freeipa

#9248 OTP token sync always returns OK even with random numbers
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 2124369

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Description of problem:
When syncing OTP tokens, as long as the first OTP is valid, it will accept any random series as numbers as the second OTP to sync from.
Version-Release number of selected component (if applicable):
IPA Server 4.6.8-5
RHEL 7.9
How reproducible:
Consistently
Steps to Reproduce:
1. Create account and setup OTP for it.
2. Run `ipa otptoken-sync`.
3. Give a valid username, password, and first OTP token.
4. Give an invalid one for the second token.
Actual results:
IPA accepts the second value despite it being invalid.
Expected results:
IPA rejects the second value as invalid.
Additional info:

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2124369

Issue linked to bug 2124369

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6472

master:

  • f1b2d8ab3640a52b7a77e4f550e1e37cb0665c74 ipa otptoken-sync: return error when sync fails
  • 59db0faf218510487f04c6ae50b68e49e203a9fb ipatests: add negative test for otptoken-sync

ipa-4-10:

  • 221768f882784755c6449ff70f291fab780cce16 ipa otptoken-sync: return error when sync fails
  • d9f33b7cd7e336be90d889e2db4c4bce18753918 ipatests: add negative test for otptoken-sync

ipa-4-9:

  • 4cc94cd3b929ee1878767d23f98ad5e755583c6b ipa otptoken-sync: return error when sync fails
  • 895a800e90a34f55f5d2789ece6e7bc8e6f5c0a6 ipatests: add negative test for otptoken-sync

ipa-4-6:

  • e2238fdf92b1df15e510d190cf3c4201dd51cbee ipa otptoken-sync: return error when sync fails
  • 0c62aef1482ea97aaa04af667980a99faa0071a8 ipatests: add negative test for otptoken-sync
  • 69c376b9e62c39f73bc9dbce081c29a0c448f3ca ipatests: python2 does not support f-strings
  • d587d0f48b488e862674bdd8c2b6d0a75eee0612 Fix otptoken_sync plugin

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.