freeipa

#9266 2FA prompt remains after disabling OTP for user
Closed: worksforme by abbra. Opened by pudding.

Closed: worksforme
Reopen Issue

Issue

After disabling (T)OTP for a user account by unticking the "Two factor authentication (password + OTP)" box, and even explicitly ticking just the "Password" box and deleting the OTP token, the user is still presented with the "second factor" prompt when trying to log in via ssh.

At this point FreeIPA will accept and successfully authenticate with blank input for second factor - i.e. just pressing enter at the prompt - but any other input, including the correct TOTP code, will fail. It appears as if OTP is not disabled but instead stuck in limbo where the only correct response is an empty response.

Steps to Reproduce

  1. create a TOTP token and assign ownership of it to a user, tick "2FA auth" box for the user
  2. log in over ssh to confirm TOTP is required and working correctly
  3. disable TOTP for the user by unticking "2FA auth" box and deleting the TOTP token

Actual behavior

Second factor prompt still shows up when logging in over ssh, and will now accept only a blank line as response, but will fail authentication with any other actual input.

Expected behavior

Second factor prompt should no longer show up. The user account should be restored to only password auth, just as it were before 2FA was enabled for it.

Version/Release/Distribution

FreeIPA server runs CentOS Stream release 9:

ipa-server-4.10.0-6.el9.x86_64
ipa-client-4.10.0-6.el9.x86_64
389-ds-base-2.1.3-4.el9.x86_64
krb5-server-1.19.1-22.el9.x86_64

Host with IPA client runs CentOS 7.9.2009 (Core):

ipa-client-4.6.8-5.el7.centos.11.x86_64
sssd-1.16.5-10.el7_9.13.x86_64

Additional info:

The default user auth config has only "Password" ticked, and allows per-user override.

I have found one way of "resetting" the user, and that's by issuing a password reset. After doing this, and successfully changing the user's password, the lingering 2FA prompt goes away and everything seems to be back to normal.

Hi,
I was not able to reproduce this behavior. As soon as I do "ipa user-mod otpuser --user-auth-type=password", ssh prompt asks only for the password.
Could you share your /etc/sssd/sssd.conf config file (from the server and from the client), for me to check if any customization could explain the behavior?

sssd.conf on FreeIPA server side is what ipa-server-install produced, no manual edits:

[domain/internal.host.name]
id_provider = ipa
ipa_server_mode = True
ipa_server = ipa.internal.host.name
ipa_domain = internal.host.name
ipa_hostname = ipa.internal.host.name
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = True
[sssd]
services = nss, pam, ifp, ssh, sudo
domains = internal.host.name
[nss]
homedir_substring = /home
memcache_timeout = 600
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
allowed_uids = ipaapi, root
[session_recording]

sssd.conf on the client side is produced by ipa-client-install during enrollment, but has manually added [prompting] stanzas, no other edits:

[domain/internal.host.name]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = internal.host.name
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ldap_tls_cacert = /etc/ipa/ca.crt
ipa_hostname = public.host.name
chpass_provider = ipa
ipa_server = _srv_, ipa.internal.host.name
dns_discovery_domain = internal.host.name
[sssd]
services = nss, sudo, pam, ssh
domains = internal.host.name
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[session_recording]
[prompting/password/sshd]
password_prompt = Password:
[prompting/2fa/sshd]
first_prompt = Password:
second_prompt = Two-factor authentication code:

I don't use ipa on the command line to do the password changes, only the web UI.

Even with those settings, I was not able to reproduce. You may get more help from sssd-users (https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org), they will have ideas how to troubleshoot.

@sbose or @pedrosam would you have any suggestion for troubleshooting this issue?

No reproducer, no follow up in two years. Closing.

Metadata Update from @abbra:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.