OAuth Two-Factor Support

Share KeePass Passwords with your Team of multiple users

(Versions 7+)

When authenticating a user, for which Two-Factor is enabled, use the following process.

The Authentication Process

1. Client sends a Resource Owner Grant authorization request to the OAuth token endpoint
   
   • [domain]:[port]/OAuth2/Token
   • POST data (Form URL encoded)
     
     • "grant_type" equal to "password"
     • "username"
     • "password"
2. If the response is 200 (OK) then the content of the response will be JSON containing the bearer token and expiry
   
   • "token_type"
   • "access_token"
   • "refresh_token" (not currently implemented)
   • "expiry"
3. If the reponse is an error code then the content of the response will be JSON containing an explanation of the error
   • "error"
   • "error_description"
4. The headers of the response should be examined for X-Pleasant-OTP and X-Pleasant-OTP-Provider values
   • X-Pleasant-OTP should contain "required"
     
     • If this header is not present then the error was not related to Two-Factor Authentication
   • X-Pleasant-OTP-Provider will contain the identifier for the two-factor provider token expected
     
     • The user's default Two-Factor Provider is used, if a user does not have a default selected then the first enabled Provider is used
5. Collect the Two-Factor token and resubmit
   • As above, except additional headers must be set on the request
   • X-Pleasant-OTP must be the value of the two-factor token
   • X-Pleasant-OTP-Provider must be the value that was returned in the error response
6. The server will respond with a standard success or error response (as above)
   • The server will NOT respond with a Two-Factor error response if the X-Pleasant-OTP-Provider header is included in the request