> @jhollowe commented on GitHub (Jan 27, 2024): Can you look at the network traffic in your browser and see what data the `api2/json/access/ticket` request has?
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@addelovein commented on GitHub (Jan 27, 2024):

You mean when I log in to proxmox via browser?

First ticket:

Request

username: adde
password: test123
realm: pve
new-format: 1

Response

{
    "success": 1,
    "data": {
        "ticket": "PVE:!tfa!{\"totp\"%3Atrue}:***********::JElr2K5oW2*************************BbxjQsa/HvhIfYrfoe*********************ULU57YW1S9pvD417VesGsKWLMLnXllg9CKSO9k*****************lSLEu7OUikT78mZ56JIIMw1IMyUXBV35+TpkR0wyZ0Lb28VpAnsFOABOqd5vZGT1e7N1ZJEx7QEXDBSqH7vhnSu0Qk1CSUQQfgyOy0V/x1GLQqLbj0jF3elamU69KiR*************************g==",
        "username": "adde@pve",
        "NeedTFA": 1,
        "CSRFPreventionToken": "65B4DD50:URrwhOOq+7tWqbOsBW6Xg2EJ3yn24R05XRqV9PpsOTc"
    }
}

Second Ticket (The Real Authentication)

Request

username: adde@pve
tfa-challenge: PVE:!tfa!{"totp"%3Atrue}:***********::JElr2K5oW2*************************BbxjQsa/HvhIfYrfoe*********************ULU57YW1S9pvD417VesGsKWLMLnXllg9CKSO9k*****************lSLEu7OUikT78mZ56JIIMw1IMyUXBV35+TpkR0wyZ0Lb28VpAnsFOABOqd5vZGT1e7N1ZJEx7QEXDBSqH7vhnSu0Qk1CSUQQfgyOy0V/x1GLQqLbj0jF3elamU69KiR*************************g=="
password: totp:473543

Response
Authenticated.....

That should be enough data ;-)

<!-- gh-comment-id:1913112805 --> @addelovein commented on GitHub (Jan 27, 2024): You mean when I log in to proxmox via browser? ### First ticket: **Request** ``` username: adde password: test123 realm: pve new-format: 1 ``` **Response** ``` { "success": 1, "data": { "ticket": "PVE:!tfa!{\"totp\"%3Atrue}:***********::JElr2K5oW2*************************BbxjQsa/HvhIfYrfoe*********************ULU57YW1S9pvD417VesGsKWLMLnXllg9CKSO9k*****************lSLEu7OUikT78mZ56JIIMw1IMyUXBV35+TpkR0wyZ0Lb28VpAnsFOABOqd5vZGT1e7N1ZJEx7QEXDBSqH7vhnSu0Qk1CSUQQfgyOy0V/x1GLQqLbj0jF3elamU69KiR*************************g==", "username": "adde@pve", "NeedTFA": 1, "CSRFPreventionToken": "65B4DD50:URrwhOOq+7tWqbOsBW6Xg2EJ3yn24R05XRqV9PpsOTc" } } ``` ### Second Ticket (The Real Authentication) **Request** ``` username: adde@pve tfa-challenge: PVE:!tfa!{"totp"%3Atrue}:***********::JElr2K5oW2*************************BbxjQsa/HvhIfYrfoe*********************ULU57YW1S9pvD417VesGsKWLMLnXllg9CKSO9k*****************lSLEu7OUikT78mZ56JIIMw1IMyUXBV35+TpkR0wyZ0Lb28VpAnsFOABOqd5vZGT1e7N1ZJEx7QEXDBSqH7vhnSu0Qk1CSUQQfgyOy0V/x1GLQqLbj0jF3elamU69KiR*************************g==" password: totp:473543 ``` **Response** Authenticated..... That should be enough data ;-)
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@jhollowe commented on GitHub (Jan 31, 2024):

I'm not sure. You might try asking in the proxmox forums how to pass OTP values to the api2/json/access/ticket API endpoint. proxmoxer does not do the two-step OTP process and instead just passes the username, password, and OTP all in one request. This may be no longer supported by the Proxmox auth layer and we may need to adjust the login flow if an OTP value is provided.

<!-- gh-comment-id:1918124793 --> @jhollowe commented on GitHub (Jan 31, 2024): I'm not sure. You might try asking in the proxmox forums how to pass OTP values to the `api2/json/access/ticket` API endpoint. proxmoxer does not do the two-step OTP process and instead just passes the username, password, and OTP all in one request. This may be no longer supported by the Proxmox auth layer and we may need to adjust the login flow if an OTP value is provided.
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@addelovein commented on GitHub (Jan 31, 2024):

It sure is supported, this code works... Just wrote it based of how proxmox itself authenticates its webui...

import sys
import requests, json

pvehost = "pve.yourdomain.se"
pveport = "8006"
username = "adde"
password = "test123"
realm = "pve"


headers = {'Content-Type': 'application/x-www-form-urlencoded'}

data = {"realm": realm, "username": username, "password": password, "new-format": 1}
print("\nSending Payload: ", data)
r = requests.post(f'https://{pvehost}:{pveport}/api2/json/access/ticket', headers=headers, data=data, verify=True)
if r.status_code!=200:
    print("Auth Failed at Step One, cant proceed with OTP")
    sys.exit()

bytes_value = r.content
jsonval = bytes_value.decode('utf8').replace("'", '"')
jsondata = json.loads(jsonval)
print("RESPONSE: ",jsondata['data'])

ticket = jsondata['data']['ticket']
code = input("\n\tEnter your value: ") 

totp={"tfa-challenge" : ticket, "username": username, "password": f"totp:{code}","realm": realm }

print("\nSending Payload: ", totp)
r2 = requests.post(f'https://{pvehost}:{pveport}/api2/json/access/ticket', headers=headers, data=totp, verify=True)
bytes_value = r2.content
jsonval = bytes_value.decode('utf8').replace("'", '"')
jsondata = json.loads(jsonval)


if r2.status_code==200:
        print("Auth Success: ", r2.json)
else:
        print("Auth Failed: ", r2.json)
<!-- gh-comment-id:1919915496 --> @addelovein commented on GitHub (Jan 31, 2024): It sure is supported, this code works... Just wrote it based of how proxmox itself authenticates its webui... ``` import sys import requests, json pvehost = "pve.yourdomain.se" pveport = "8006" username = "adde" password = "test123" realm = "pve" headers = {'Content-Type': 'application/x-www-form-urlencoded'} data = {"realm": realm, "username": username, "password": password, "new-format": 1} print("\nSending Payload: ", data) r = requests.post(f'https://{pvehost}:{pveport}/api2/json/access/ticket', headers=headers, data=data, verify=True) if r.status_code!=200: print("Auth Failed at Step One, cant proceed with OTP") sys.exit() bytes_value = r.content jsonval = bytes_value.decode('utf8').replace("'", '"') jsondata = json.loads(jsonval) print("RESPONSE: ",jsondata['data']) ticket = jsondata['data']['ticket'] code = input("\n\tEnter your value: ") totp={"tfa-challenge" : ticket, "username": username, "password": f"totp:{code}","realm": realm } print("\nSending Payload: ", totp) r2 = requests.post(f'https://{pvehost}:{pveport}/api2/json/access/ticket', headers=headers, data=totp, verify=True) bytes_value = r2.content jsonval = bytes_value.decode('utf8').replace("'", '"') jsondata = json.loads(jsonval) if r2.status_code==200: print("Auth Success: ", r2.json) else: print("Auth Failed: ", r2.json) ```
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@addelovein commented on GitHub (Feb 17, 2024):

No response on this at all?

<!-- gh-comment-id:1950385933 --> @addelovein commented on GitHub (Feb 17, 2024): No response on this at all?
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@jpattWPC commented on GitHub (Feb 18, 2024):

I added #158 to address this on the HTTPS backend. Please let me know if this can be merged into a release.

<!-- gh-comment-id:1951472791 --> @jpattWPC commented on GitHub (Feb 18, 2024): I added #158 to address this on the HTTPS backend. Please let me know if this can be merged into a release.
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@jhollowe commented on GitHub (Feb 22, 2024):

@addelovein sorry for the slow response, this fell off my radar.

Thanks @jpattWPC for the PR!

I've started a thread in the PVE forums to see if the single request flow is still supported or if this needs to move to the two-step flow:
https://forum.proxmox.com/threads/single-post-auth-with-otp-no-longer-supported.141830/

<!-- gh-comment-id:1958584312 --> @jhollowe commented on GitHub (Feb 22, 2024): @addelovein sorry for the slow response, this fell off my radar. Thanks @jpattWPC for the PR! I've started a thread in the PVE forums to see if the single request flow is still supported or if this needs to move to the two-step flow: https://forum.proxmox.com/threads/single-post-auth-with-otp-no-longer-supported.141830/
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@addelovein commented on GitHub (Mar 24, 2024):

I posted a working example...

<!-- gh-comment-id:2016996509 --> @addelovein commented on GitHub (Mar 24, 2024): I posted a working example...
kerem commented 2026-02-27 15:46:20 +03:00
Author
Owner
Copy link

@jpattWPC commented on GitHub (Mar 24, 2024):

I'm waiting on PR acceptance from the proxmoxer repo, you're correct that 2
step auth is now required. I submitted a PR to fix this issue in the
proxmoxer repo.

On Sun, Mar 24, 2024, 6:55 PM Adde Lovein @.***> wrote:

I posted a working example...

—
Reply to this email directly, view it on GitHub
https://github.com/proxmoxer/proxmoxer/issues/156#issuecomment-2016996509,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AD4U7MEG4CUHQJWR22Y2NU3YZ5RXTAVCNFSM6AAAAABCH7IHQ2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJWHE4TMNJQHE
.
You are receiving this because you were mentioned.Message ID:
@.***>

<!-- gh-comment-id:2016997918 --> @jpattWPC commented on GitHub (Mar 24, 2024): I'm waiting on PR acceptance from the proxmoxer repo, you're correct that 2 step auth is now required. I submitted a PR to fix this issue in the proxmoxer repo. On Sun, Mar 24, 2024, 6:55 PM Adde Lovein ***@***.***> wrote: > I posted a working example... > > — > Reply to this email directly, view it on GitHub > <https://github.com/proxmoxer/proxmoxer/issues/156#issuecomment-2016996509>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AD4U7MEG4CUHQJWR22Y2NU3YZ5RXTAVCNFSM6AAAAABCH7IHQ2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMJWHE4TMNJQHE> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
master
release/2.3.0
develop-1.x
2.3.0
2.2.0
2.1.0
2.0.1
2.0.0
1.3.1
1.3.0
1.2.0
1.1.1
1.1.0
1.0.4
1.0.3
0.2.6
0.2.5
0.2.4
0.2.3
0.2.2
0.2.1
0.2.0
0.1.8
0.1.7
0.1.6
0.1.5
0.1.4
0.1.3
0.1.2
0.1.1
0.1.0
Labels
Clear labels   
backend:https

   
backend:local

   
backend:openssh

   
backend:ssh_paramiko

   
pull-request

Mirrored from GitHub Pull Request

  
status:ansible-issue

   
status:help-wanted

   
status:info-needed

   
status:proxmox-issue

   
status:review-needed

   
type:bug 🐞

   
type:dependency ⛓️

   
type:docs 📝

   
type:enhancement ⏫

   
type:maintenance 🛠️

   
type:meta

   
type:question ❓

   
type:request ✋

   
type:testing 🧪

   
version:1.x

   
version:latest

   
version:py2

   
version:py3
No labels
backend:https
backend:local
backend:openssh
backend:ssh_paramiko
pull-request
status:ansible-issue
status:help-wanted
status:info-needed
status:proxmox-issue
status:review-needed
type:bug 🐞
type:dependency ⛓️
type:docs 📝
type:enhancement ⏫
type:maintenance 🛠️
type:meta
type:question ❓
type:request ✋
type:testing 🧪
version:1.x
version:latest
version:py2
version:py3
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/proxmoxer#82
No description provided.