Added check for MFA #27
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@SunnyCrockett Please provided full output of your String |
marcelmamula
requested changes
Mar 27, 2025
There was a problem hiding this comment.
@sean-freeman @SunnyCrockett
This change does not work because str(res.content) is invalid. Please check your json response and improve its handling.
I do not have MFA enabled on my S-User, but it fails with error below.
msg: 'An exception has occurred - Expecting value: line 1 column 1 (char 0)'
My C-User with MFA does not get this error, because it gets stuck on real RSA MFA during SSO attempt (not this request check).
Tested with file 19118000000000008988 that was able to reproduce this error consistently. Other smaller files were not having consistent results.
|
Hi @marcelmamula
|
|
@SunnyCrockett @sean-freeman I am not able to see attached file that you wanted to show. I have done more tests and I was able to isolate few files that are behaving 100% same in each scenario so they can be used for testing: - '19118000000000008988' # Does not work with MFA
- 'S4CORE108_INST_EXPORT_23.zip' # Does not work with MFA
- 'SAPHOSTAGENT62_62-80004822.SAR' # Works with MFA
- 'IMDB_CLIENT20_024_21-80002082.SAR' # Works with MFATest results: Download will never finish if this is added. It goes into 60 second timeout resulting in failed: [localhost] (item=19118000000000008988 : MODULE FAILURE: No start of json char found
See stdout/stderr for the exact error) =>
ansible_loop_var: item
changed: false
item: '19118000000000008988'
module_stderr: ''
module_stdout: ''
msg: |-
MODULE FAILURE: No start of json char found
See stdout/stderr for the exact error
rc: 137
failed: [localhost] (item=S4CORE108_INST_EXPORT_23.zip : MODULE FAILURE: No start of json char found
See stdout/stderr for the exact error) =>
ansible_loop_var: item
changed: false
item: S4CORE108_INST_EXPORT_23.zip
module_stderr: ''
module_stdout: ''
msg: |-
MODULE FAILURE: No start of json char found
See stdout/stderr for the exact error
rc: 137NOTE: Condition above MFA IF section is also not working. If you remove RC check, then it also has syntax error! failed: [localhost] (item=19118000000000008988 : An exception has occurred - Expecting value: line 1 column 1 (char 0)) =>
alternative: false
ansible_loop_var: item
changed: false
filename: '19118000000000008988'
item: '19118000000000008988'
msg: 'An exception has occurred - Expecting value: line 1 column 1 (char 0)' |
|
I have tested to download file SAPHOSTAGENT62_62-80004822.SAR with MFA activated, without luck. Please feel free to decline/delete my pull request, as it seems like the "solution" is only working for me. This is the content: <!DOCTYPE html>
<html dir=\'ltr\' lang=\'en\'>
<head>
<meta charset=\'utf-8\'>
<base href=\'https://accounts.sap.com\' target=\'_self\'>
<meta content=\'IE=edge\' http-equiv=\'X-UA-Compatible\'>
<meta content=\'width=device-width, initial-scale=1.0\' name=\'viewport\'>
<meta content=\'universalui\' name=\'uitype\'>
<meta content=\'noindex, nofollow\' name=\'robots\'>
<meta content=\'noindex, nofollow\' name=\'AdsBot-Google\'>
<title>SAP ONE Support Launchpad: Two-Factor Authentication</title>
<div style=\'width: 0; height: 0; overflow: hidden; position: absolute;\'></div>
<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="AAAAAAAAAAAA/BBBBBBBBBBBBB/CCCCCCCC+Q==" />
<!-- third party cookies check --><!-- same origin protection check -->
</head>
<body style=\'justify-content: center\'>
<div data-brandingType=\'theme_fiori\' data-page=\'ids-two_factor_choice/logon\' id=\'body\' style=\'display:none\'>
<main class=\'ids-main\'>
<div class=\'ids-main__content\'>
<div class=\'iam-container__header\'>
<div class=\'iam-login-columned\'>
<div class=\'iam-login-columned__begin\'>
<div class=\'ids-login-tenant__logo\'><img alt=" logo" style="height:26px; width:auto" src="https://accounts.sap.com/ui/public/cached/tenant/v/2/tenant_logo" /></div>
</div>
<div class=\'iam-login-columned__end\'></div>
</div>
<div class=\'iam-container__title\'>
<h1 class=\'ids-heading-1 ids-heading-1--login\' id=\'ids-heading-1\'>Choose Two-Factor Authentication Method</h1>
</div>
<div class=\'iam-container__subtitle\'>
<h2>Account: my@mailaddress.de</h2>
</div>
</div>
<div class=\'iam-container__body\'>
<div aria-labelledby=\'ids-heading-1\' class=\'ids-container\' role=\'dialog\'>
<form action=\'/saml2/idp/acs\' autocomplete=\'off\' class=\'ids-form ids-form--horizontal\' id=\'secondFactorForm\' method=\'post\' role=\'form\'>
<div class=\'js-global-flashes-area\' id=\'globalMessages\'></div>
<p id=\'test-tfa-message\'>Please choose one of the enabled two-factor authentication methods or press the button to enable a new method.</p>
<div class=\'ids-input-area fd-has-display-none\'>
<fieldset class=\'ids-fieldset fn-fieldset\'>
<div class=\'fd-form-item ids-input-group ids-input-group--text\' id=\'j_username-group\'>
<div class=\'ids-label-container\'> <span class=\'ids-label-wrap\'>
<label class=\'fn-label ids-label\' for=\'j_username\' id=\'j_username-label\'> E-Mail, ID, or Login Name </label>
</span>
</div>
<div class=\'ids-control-container fd-form-input-message-group fd-popover
fd-popover--input-message-group\'>
<div class=\'fd-popover__control\'>
<div class=\'fd-input-group\'>
<div class=\'fn-input\'> <input class=\'fn-input__text-field
ids-input ids-input--text ids-input--clear
js-has-input-clear\' id=\'j_username\' name=\'j_username\'
readonly=\'readonly\' type=\'text\'
value=\'my@mailaddress.de\'>
<div class=\'fn-input__border\'></div>
</div>
</div>
</div> <a class=\'ids-input-clear js-input-clear\' href=\'#\'
tabindex=\'-1\'></a>
</div>
</div>
</fieldset>
</div>
<div class=\'ids-input-area\'>
<fieldset class=\'ids-fieldset fn-fieldset\'>
<input
type="hidden"
id="hidden-xsrfProtection-field" name="xsrfProtection"
value="AAAAAAAAAAAA"><input
type="hidden" name="method" value="POST"><input type="hidden"
name="idpSSOEndpoint" value="https://accounts.sap.com/saml2/idp/acs"><input
type="hidden" name="RelayState" value="__HOST-arc1a07cd"><input id=\'spId\'
name=\'spId\' type=\'hidden\' value=\'XXXX5985e4b07dc3abdfXXXX\'><input
id=\'spName\' name=\'spName\' type=\'hidden\'
value=\'https://hana.ondemand.com/supportportal\'><input id=\'tfaToken\'
name=\'tfaToken\' type=\'hidden\'
value=\'AAAAAAAAAAAA\'><input
id=\'tfaChoice\' name=\'tfaChoice\' type=\'hidden\' value=\'\'></input><input
id=\'activateNewTfaDevice\' name=\'activateNewTfaDevice\' type=\'hidden\'
value=\'\'><input id=\'firstTfaMethodChoiceSuccess\'
name=\'firstTfaMethodChoiceSuccess\' type=\'hidden\' value=\'\'
>
<section class=\'ids-section ids-section--profile js-tfa-choice-methods\'>
<form class="ids-form ids-form--horizontal" role="form" id="chooseTwoFactorMethodForm" action="chooseTwoFactorMethod"
accept-charset="UTF-8" data-remote="true" method="post">
<input name="utf8" type="hidden" value="✓" autocomplete="off" />
<div class=\'js-section-flashes-area\'></div>
<ul class=\'ids-list ids-list-borders iam-verification-list\'>
<li class=\'ids-list__item fd-margin-top--tiny\'>
<button
class=\'ids-status ids-status--totp ids-status--button
ids-button fn-button fn-button--secondary
ids-button--transparent\' id=\'tfaChoiceTotpButton\'
name=\'tfaChoiceTOTP\' type=\'submit\' value=\'true\'>
<div class=\'fn-button__text\'>TOTP Two-Factor Authentication
</div>
</button>
</li>
<li class=\'ids-list__item fd-margin-top--tiny\'>
<button
class=\'ids-status ids-status--sms ids-status--button ids-button
fn-button fn-button--secondary ids-button--transparent\'
disabled id=\'tfaChoiceSmsButton\' name=\'tfaChoiceSMS\'
type=\'submit\' value=\'true\'>
<div class=\'fn-button__text\'>SMS Two-Factor Authentication
</div>
</button>
</li>
<li class=\'ids-list__item fd-margin-top--tiny\'>
<button
class=\'ids-status ids-status--webauth ids-status--button
ids-button fn-button fn-button--secondary
ids-button--transparent\' disabled id=\'tfaChoiceWebButton\'
name=\'tfaChoiceWEB\' type=\'submit\' value=\'true\'>
<div class=\'fn-button__text\'>WEB Two-Factor Authentication
</div>
</button>
</li>
</ul>
</form>
</section>
</fieldset>
</div>
</form>
</div>
</div>
<div class=\'iam-container__footer\'>
<div class=\'iam-login-columned\'>
<div class=\'iam-login-columned__begin\'></div>
<div class=\'iam-login-columned__end\'>
<div class=\'ids-button-group\'><button class=\'ids-button fn-button ids-button--primary
fn-button--emphasized\' form=\'secondFactorForm\'
id=\'tfaChoiceActivateAnotherDeviceButton\' name=\'tfaChoiceActivateAnotherDevice\'
type=\'submit\' value=\'true\'>
<div class=\'fn-button__text\'>Enable Method</div>
</button></div>
</div>
</div>
</div>
</div>
</main>
</div>
<script src="/universalui/assets/application-f0eb0890e5394a3ad0aff080fe961cd05c2f573162ddd9cdc751facefc988b84.js"></script>
<script nonce=\'LQ5pJ7jfhfDjHEey3iAuski9ZV57UDshYUAHDCE5B4U=\'>$.ids.overlay.isClickjackingProtectEnabled = true;</script>
<script nonce=\'LQ5pJ7jfhfDjHEey3iAuski9ZV57UDshYUAHDCE5B4U=\'>$(document).ready(function ()
{
if (document.getElementById("secondFactorForm") || document.getElementById("verifyPhoneForm"))
{ var isVerifyPhoneView = document.getElementById("smsCode"); if (isVerifyPhoneView) { $("#smsCode").focus(); }
else
{ $("#j_otpcode").focus(); }
}
else { var element = $(\'form :input:visible:not([readonly]):not([disabled]):not(.fn-button--layout):first\');
if (element && element.attr("id") !== "newPasswordInput") { element.focus();
}
}
}
)</script>
</body>
</html> |
|
@SunnyCrockett Please make sure to test 2 CD Media files that never work. SAPHOSTAGENT and HANA CLIENT I listed are working fine. All these 4 files are on SAP download site, for example:
|
|
Note: looking for these may be easier?
Instead of searching for TFA methods:
|
|
Problem is not with what to look for, but rather where to look. Neither solution works so it needs proper investigation and review to see output request format because:
|
|
That's why you can see it parsed elsewhere as
|
|
@SunnyCrockett I did some test now and I can confirm that this is not causing issue. Can you test if it catches your MFA account? I would love to add return code there, but I dont see it in your response. What code did you get? if 'Two-Factor Authentication' in res.text:
raise Exception(f'The SAP ID is enabled for two-factor authentication (MFA). Please disable MFA under https://accounts.sap.com/ and try again.') |
|
@SunnyCrockett I am using this to get content |
|
Here you find my output of the ValueError requests by @marcelmamula |
|
@SunnyCrockett Thank you for this PR, but we cannot accept it because:
Problem: Executing Fuzzy search using I am updating this function with extra check as well as explanation for future reference # Validating against `res.text` can cause long execution time, because fuzzy search result can contain large `res.text`.
# This can be prevented by validating `res.status_code` check before `res.text`.
# Example: 'Two-Factor Authentication' is only in `res.text`, which can lead to long execution.
if res.status_code == 403:
if 'You are not authorized to download this file' in res.text:
raise Exception(f'You are not authorized to download this file.')
elif 'Account Temporarily Locked Out' in res.text:
raise Exception(f'Account Temporarily Locked Out. Please reset password to regain access and try again.')
else:
res.raise_for_status()
if res.status_code == 404:
if 'The file you have requested cannot be found' in res.text:
raise Exception(f'The file you have requested cannot be found.')
else:
res.raise_for_status() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the S-User has MFA activated, it is not possible to use it for download. I added a check in _request to check if "WEB Two-Factor Authentication" is in the content of the web request.