Authentication data specifying mechanism and credentials.
Authentication mechanism identifier for plain API key authentication.
Specific value:"API_KEY_PLAIN"
Username associated with the API key.
API key for authentication.
Additional options for the authentication process.
No Additional PropertiesWhether to include detailed user information (the output of auth.me) in the authentication response.
Whether to include a reauthentication token in the authentication response. The ttl for the generated token depends on the TrueNAS webui setting for preferences->lifetime, with a default value of 600 seconds.
Authentication mechanism identifier for plain password authentication.
Specific value:"PASSWORD_PLAIN"
Username for authentication.
Password for authentication.
Additional options for the authentication process.
No Additional PropertiesWhether to include detailed user information (the output of auth.me) in the authentication response.
Whether to include a reauthentication token in the authentication response. The ttl for the generated token depends on the TrueNAS webui setting for preferences->lifetime, with a default value of 600 seconds.
Authentication mechanism type for plain token login.
Specific value:"TOKEN_PLAIN"
Authentication token (masked for security).
Common authentication options and settings.
No Additional PropertiesWhether to include detailed user information (the output of auth.me) in the authentication response.
Whether to include a reauthentication token in the authentication response. The ttl for the generated token depends on the TrueNAS webui setting for preferences->lifetime, with a default value of 600 seconds.
Authentication mechanism identifier for one-time password tokens.
Specific value:"OTP_TOKEN"
One-time password token for authentication.
Additional options for the authentication process.
No Additional PropertiesWhether to include detailed user information (the output of auth.me) in the authentication response.
Whether to include a reauthentication token in the authentication response. The ttl for the generated token depends on the TrueNAS webui setting for preferences->lifetime, with a default value of 600 seconds.
Authentication mechanism that implements SHA512-based RFC5802 authentication. The authentication mechanism provides replay resistence and capability for mutual validation of server and client sessions.
The authentication mechanism is currently limited to API key credentials, but at a future point will be expanded to cover local user authentication.
Channel binding (RFC 5929 tls-server-end-point) is supported and negotiated per exchange. A client that requires it sends a p=tls-server-end-point gs2 header over a TLS connection (see rfc_str) and the server verifies it against the certificate it serves; binding is only honored over TLS and remains optional, so clients that do not request it still authenticate.
C and python libraries to for managing the client-side portion of the authentication exchanges are provided at https://github.com/truenas/truenas_scram.
Specific value:"SCRAM"
Scram message type from client. The scram types indicate the message type that is represented by the rfc_str field. CLIENTFIRSTMESSAGE - this corresponds with the client-first-message as defined in RFC5802. CLIENTFINALMESSAGE - this corresponds with the client-final-message as defined in RFC5802.
This field contains the SCRAM authentication exchange message as defined in RFC5802. The expected format and contents depends on the scram_type. CLIENTFIRSTMESSAGE: n,,n=user:10,r=fyko+d2lbbFgONRv9qkxdawL The n,, component indicates that client does not support channel bindings. n=user:10 specifies the username and API key id (separated by : character). r=fyko+d2lbbFgONRv9qkxdawL specifies a base64-encoded nonce generated client-side. CLIENTFINALMESSAGE: c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j, p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts= c=biws contains channel binding information. In this example it's the base64-encoded string n,, (no channel binding support). r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j contains the combined client and server nonce as returned by the response to the CLIENTFIRSTMESSAGE. p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts= contains the base64-encoded client proof generated based on client-side key material and client + server nonce.
"n,,n=user,r=fyko+d2lbbFgONRv9qkxdawL"
"c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts="
Authentication response indicating success, failure, or additional steps required.
Authentication response type indicating successful login.
Specific value:"SUCCESS"
Authenticated user information (the output of auth.me), or null if not requested.
Name of the user.
Full username or comment field.
User home directory.
User command line interpreter.
Numerical user ID of the user.
Numerical group id for the user's primary group.
Optional array of group IDs for groups of which this account is a member. If get_groups is not specified, this value will be null.
Optional SID value for the account that is present if sid_info is specified in payload.
The source for the user account.
The account is local to TrueNAS or provided by a directory service.
Custom user attributes and metadata.
Two-factor authentication configuration for the user.
User privilege and role information.
Array of account attribute names available for this user.
No Additional ItemsAuthentication level achieved (LEVEL1 for password, LEVEL2 for two-factor).
Single-use token that can be used to reauthenticate to the truenas server in case websocket session is interrupted. This will be null in the following situations:
1) The initiating authentication request set reconnect_token to false (default).
2) The user authenticated via a one-time password, which does not support reconnect token creation.
Authentication response type indicating authentication failure.
Specific value:"AUTH_ERR"
Authentication response type indicating the session or token has expired.
Specific value:"EXPIRED"
Authentication response type indicating one-time password is required.
Specific value:"OTP_REQUIRED"
Username for which OTP is required.
Authentication response type indicating redirect is required.
Specific value:"REDIRECT"
Array of URLs to redirect to for authentication completion.
No Additional ItemsAuthentication response type indicating a SCRAM server response.
Specific value:"SCRAM_RESPONSE"
The type of server response. The SERVERFIRSTRESPONSE will contain nonce, salt, and iterations. The SERVERFINALRESPONSE will contain the server verification proof for client mutual validation.
Server authentication response containing string per RFC5802.
"r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,i=500000"
"v=rmF9pqV8S7suAoZWja4dJRkFsKQ="
Authenticated user information on SERVERFINALRESPONSE or null on SERVERFIRSTRESPONSE.
Name of the user.
Full username or comment field.
User home directory.
User command line interpreter.
Numerical user ID of the user.
Numerical group id for the user's primary group.
Optional array of group IDs for groups of which this account is a member. If get_groups is not specified, this value will be null.
Optional SID value for the account that is present if sid_info is specified in payload.
The source for the user account.
The account is local to TrueNAS or provided by a directory service.
Custom user attributes and metadata.
Two-factor authentication configuration for the user.
User privilege and role information.
Array of account attribute names available for this user.
No Additional ItemsAuthentication response type indicating that the credential lacks API access.
Specific value:"DENIED"