send Ziti Edge Tunnel MFA when Yubikey is present

ziti-mfa.bash

#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

if systemctl is-enabled --quiet ziti-edge-tunnel.service && ykman piv info &>/dev/null
then
    RESPONSE=$(ykman oath accounts code "$ZITI_IDENTITY" \
    | awk '{print $2;}' \
    | xargs -r ziti-edge-tunnel submit_mfa --identity "/opt/openziti/etc/identities/${ZITI_IDENTITY}.json" --authcode
    )
    RESPONSE="$(sed -nE 's/.*\{(.*)\}.*/{\1}/p' <<< "$RESPONSE")"
    RESULT="$(jq -r .Success <<< "$RESPONSE")"
    if [[ $RESULT == true ]]
    then
        echo "INFO: $ZITI_IDENTITY MFA accepted"
    else
        zenity --display=":1" --notification --text="$ZITI_IDENTITY MFA failed"
    fi
else
    echo "INFO: yubikey not detected"
fi

ziti-mfa.service

# ~/.config/systemd/user/ziti-mfa.service

[Unit]
Description=Send Ziti MFA Token

[Service]
Environment="ZITI_IDENTITY=mattermost"
ExecStart=/opt/openziti/bin/ziti-mfa.bash

ziti-mfa.timer

# ~/.config/systemd/user/ziti-mfa.timer

[Unit]
Description=Send Ziti MFA Token

[Timer]
OnCalendar=*:0/5

[Install]
WantedBy=timers.target