[TUTORIAL] How can I enable TFA for a user via script?

[eMarcus]

Hi,
Because we often add whole LDAP groups to our Proxmox cluster and we enforce TFA for LDAP realms, I tried to script the TFA enablement for all users of a group.

• I can create a new key using oathkeygen
• I can add that key to a user with pveum user modify <user@realm> --keys <key>
• I can even create a QRCode with qrencode and send it to the user with mail
• But the user does not show up in the GUI "Two Factor" menu list and he can't login.

I guess there is another step missing (pveum user tfa unlock) does not work (no such user).

any ideas what the missing link could be?

Thanks and a nice weekend,
Marcus.