Restrict the use of the identification token to specific users

[Jayddee23]

Hello,

In my case, I have deactivated the use of tokens to prevent my service providers from logging in this way, but I would have liked to be able to use it for certain users only.

"domains": {
"": {
"siteStyle": 2,
"title": "**** MeshCentral",
"titlePicture": "titlePicture.png",
"loginPicture": "loginPicture.png",
"welcomePicture": "welcomePicture.png",
"welcomeText": "Bienvenue sur le serveur de télémaintenance du ",
"footer": "",
"loginFooter": "",
"agentCustomization": {
"displayName": "Assistance_Informatique",
"companyName": "",
"serviceName": "Assistance_Informatique",
"image": "logo_assistant.png"
},
"assistantCustomization": {
"title": "Assistance Informatique",
"image": "logo_assistant.png",
"_fileName": ""
},
"autoRemoveInactivesDevices":31,
"userSessionIdleTimeout": 60,
"_userAllowedIP": ["****"],
"passwordRequirements": {
"min": 12,
"upper": 1,
"lower": 1,
"numeric": 1,
"nonalpha": 1,
"reset": 180,
"oldPasswordBan": 10,
"banCommonPasswords": true,
"loginTokens": false
},
"twoFactorCookieDurationDays": 1
}
}

Is it possible to authorize it for certain users only in the config.json file?

Thanks for your help,
Best regards,

[si458]

Currently no (that im aware of)
the logintokens are enabled for all users if u enable them
So we would have to add something into the config.json like only allow these users/groups permission to have login token access so would be a feature request u could open in issues

IGNORE SEE OTHER COMMENT! IT IS POSSIBLE!

[si458]

i stand corrected ignore me! you can set loginTokens to an array and set each value to the users ID user//simon for example!

"loginTokens": {
  "type": [
    "boolean",
    "array"
  ],
  "default": true,
  "description": "Allows users to create alternative username/passwords for their account. Set to false to disallow all users, or set to a userid array to only allow some users."
},

[Jayddee23]

I'm looking for the right synthaxe but I lack practice in json.
For example, how can I declare that no user can generate a connection token except user//test1 and user//test2 ?
And do I have to stay in the passwordRequirements section to declare this?

[si458]

sorry so the example below will help,
basically you can specify

1. just a username test1
2. domain and username domain1/test2
3. full user id from ui user//test2
   example below shows test1 twice, but they refer to user//test1 and user/domain1/test1 if that makes sense
   so the same username can exist on 2 domains, but both wont cross as they only effect there domain

{
    "domains": {
        "": {
            "passwordRequirements": {
                "logintokens": [
                    "test1",
                    "user//test2"
                ]
            }
        },
        "domain1": {
            "title": "Domain1Title",
            "passwordRequirements": {
                "logintokens": [
                    "test1",
                    "domain1/test2",
                    "user/domain1/test2"
                ]
            }
        }
    }
}

[Jayddee23]

Perfect.
Fast, efficient.
Many thanks.