freeipa

#9711 Regression: LDAP bind is allowed without OTP in 4.12
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2321307

Steps to Reproduce:

  1. install ipa-server version 4.10, create user, add token, enable password+otp for this user -> ldapsearch using authenticated bind works using password+token as password
  2. upgrade to ipa-server version 4.12, run ldapsearch using authenticated bind, you can login to ldap server without token (just enter password)

Actual results:
when upgraded (or newly installed) ipa version 4.12 you can bypass OTP authentication using ldapsearch and password authentication even if OTP is activated for this user.

Expected results:
keep behavior as it's currently on 4.10: if authentication type password+OTP is activated for user -> enforce authentication using pwd+OTP

Metadata Update from @abbra:
- Issue assigned to abbra

PR: https://github.com/freeipa/freeipa/pull/7618

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-69900

master:

  • 60f9bd043075ad9efce4cd908b23781b81065ca4 ipa-pwd-extop: clarify OTP use over LDAP binds

ipa-4-12:

  • 3e7ec3dc49d0f559bdbe330e52019e59f0b57c18 ipa-pwd-extop: clarify OTP use over LDAP binds

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.