freeipa

#7012 Users can delete their last active OTP token
Closed: fixed Opened by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1458183

Description of problem:
When the global default auth-type is set to 'otp', users can still delete their
last OTP token. Only after the auth-type has been set explicitly on the user
entry, the last token can not be deleted.
A user should should not be able to delete the last token for the account when
the global auth-type is set to otp.
# ipa config-mod --user-auth-type otp
# ipa config-show|grep -i auth
  Default user authentication types: otp
- Login as tuser1
$ ipa otptoken-add
$ ipa otptoken-find
-------------------
1 OTP token matched
-------------------
  Unique ID: 448dd2f5-56e3-41dd-bea8-2df72fc3ba96
  Type: TOTP
  Owner: tuser1
----------------------------
Number of entries returned 1
----------------------------
$ klist
Ticket cache: KEYRING:persistent:88800001:krb_ccache_EgmK3we
Default principal: tuser1@GSSLAB.PNQ2.REDHAT.COM
Valid starting       Expires              Service principal
06/02/2017 16:21:05  06/03/2017 16:21:05
krbtgt/GSSLAB.PNQ2.REDHAT.COM@GSSLAB.PNQ2.REDHAT.COM
$ ipa otptoken-delete 448dd2f5-56e3-41dd-bea8-2df72fc3ba96
--------------------------------------------------------
Deleted OTP token "448dd2f5-56e3-41dd-bea8-2df72fc3ba96"
--------------------------------------------------------
- Change the auth-type on the user entry itself
#  ipa user-mod tuser1 --user-auth-type otp
#  ipa user-show  tuser1 |grep auth
  User authentication types: otp
- Login as tuser1 again and add a new token and try to delete it
$ ipa otptoken-add
$ ipa otptoken-find
-------------------
1 OTP token matched
-------------------
  Unique ID: abb6105d-e751-451f-9f2f-5fed9c436a04
  Type: TOTP
  Owner: tuser1
----------------------------
Number of entries returned 1
----------------------------
$ ipa otptoken-del abb6105d-e751-451f-9f2f-5fed9c436a04
ipa: ERROR: Server is unwilling to perform: Can't delete last active token
Version-Release number of selected component (if applicable):
ipa-server-4.4.0-12.el7.x86_64
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1458183

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1458183

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.6.1 (was: FreeIPA 4.6)

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.6.2 (was: FreeIPA 4.6.1)

Metadata Update from @fbarreto:
- Issue assigned to fbarreto

Metadata Update from @tdudlak:
- Issue set to the milestone: FreeIPA 4.6.3 (was: FreeIPA 4.6.2)

https://github.com/freeipa/freeipa/pull/1416

Metadata Update from @fbarreto:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1416

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.4 (was: FreeIPA 4.6.3)

FreeIPA 4.6.3 has been released, moving to FreeIPA 4.6.4 milestone

Metadata Update from @frenaud:
- Issue assigned to frenaud (was: fbarreto)

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1582 (was: https://github.com/freeipa/freeipa/pull/1416)

master:

  • 8b6506a5f1176ad768bb0e513436009906b8ff63 User must not be able to delete his last active otp token
  • c701cd21d31e6bdf5f1078cdfca49e410e093e28 389-ds OTP lasttoken plugin: Add unit test

ipa-4-6:

  • 55d5f91576fae46cb2adb2cfd1d8f4a21be93743 User must not be able to delete his last active otp token
  • a47ddde0d60e780979c3ad6cc5c0406a3cfbe88f 389-ds OTP lasttoken plugin: Add unit test

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/1582
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.