freeipa

#9609 ipa-otptoken-import fails to import encrypted file
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

ipa-otptoken-import provides an option (-k KEYFILE) to import an encrypted PSKC file but this option does not work with python3 in RHEL 8 and above.

Steps to Reproduce

  1. install IPA server
  2. call ` ipa-otptoken-import -v -k password.txt PSKC.xml /root/output.txt

The command fails with:

ipapython.admintool: DEBUG:   File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 177, in execute
        self.validate_options()
    File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_otptoken_import.py", line 553, in validate_options
        self.doc.setKey(f.read())
    File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_otptoken_import.py", line 495, in setKey
        key = kd(self.__enckey).derive(key)
    File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_otptoken_import.py", line 234, in derive
        return self.kdf.derive(masterkey)
    File "/usr/lib64/python3.6/site-packages/cryptography/hazmat/primitives/kdf/pbkdf2.py", line 49, in derive
        utils._check_byteslike("key_material", key_material)
    File "/usr/lib64/python3.6/site-packages/cryptography/utils.py", line 36, in _check_byteslike
        raise TypeError("{} must be bytes-like".format(name))
    ipapython.admintool: DEBUG: The ipa-otptoken-import command failed, exception: TypeError: key_material must be bytes-like
    ipapython.admintool: ERROR: key_material must be bytes-like
    ipapython.admintool: ERROR: The ipa-otptoken-import command failed.

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-39616, https://issues.redhat.com/browse/RHEL-42703, https://issues.redhat.com/browse/RHEL-42705

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7390

master:

  • 3249b1247f148f648d8b9696e9e80a8237b4d14c ipa-otptoken-import: open the key file in binary mode

ipa-4-12:

  • 9de053ef02db8cb63e14edc64ac22ec2d3d7bbc9 ipa-otptoken-import: open the key file in binary mode

ipa-4-11:

  • a336b3183eace0216b36f7747a9e69e854bd026e ipa-otptoken-import: open the key file in binary mode

ipa-4-9:

  • ef084d6d734aa9256b74a40325e5f20869e36faf ipa-otptoken-import: open the key file in binary mode

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/7390
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.