Issue

The user-del command only removes OTP tokens that were added by a user. It does not clear OTP tokens that were added by an administrator on behalf of a user.

Steps to Reproduce

As an admin add a testuser and a token with owner=testuser

$ kinit admin
$ ipa user-add testuser1 --first Test --last User1
$ ipa otptoken-add --owner=testuser1
------------------
Added OTP token ""
------------------
  Unique ID: 2dca9333-e563-438e-838a-ce0ac5311bb1
  Type: TOTP
  Owner: testuser1
  Key: ...

The token UID and owner are stored with the entry:

$ ldapsearch -b ipatokenuniqueid=2dca9333-e563-438e-838a-ce0ac5311bb1,cn=otp,dc=ipa,dc=example ipatokenOwner ipatokenUniqueID
...
# 2dca9333-e563-438e-838a-ce0ac5311bb1, otp, ipa.example
dn: ipatokenuniqueid=2dca9333-e563-438e-838a-ce0ac5311bb1,cn=otp,dc=ipa,dc=exa
 mple
ipatokenOwner: uid=testuser1,cn=users,cn=accounts,dc=ipa,dc=example
ipatokenUniqueID: 2dca9333-e563-438e-838a-ce0ac5311bb1
# search result
...

Delete the user

$ ipa user-del testuser1

Actual behavior

The user entry and token owner attribute are gone, but the OTP entry still persists:

$ ldapsearch -b ipatokenuniqueid=2dca9333-e563-438e-838a-ce0ac5311bb1,cn=otp,dc=ipa,dc=example ipatokenOwner ipatokenUniqueID
...
# 2dca9333-e563-438e-838a-ce0ac5311bb1, otp, ipa.example
dn: ipatokenuniqueid=2dca9333-e563-438e-838a-ce0ac5311bb1,cn=otp,dc=ipa,dc=exa
 mple
ipatokenUniqueID: 2dca9333-e563-438e-838a-ce0ac5311bb1
# search result
...

Expected behavior

The behavior is a bit surprising. The commit message provides a good reason for the behavior. However it's not obvious for an admin. The help documentation for otptoken-add should mention the behavior and perhaps offer an option to set the user as manager, too.

Version/Release/Distribution

freeipa-server-4.8.3-1.fc31.x86_64

Additional info:

The behavior was introduced in commit 98851256f94efe55b873f01aa46b2cdcda4a3efb

This behavior enables two important other behaviors. First, an admin can
create a hardware token and assign it to the user as a read-only token.
Second, when the user is deleted, only his self-managed tokens are deleted.
All other (read-only) tokens are instead orphaned. This permits the same
token object to be reasigned to another user without loss of any counter
data.