freeipa

#9699 EnforceLDAPOTP ldap-bind with sysaccount no longer possible
Closed: fixed by frenaud. Opened by theonerole.

Closed: fixed
Reopen Issue

Issue

When setting EnforceLDAPOTP a ldap-bind with a sysaccount is no longer possible which breaks applications utilizing ldap-bind.

The option has been introduced with: https://pagure.io/freeipa/issue/5169

Steps to Reproduce

Working:
1. ipa config-mod --ipaconfigstring "AllowNThash" --ipaconfigstring "KDC:Disable Last Success"
2. ldapwhoami -x -D "uid=abc,cn=sysaccounts,cn=etc,dc=example,dc=com" -W

Not Working:
1. ipa config-mod --ipaconfigstring "EnforceLDAPOTP" --ipaconfigstring "AllowNThash" --ipaconfigstring "KDC:Disable Last Success"
2. ldapwhoami -x -D "uid=abc,cn=sysaccounts,cn=etc,dc=example,dc=com" -W

Actual behavior

A ldap-bind for a sysaccount or a user which has only the option password is no longer possible.

Enter LDAP Password:
ldap_bind: Invalid credentials (49)

Expected behavior

A ldap-bind for a sysaccount or a user which has only the option password set should still be possible.

Enter LDAP Password:
dn: uid=abc,cn=sysaccounts,cn=etc,dc=example,dc=com

Version/Release/Distribution

rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.12.2-1.fc40.x86_64
freeipa-client-4.12.2-1.fc40.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.0.4-3.fc40.x86_64
package pki-ca is not installed
krb5-server-1.21.3-2.fc40.x86_64

Sysaccounts are created according to: https://www.freeipa.org/page/HowTo/LDAP

The behavior is intentional for normal users as you have enforced OTP to be present for any LDAP bind. I can see this being an issue for sysaccounts.

We may adjust the enforcement logic for accounts that do not have ipaobject object class.

PR: https://github.com/freeipa/freeipa/pull/7618 adds logic to exclude 'simplesecurityobject' objects from the 2FA check.

So if you have created system account with that objectclass (like uid=sudo,cn=sysaccounts,cn=etc,... in the default installation) and not an IPA user, the system account will be exempt from the 2FA check.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-69900

master:

  • 60f9bd043075ad9efce4cd908b23781b81065ca4 ipa-pwd-extop: clarify OTP use over LDAP binds

ipa-4-12:

  • 3e7ec3dc49d0f559bdbe330e52019e59f0b57c18 ipa-pwd-extop: clarify OTP use over LDAP binds

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Dears,

Thank you very much for the fix.
Could you clarify, whether this fix will be available in fedora 40 aswell?

As I can see in https://bodhi.fedoraproject.org/updates/FEDORA-2024-860c80c29c it was pushed to fedora 42 already.

Yes, I'll do that next week, I'm traveling without laptop right now.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.