Add -Device parameter to Connect-Keeper to prevent config file load

Author: sk-keeper

KeeperSdk/auth/AuthCommon.cs

@@ -181,6 +181,11 @@ public interface IAuth : IAuthEndpoint
         /// </summary>
         bool AlternatePassword { get; set; }
 
+        /// <summary>
+        /// Uses a configured device token without requiring a stored device private key.
+        /// </summary>
+        public bool NoNewDevice { get; set; }
+
         /// <summary>
         /// Login to Keeper account with email.
         /// </summary>

KeeperSdk/auth/AuthSync.cs

@@ -61,6 +61,9 @@ public AuthSync(IConfigurationStorage storage, IKeeperEndpoint endpoint = null)
         /// <inheritdoc/>>
         public bool AlternatePassword { get; set; }
 
+        /// <inheritdoc/>>
+        public bool NoNewDevice { get; set; }
+
         /// <inheritdoc cref="IAuth.Username" />>
         public new string Username
         {
@@ -216,6 +219,10 @@ private async Task<AuthStep> StartLoginSync(StartLoginRequest request)
                     switch (response.EncryptedDataKeyType)
                     {
                         case EncryptedDataKeyType.ByDevicePublicKey:
+                            if (_loginContext.DeviceKey == null)
+                            {
+                                throw new KeeperInvalidDeviceToken("device private key is required for this login flow");
+                            }
                             context.DataKey = CryptoUtils.DecryptEc(encryptedDataKey, _loginContext.DeviceKey);
                             break;
                     }

KeeperSdk/auth/LoginV3Extensions.cs

@@ -80,6 +80,14 @@ public static async Task EnsureDeviceTokenIsRegistered(this IAuth auth, LoginCon
             }
 
             var configuration = auth.Storage.Get();
+            if (auth.NoNewDevice)
+            {
+                var token = configuration.Users.Get(auth.Username)?.LastDevice?.DeviceToken
+                    ?? configuration.Devices.List.FirstOrDefault()?.DeviceToken;
+                auth.DeviceToken = token.Base64UrlDecode();
+                return;
+            }
+
             IDeviceConfiguration deviceConf = null;
             if (auth.DeviceToken != null)
             {
@@ -355,7 +363,7 @@ internal static async Task<T> StartLogin<T>(
                 catch (Exception e)
                 {
                     auth.SetPushNotifications(null);
-                    if (attempt < 3 && e is KeeperInvalidDeviceToken)
+                    if (attempt < 3 && e is KeeperInvalidDeviceToken && !auth.NoNewDevice)
                     {
                         var configuration = auth.Storage.Get();
                         configuration.Devices.Delete(auth.DeviceToken.Base64UrlEncode());

PowerCommander/AuthCommands.ps1

@@ -463,6 +463,42 @@ function executeStepAction ([KeeperSecurity.Authentication.IAuthentication] $aut
     }
 }
 
+function getConfigurationForDevice {
+    param(
+        [Parameter(Mandatory=$true)] [string] $Device,
+        [Parameter()] [string] $Username,
+        [Parameter()] [string] $Server
+    )
+
+    $deviceToken = $Device.Trim()
+    if (-not $deviceToken) {
+        Write-Error "Device parameter requires a device_token value." -ErrorAction Stop
+    }
+
+    $configuration = New-Object KeeperSecurity.Configuration.KeeperConfiguration
+    $configuration.LastLogin = $Username
+    $configuration.LastServer = $Server
+
+    $deviceConf = New-Object KeeperSecurity.Configuration.DeviceConfiguration $deviceToken
+    if ($Server) {
+        $deviceConf.ServerInfo.Put((New-Object KeeperSecurity.Configuration.DeviceServerConfiguration $Server))
+    }
+    $configuration.Devices.Put($deviceConf)
+
+    if ($Username) {
+        $userConf = New-Object KeeperSecurity.Configuration.UserConfiguration $Username
+        $userConf.Server = $Server
+        $userConf.LastDevice = New-Object KeeperSecurity.Configuration.UserDeviceConfiguration $deviceToken
+        $configuration.Users.Put($userConf)
+    }
+
+    if ($Server) {
+        $configuration.Servers.Put((New-Object KeeperSecurity.Configuration.ServerConfiguration $Server))
+    }
+
+    return New-Object KeeperSecurity.Configuration.InMemoryConfigurationStorage $configuration
+}
+
 function Connect-Keeper {
     <#
     .Synopsis
@@ -487,6 +523,9 @@ function Connect-Keeper {
     .Parameter Server
     Change default keeper server
 
+    .Parameter Device
+    Device token. When provided, skips loading configuration from file.
+
     .Parameter Config
     Config file name
 
@@ -507,14 +546,23 @@ function Connect-Keeper {
         [Parameter(ParameterSetName = 'sso_password')][switch] $SsoPassword,
         [Parameter(ParameterSetName = 'sso_provider')][switch] $SsoProvider,
         [Parameter()][string] $Server,
+        [Parameter()][string] $Device,
         [Parameter()][string] $Config,
         [Parameter()][switch] $UseOfflineStorage,
         [Parameter()][string] $VaultDatabasePath,
         [Parameter()][switch] $SkipSync
     )
 
     Disconnect-Keeper -Resume | Out-Null
-    if ($Config) {
+    $deviceTokenOnly = $false
+    if ($Device) {
+        if ($Config) {
+            Write-Error "The Device and Config parameters cannot be used together." -ErrorAction Stop
+        }
+        $storage = getConfigurationForDevice -Device $Device -Username $Username -Server $Server
+        $deviceTokenOnly = $true
+    }
+    elseif ($Config) {
         $storage = New-Object KeeperSecurity.Configuration.JsonConfigurationStorage $Config
     } else {
         $storage = New-Object KeeperSecurity.Configuration.JsonConfigurationStorage
@@ -529,6 +577,7 @@ function Connect-Keeper {
     $authFlow = New-Object KeeperSecurity.Authentication.Sync.AuthSync($storage, $endpoint)
 
     $authFlow.AlternatePassword = $SsoPassword.IsPresent
+    $authFlow.NoNewDevice = $deviceTokenOnly
 
     if (-not $NewLogin.IsPresent -and -not $SsoProvider.IsPresent) {
         if (-not $Username) {
@@ -565,6 +614,9 @@ function Connect-Keeper {
         }
     }
     $authFlow.ResumeSession = $canResume
+    if ($deviceTokenOnly) {
+        $authFlow.ResumeSession = $false
+    }
     Write-Verbose "Resume Session: $($authFlow.ResumeSession)"
 
     $biometricPresent = $false