fix access-reject on fortigate when two_fa is enabled Fixes #5

cmd/client/main.go

@@ -56,12 +56,30 @@ func main() {
 			rfc2865.UserName_SetString(packet, username)
 			rfc2865.UserPassword_SetString(packet, password)
 			response, err := radius.Exchange(context.Background(), packet, server)
-			wg.Done()
 			if err != nil {
 				log.Fatal(err)
 			}
 
 			log.Println("Code:", response.Code)
+			if response.Code == radius.CodeAccessChallenge {
+				state := rfc2865.State_GetString(response)
+				var otpCode string
+				if _, err := fmt.Scanln(&otpCode); err != nil {
+					log.Println(err)
+				}
+
+				rfc2865.UserPassword_SetString(packet, otpCode)
+				rfc2865.State_SetString(packet, state)
+				challengeResponse, err := radius.Exchange(context.Background(), packet, server)
+				if err != nil {
+					log.Fatal(err)
+				}
+				log.Print("Code:", challengeResponse.Code)
+
+			}
+
+			wg.Done()
+
 		}()
 	}
 	wg.Wait()

deploy/docker-compose.yml

@@ -1,7 +1,7 @@
 version: "2"
 services:
   radotp:
-   image: ghcr.io/abbas-gheydi/radotp:main
+   image: ghcr.io/abbas-gheydi/radotp:v2.0.1
    restart: always
    ports:
     - "80:8080"

pkgs/rad/Start.go

@@ -33,7 +33,7 @@ func StartRadius() {
 			log.Println("password is empty for user: ", rfc2865.UserName_GetString(r.Packet))
 		}
 
-		if mustCheckPassword() {
+		if mustCheckPassword() && rfc2865.State_GetString(r.Packet) == "" {
 			User_PassHandler(w, r)
 
 		} else {