API stopped working with 2fa since 2.4 upgrade

Question

We have used the same PHP script since magento 2 upgrade (around 4 years) to integrate magento with our warehouse management software. Since we upgraded to 2.4 we are getting this message

resulted in a 400 Bad Request response: {"message":"You are required to configure personal Two-Factor Authorization in order to login. Please check your email."

We have always had 2fa enabled.

We use the standard way of connecting, is there another way of doing it since the upgrade?

 $_stores[1] = [
            'base_uri' => 'https://XXX.XXX.co.uk/',
            'username' => 'XXX',
            'password' => 'XXX',
        ];

        if (!isset($_stores[$store_id])) {
            throw new Exception('Invalid store ID found in URL');
        }

        $this->_client = new Client([
            'base_uri' => $_stores[$store_id]['base_uri'] . 'index.php/rest/all/V1/',
            'verify' => false,
        ]);

        try {
            $response = $this->_client->request('POST', 'integration/admin/token', [
                'json' => [
                    'username' => $_stores[$store_id]['username'],
                    'password' => $_stores[$store_id]['password'],
                ],
            ]);

We have turned 2fa off for now but we would really like to get it back on as soon as possible. I'm guessing the account needs to be able to bypass the 2fa somehow? or is there another way to ger the token without using 2fa? i can't find anything online about this?

Answer 1

The 2FA module did add the ability to authenticate to the API using 2FA.

First I would suggest logging into Magento using the account you want to use for the API via the admin so you can configure the account. Pick an auth method that you can use programmatically such as google authenticator and you can use https://github.com/dochne/google-authenticator to generate the OTP value. You can configure it via the API (https://devdocs.magento.com/guides/v2.4/security/two-factor-authentication.html) but it's easier via the admin.

Once this is done you can now use the 2FA endpoint /V1/tfa/provider/google/authenticate (there is a specific endpoint for each 2FA scheme) with the POST body being:

{
    "username": "admin",
    "password": "password",
    "otp": "123456"
}

Using your username, password, and generated OTP value.

If you still attempt to use the old token endpoint it will tell you which 2FA methods have been configured in the response json at parameters -> active_providers

Answer 2

Setting up 2FA after installation is simple.

First we will want to go into our Database and run this query:
SELECT * FROM core_config_data WHERE path LIKE '%provider%'; make sure we have the path twofactorauth/general/force_providers available to us.

Then we are going to add a value of google to our provider path: INSERT INTO core_config_data(scope,scope_id,path,'value') VALUES ('default',0,'twofactorauth/general/force_providers','google');

Next we will need a Base32encoder (i use this guy: https://emn178.github.io/online-tools/base32_encode.html ) and then choose a passkey of at least 10 characters.

After coping our encoded passkey we will return to our Magento CLI and run command bin/magento security:tfa:google:set-secret <user> <encoded passkey>

Finally, we will need to download desired authentication app (Google or Microsoft) and add our encoded passkey to the app. When you return to the admin page, it will ask for an authentication code that your app should provide.