func (s *IdentityService) CheckPassword(user string, password []byte, hotpToken string) error {
	hash, err := s.GetPasswordHash(user)
	if err != nil {
		return trace.Wrap(err)
	}
	if err = s.IncreaseLoginAttempts(user); err != nil {
		return trace.Wrap(err)
	}
	if err := bcrypt.CompareHashAndPassword(hash, password); err != nil {
		return trace.AccessDenied("passwords do not match")
	}
	otp, err := s.GetHOTP(user)
	if err != nil {
		return trace.Wrap(err)
	}
	if !otp.Scan(hotpToken, defaults.HOTPFirstTokensRange) {
		return trace.AccessDenied("bad one time token")
	}
	defer s.ResetLoginAttempts(user)
	if err := s.UpsertHOTP(user, otp); err != nil {
		return trace.Wrap(err)
	}
	return nil
}
// CheckPassword is called on web user or tsh user login
CheckPassword is called on web user or tsh user login
// CheckPassword is called on web user or tsh user login
func (s *IdentityService) CheckPassword(user string, password []byte, hotpToken string) error {
	hash, err := s.GetPasswordHash(user)
	if err != nil {
		return trace.Wrap(err)
	}
	if err = s.IncreaseLoginAttempts(user); err != nil {
		return trace.Wrap(err)
	}
	if err := bcrypt.CompareHashAndPassword(hash, password); err != nil {
		return trace.AccessDenied("passwords do not match")
	}
	otp, err := s.GetHOTP(user)
	if err != nil {
		return trace.Wrap(err)
	}
	if !otp.Scan(hotpToken, defaults.HOTPFirstTokensRange) {
		return trace.AccessDenied("bad one time token")
	}
	defer s.ResetLoginAttempts(user)
	if err := s.UpsertHOTP(user, otp); err != nil {
		return trace.Wrap(err)
	}
	return nil
}
func ( s * IdentityService ) CheckPassword ( user string , password [ ] byte , hotpToken string ) error { hash , err := s . GetPasswordHash ( user ) if err != nil { return trace . Wrap ( err ) } if err = s . IncreaseLoginAttempts ( user ) ; err != nil { return trace . Wrap ( err ) } if err := bcrypt . CompareHashAndPassword ( hash , password ) ; err != nil { return trace . AccessDenied ( " " ) } otp , err := s . GetHOTP ( user ) if err != nil { return trace . Wrap ( err ) } if ! otp . Scan ( hotpToken , defaults . HOTPFirstTokensRange ) { return trace . AccessDenied ( " " ) } defer s . ResetLoginAttempts ( user ) if err := s . UpsertHOTP ( user , otp ) ; err != nil { return trace . Wrap ( err ) } return nil }
CheckPassword is called on web user or tsh user login
CheckPassword is called on web user or tsh user login