feature: users can be enrolled for TOTP one-time passwords.

README.md

@@ -331,6 +331,11 @@ is switched on:
   `/etc/vpn-router/ldap/user-manager.secret` (root only);
 - passwords are stored as ARGON2 hashes, and a disabled user is locked with the password policy
   (`pwdAccountLockedTime`);
+- slapd's `otp` module is loaded for the OATH-LDAP schema; a user enrolled for TOTP is also an
+  `oathTOTPUser` and `oathTOTPToken` whose `oathTOTPToken` names the entry itself, with the
+  secret in `oathSecret`, which the user manager account may set and no one can read, and
+  `oathTOTPParams` naming `cn=totp,ou=policies` (6 digits, HMAC-SHA1, 30 second steps, one step
+  of tolerance). The module's overlay is not configured, so binds take the password alone;
 - slapd listens on its local socket only (`SLAPD_SERVICES` in `/etc/default/slapd`).
 
 The directory is kept on purge.
@@ -340,8 +345,9 @@ The directory is kept on purge.
 `vpn-router-user` manages the users. A user is the directory entry, with a first name, a last
 name and an e-mail address (`givenName`, `sn` and `mail`; `cn` is the first and the last name),
 and a client certificate with the user name as its common name, in `/etc/vpn-router/pki/users`.
-Passwords are read from the first line of standard input. The answer is text: a table of the
-users, the client profile or a short message, and a failure is a message on standard error.
+Passwords and TOTP secrets are read from the first line of standard input. The answer is text: a
+table of the users, the client profile, a TOTP secret or a short message, and a failure is a
+message on standard error.
 `--json`, before the command, gives the answer as JSON on standard output, and a failure as
 `{"error": ...}` there too; the web service uses it. `-h` or `--help` shows the commands, and
 after a command its options.
@@ -356,21 +362,29 @@ echo 'n3w-pass' | vpn-router-user passwd alice
 vpn-router-user disable alice
 vpn-router-user enable alice
 vpn-router-user remove alice
+vpn-router-user otp-new alice
+echo 'JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP' | vpn-router-user otp-enrol alice 123456
+vpn-router-user otp-remove alice
 ```
 
 | Command | Effect |
 | --- | --- |
-| `list` | The users with their names and e-mail addresses, whether each is enabled and has a certificate |
+| `list` | The users with their names and e-mail addresses, whether each is enabled, has a certificate and is enrolled for TOTP |
 | `add <name> --first-name F --last-name L --email E` | Adds the user and issues the certificate; all three are required |
 | `update <name> [--first-name F] [--last-name L] [--email E]` | Changes the names or the e-mail address |
 | `passwd <name>` | Sets the password |
 | `disable <name>`, `enable <name>` | Locks the user out of OpenVPN, and lets the user in again |
 | `remove <name>` | Takes the user out of its groups, revokes the certificate, renews the CRL and removes the user; refused while the user is the last member of a group |
 | `profile <name>` | The OpenVPN client profile, with the CA, the certificate and the key inline |
+| `otp-new <name>` | A new TOTP secret and its `otpauth://` URI, issued by `wan.local_fqdn`, for an authenticator app; nothing is stored |
+| `otp-enrol <name> <code>` | Stores the secret read from standard input when the code is a current code of it, replacing a secret the user has |
+| `otp-remove <name>` | Removes the user's TOTP secret |
 
 A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter; a
 password has 8 to 128 characters; a first or last name has 1 to 64 printable characters; an
-e-mail address has one `@`, no spaces and a dot in its domain. In the answers a user added
+e-mail address has one `@`, no spaces and a dot in its domain; a TOTP secret is 32 base32
+characters, as `otp-new` makes it, and a code 6 digits. Enrolment does not change how users log
+in. In the answers a user added
 without the names or the e-mail address has them as `null`. The exit status is 0 on success, 2 for an invalid request,
 3 when the user does not exist, 4 when the user exists and 1 for any other failure.
 
@@ -521,7 +535,7 @@ and answer bodies are JSON; a request body is at most 4096 bytes.
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /users` | | `{"users": [{"name", "enabled", "certificate", "first_name", "last_name", "email"}, ...]}` |
+| `GET /users` | | `{"users": [{"name", "enabled", "certificate", "otp", "first_name", "last_name", "email"}, ...]}` |
 | `POST /users` | `{"name", "password", "first_name", "last_name", "email"}`, all required | 201 and the user |
 | `PUT /users/<name>` | any of `{"first_name", "last_name", "email"}` | the user |
 | `PUT /users/<name>/password` | `{"password": ...}` | the user |
@@ -529,11 +543,14 @@ and answer bodies are JSON; a request body is at most 4096 bytes.
 | `POST /users/<name>/enable` | | the user |
 | `DELETE /users/<name>` | | `{"name", "removed": true}` |
 | `GET /users/<name>/profile` | | `{"name", "profile"}`, the OpenVPN client profile |
+| `POST /users/<name>/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
+| `PUT /users/<name>/otp` | `{"secret", "code"}` | the user, once the code matches the secret |
+| `DELETE /users/<name>/otp` | | the user |
 
 A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
 exist, 409 for a user that exists and 500 otherwise. `/users` works whether or not OpenVPN or
-road-warrior access is enabled; the profile needs OpenVPN. Passwords and private keys cross the internal
-network in plain HTTP, like the token.
+road-warrior access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP
+secrets cross the internal network in plain HTTP, like the token.
 
 ```bash
 curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \