Retrieve the seed and current TOTP token for any given LDAP account. Assumes LDAP is used as the auth source.

totprescue.py

#!/usr/bin/env python
from optparse import OptionParser
import ConfigParser
import totpcgi
import totpcgi.backends
import getpass
import sys

def decrypt_user_token(backends, args):
  user = args[0]
  pincode = getpass.getpass('LDAP Password for user %s: ' % user)

  # Try getting the user secret
  try:
    secret = backends.secret_backend.get_user_secret(user, pincode)
  except totpcgi.UserNotFound, ex:
    print 'Error: No existing tokens found for user %s' % user
    sys.exit(1)
  except totpcgi.UserSecretError, ex:
    print 'Error: Could not decrypt the secret for user %s' % user
    sys.exit(1)

  print "TOTP Secret: %s" % secret.totp.secret
  print "Current Token: %s" % secret.token
  backends.secret_backend.save_user_secret(user, secret, None)

if __name__ == '__main__':
  usage = 'Please pass in an LDAP uid that needs a secret retrieved!'
  parser = OptionParser(usage=usage, version='0.1')
  parser.add_option('-c', '--config', dest='config_file',
          default='/etc/totpcgi/provisioning.conf',
          help='Path to provisioning.conf (%default)')

  (opts, args) = parser.parse_args()

  if not len(args) > 0:
    print usage
    sys.exit(1)

  config = ConfigParser.RawConfigParser()
  config.read(opts.config_file)

  backends = totpcgi.backends.Backends()
  try:
    backends.load_from_config(config)
  except totpcgi.backends.BackendNotSupported, ex:
    syslog.syslog(syslog.LOG_CRIT,
                  'Backend engine not supported: %s' % ex)
    sys.exit(1)

  decrypt_user_token(backends, args)