fix: enfore mfa (#21801)

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>

pkg/keystone/models/users.go

@@ -165,11 +165,20 @@ func (manager *SUserManager) InitializeData() error {
 			return errors.Wrap(err, "update")
 		}
 	}
-	err = manager.initSystemAccount()
-	if err != nil {
-		return errors.Wrap(err, "initSystemAccount")
+	{
+		err := manager.initSystemAccount()
+		if err != nil {
+			return errors.Wrap(err, "initSystemAccount")
+		}
 	}
-	return manager.initSysUser(context.TODO())
+	{
+		err := manager.initSysUser(context.TODO())
+		if err != nil {
+			return errors.Wrap(err, "initSystemAccount")
+		}
+	}
+
+	return nil
 }
 
 func (manager *SUserManager) initSystemAccount() error {
@@ -241,6 +250,30 @@ func (manager *SUserManager) initSysUser(ctx context.Context) error {
 	return nil
 }
 
+func (manager *SUserManager) EnforceUserMfa(ctx context.Context) error {
+	if options.Options.ForceEnableMfa != "all" {
+		return nil
+	}
+	q := manager.Query().IsFalse("enable_mfa")
+
+	users := make([]SUser, 0)
+	err := db.FetchModelObjects(manager, q, &users)
+	if err != nil {
+		return errors.Wrap(err, "FetchModelObjects")
+	}
+	for i := range users {
+		_, err := db.Update(&users[i], func() error {
+			users[i].EnableMfa = tristate.True
+			return nil
+		})
+		if err != nil {
+			return errors.Wrap(err, "update enable mfa")
+		}
+		logclient.AddSimpleActionLog(&users[i], logclient.ACT_UPDATE, "force enable mfa", GetDefaultAdminCred(), true)
+	}
+	return nil
+}
+
 /*
 Fetch extended userinfo by Id or name + domainId or name + domainName
 */
@@ -549,6 +582,11 @@ func (manager *SUserManager) ValidateCreateData(
 		return input, errors.Wrapf(err, "CheckSetPendingQuota")
 	}
 
+	if options.Options.ForceEnableMfa != "disable" {
+		boolTrue := true
+		input.EnableMfa = &boolTrue
+	}
+
 	return input, nil
 }
 
@@ -590,6 +628,10 @@ func (user *SUser) ValidateUpdateData(ctx context.Context, userCred mcclient.Tok
 			return input, httperrors.NewInputParameterError("invalid password: %s", err)
 		}
 	}
+	if options.Options.ForceEnableMfa != "disable" {
+		boolTrue := true
+		input.EnableMfa = &boolTrue
+	}
 	var err error
 	input.EnabledIdentityBaseUpdateInput, err = user.SEnabledIdentityBaseResource.ValidateUpdateData(ctx, userCred, query, input.EnabledIdentityBaseUpdateInput)
 	if err != nil {

pkg/keystone/options/options.go

@@ -79,6 +79,8 @@ type SKeystoneOptions struct {
 
 	MaxUserRolesInProject  int `help:"maximal allowed roles of a user in a project" default:"20"`
 	MaxGroupRolesInProject int `help:"maximal allowed roles of a group in a project" default:"20"`
+
+	ForceEnableMfa string `help:"force enable mfa" default:"disable" choices:"all|after|disable"`
 }
 
 var (
@@ -102,5 +104,9 @@ func OnOptionsChange(oldOptions, newOptions interface{}) bool {
 		changed = true
 	}
 
+	if oldOpts.ForceEnableMfa != newOpts.ForceEnableMfa {
+		changed = true
+	}
+
 	return changed
 }

pkg/keystone/service/service.go

@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
 	_ "yunion.io/x/sqlchemy/backends"
 
 	api "yunion.io/x/onecloud/pkg/apis/identity"
@@ -92,6 +93,13 @@ func StartService() {
 
 	common_options.StartOptionManagerWithSessionDriver(opts, opts.ConfigSyncPeriodSeconds, api.SERVICE_TYPE, "", options.OnOptionsChange, models.NewServiceConfigSession())
 
+	{
+		err := models.UserManager.EnforceUserMfa(context.Background())
+		if err != nil {
+			log.Errorf("EnforceUserMfa fail %s", err)
+		}
+	}
+
 	cache.Init(opts.TokenExpirationSeconds)
 
 	if !opts.IsSlaveNode {