Feature: use login token for meshcentral integration

[bbrendon]

I would like to require mesh to have 2fa enabled ("force2factor": true) but not break the integration with tactical.

Mesh has the ability to force 2fa but enabling it breaks the integration with tactical. From my understanding, in order to to resolve this tactical can use login tokens for the mesh API.
Ylianst/MeshCentral#2859 (comment)

[wh1te909]

tactical is already using login tokens that's how we integrate with mesh

i just tried adding "force2factor": true to my config.json, restarted mesh and confirmed didn't break anything. iframe integration still works. but when trying to login now with just username/pass from the mesh login screen, am prompted for 2 factor. not sure why it's breaking for you, can you post your config.json

[bbrendon]

Sorry, I should have been more specific...

There is an auth-popup with breaks the seamlessness of the integration.

Also, even though I'm logged into the mesh interface using 2fa in one browser tab, when I go to Tactical and it opens a mesh iframe, I get this...

So maybe the admin account needs 2fa? And the 2fa sign-up QR Code needs to be saved and sent to all the users? But then that goes back to sharing accounts which kind of defeats the purpose.

All of this seems backwards. It seems like each user should input their mesh API token into Tactical that creates the integration.

{
  "settings": {
    "Cert": " . .com",
    "MongoDb": "mongodb://127.0.0.1:27017",
    "MongoDbName": "meshcentral",
    "WANonly": true,
    "Minify": 1,
    "Port": 4430,
    "AliasPort": 443,
    "RedirPort": 800,
    "AllowLoginToken": true,
    "AllowFraming": true,
    "_AgentPing": 60,
    "AgentPong": 200,
    "AllowHighQualityDesktop": true,
    "TlsOffload": "127.0.0.1",
    "agentCoreDump": false,
    "Compression": true,
    "WsCompression": true,
    "AgentWsCompression": true,
    "MaxInvalidLogin": { "time": 5, "count": 5, "coolofftime": 30 }
  },
  "domains": {
    "": {
      "Title": "  RMM",
      "Title2": "  RMM",
      "NewAccounts": false,
      "CertUrl": "https:// .com:443/",
      "GeoLocation": true,
      "CookieIpCheck": false,
      "mstsc": true,
      "PasswordRequirements": {         "force2factor": true       }
    }
  }
}

[bbrendon]

I just noticed this issue which might be related. #182

[dinger1986]

A decent work round for now is:

1. Create a user on mesh
2. Take them through logging into mesh
3. Get them to setup mfa
4. As an admin go into user settings, click on User (far right on username).
5. Tick Box Lock Account Settings

They now can’t disable MFA

[fts-tmassey]

Sorry: this isn't the right issue for this, though it is relevant. Moved comment to #182 (comment)

tl;dr: Adding PR #981 allows admin to manage remote control permissions for the techs individually; adding ability to add mesh_device_group to site in addition to globally allows TRMM to automatically put the device in the right Mesh group, which gives you 100% permission control with zero ongoing manual effort.

Sorry for the extra noise. Too many open tabs! :)