starred/tacticalrmm

Fork 0

mirror of https://github.com/amidaware/tacticalrmm.git synced 2026-04-26 06:55:52 +03:00

[GH-ISSUE #618] Feature: use login token for meshcentral integration #396

New issue

Open

opened 2026-03-02 02:16:02 +03:00 by kerem · 5 comments

kerem commented

2026-03-02 02:16:02 +03:00

Owner

Originally created by @bbrendon on GitHub (Jul 4, 2021).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/618

I would like to require mesh to have 2fa enabled ("force2factor": true) but not break the integration with tactical.

Mesh has the ability to force 2fa but enabling it breaks the integration with tactical. From my understanding, in order to to resolve this tactical can use login tokens for the mesh API.
https://github.com/Ylianst/MeshCentral/issues/2859#issuecomment-873631301

Originally created by @bbrendon on GitHub (Jul 4, 2021). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/618 I would like to require mesh to have 2fa enabled ("force2factor": true) but not break the integration with tactical. Mesh has the ability to force 2fa but enabling it breaks the integration with tactical. From my understanding, in order to to resolve this tactical can use login tokens for the mesh API. https://github.com/Ylianst/MeshCentral/issues/2859#issuecomment-873631301

kerem added the

integration

dev-triage

labels

2026-03-02 02:16:02 +03:00

kerem commented

2026-03-02 02:16:03 +03:00

Author

Owner

@wh1te909 commented on GitHub (Jul 21, 2021):

tactical is already using login tokens that's how we integrate with mesh

i just tried adding "force2factor": true to my config.json, restarted mesh and confirmed didn't break anything. iframe integration still works. but when trying to login now with just username/pass from the mesh login screen, am prompted for 2 factor. not sure why it's breaking for you, can you post your config.json

@wh1te909 commented on GitHub (Jul 21, 2021): tactical is already using login tokens that's how we integrate with mesh i just tried adding `"force2factor": true` to my config.json, restarted mesh and confirmed didn't break anything. iframe integration still works. but when trying to login now with just username/pass from the mesh login screen, am prompted for 2 factor. not sure why it's breaking for you, can you post your config.json

kerem commented

2026-03-02 02:16:03 +03:00

Author

Owner

@bbrendon commented on GitHub (Jul 21, 2021):

Sorry, I should have been more specific...

There is an auth-popup with breaks the seamlessness of the integration.

Also, even though I'm logged into the mesh interface using 2fa in one browser tab, when I go to Tactical and it opens a mesh iframe, I get this...

So maybe the admin account needs 2fa? And the 2fa sign-up QR Code needs to be saved and sent to all the users? But then that goes back to sharing accounts which kind of defeats the purpose.

All of this seems backwards. It seems like each user should input their mesh API token into Tactical that creates the integration.

{
  "settings": {
    "Cert": " . .com",
    "MongoDb": "mongodb://127.0.0.1:27017",
    "MongoDbName": "meshcentral",
    "WANonly": true,
    "Minify": 1,
    "Port": 4430,
    "AliasPort": 443,
    "RedirPort": 800,
    "AllowLoginToken": true,
    "AllowFraming": true,
    "_AgentPing": 60,
    "AgentPong": 200,
    "AllowHighQualityDesktop": true,
    "TlsOffload": "127.0.0.1",
    "agentCoreDump": false,
    "Compression": true,
    "WsCompression": true,
    "AgentWsCompression": true,
    "MaxInvalidLogin": { "time": 5, "count": 5, "coolofftime": 30 }
  },
  "domains": {
    "": {
      "Title": "  RMM",
      "Title2": "  RMM",
      "NewAccounts": false,
      "CertUrl": "https:// .com:443/",
      "GeoLocation": true,
      "CookieIpCheck": false,
      "mstsc": true,
      "PasswordRequirements": {         "force2factor": true       }
    }
  }
}

@bbrendon commented on GitHub (Jul 21, 2021): Sorry, I should have been more specific... There is an auth-popup with breaks the seamlessness of the integration. Also, even though I'm logged into the mesh interface using 2fa in one browser tab, when I go to Tactical and it opens a mesh iframe, I get this... ![image](https://user-images.githubusercontent.com/6364477/126533192-f360ec1a-b9e7-490b-af99-abe3d6570bd9.png) So maybe the admin account needs 2fa? And the 2fa sign-up QR Code needs to be saved and sent to all the users? But then that goes back to sharing accounts which kind of defeats the purpose. All of this seems backwards. It seems like each user should input their mesh API token into Tactical that creates the integration. ``` { "settings": { "Cert": " . .com", "MongoDb": "mongodb://127.0.0.1:27017", "MongoDbName": "meshcentral", "WANonly": true, "Minify": 1, "Port": 4430, "AliasPort": 443, "RedirPort": 800, "AllowLoginToken": true, "AllowFraming": true, "_AgentPing": 60, "AgentPong": 200, "AllowHighQualityDesktop": true, "TlsOffload": "127.0.0.1", "agentCoreDump": false, "Compression": true, "WsCompression": true, "AgentWsCompression": true, "MaxInvalidLogin": { "time": 5, "count": 5, "coolofftime": 30 } }, "domains": { "": { "Title": " RMM", "Title2": " RMM", "NewAccounts": false, "CertUrl": "https:// .com:443/", "GeoLocation": true, "CookieIpCheck": false, "mstsc": true, "PasswordRequirements": { "force2factor": true } } } } ```

kerem commented

2026-03-02 02:16:03 +03:00

Author

Owner

@bbrendon commented on GitHub (Sep 23, 2021):

I just noticed this issue which might be related. https://github.com/wh1te909/tacticalrmm/issues/182

@bbrendon commented on GitHub (Sep 23, 2021): I just noticed this issue which might be related. https://github.com/wh1te909/tacticalrmm/issues/182

kerem commented

2026-03-02 02:16:03 +03:00

Author

Owner

@dinger1986 commented on GitHub (Oct 11, 2021):

A decent work round for now is:

Create a user on mesh
Take them through logging into mesh
Get them to setup mfa
As an admin go into user settings, click on User (far right on username).
Tick Box Lock Account Settings

They now can’t disable MFA

@dinger1986 commented on GitHub (Oct 11, 2021): A decent work round for now is: 1. Create a user on mesh 2. Take them through logging into mesh 3. Get them to setup mfa 4. As an admin go into user settings, click on User (far right on username). 5. Tick Box Lock Account Settings They now can’t disable MFA

kerem commented

2026-03-02 02:16:03 +03:00

Author

Owner

@fts-tmassey commented on GitHub (Apr 11, 2022):

Sorry: this isn't the right issue for this, though it is relevant. Moved comment to https://github.com/amidaware/tacticalrmm/issues/182#issuecomment-1095422533

tl;dr: Adding PR #981 allows admin to manage remote control permissions for the techs individually; adding ability to add mesh_device_group to site in addition to globally allows TRMM to automatically put the device in the right Mesh group, which gives you 100% permission control with zero ongoing manual effort.

Sorry for the extra noise. Too many open tabs! :)

@fts-tmassey commented on GitHub (Apr 11, 2022): Sorry: this isn't the right issue for this, though it is relevant. Moved comment to https://github.com/amidaware/tacticalrmm/issues/182#issuecomment-1095422533 tl;dr: Adding PR #981 allows admin to manage remote control permissions for the techs individually; adding ability to add mesh_device_group to site in addition to globally allows TRMM to automatically put the device in the right Mesh group, which gives you 100% permission control with zero ongoing manual effort. Sorry for the extra noise. Too many open tabs! :)

kerem referenced this issue

2026-03-14 02:55:09 +03:00

[GH-ISSUE #396] Patch Management - cannot disable schedules #2187