freeipa

#9851 otptoken-sync fails with imported tokens "plain text seeds"
Opened by sherif. Modified

Open
Close Issue

Issue

I got TOTP seed file from our hardware vendor and imported that file into IPA using otptoken-import, the XML isn't encrypted, however IPA did load them into the ldap also un-encrypted "I thought IPA will encrypted the seeds!", however the IPA generated seeds does look encrypted in the ldap. Whenever I try to sync the imported token via the web UI or the CLI, I get "Invalid credential" error, but the sync works fine for the IPA generated tokens

Steps to Reproduce

  1. Import a plain XML token seed
  2. Try to sync that imported token
  3. Search LDAP to confirm that the seeds are in clear text

Actual behavior

Sync failed with "Invalid Credential"

Expected behavior

To sync the token, but again, this might be due to the fact that the seeds are imported in clear text

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.12.2-14.el9_6.1.x86_64
ipa-client-4.12.2-14.el9_6.1.x86_64
389-ds-base-2.6.1-10.el9_6.x86_64
package pki-ca is not installed
krb5-server-1.21.1-8.el9_6.x86_64

RockyLinux 9.6

quick update / test I have done, I created the OTP with otptoken-add CLI and passed the seed as key, that token worked fine, sync and auth okay, and the seed in LDAP looks totally different than what happens when importing to the token with otptoken-import took, I think the tool doesn't do the same encoding of the seeds as the add and that's why the imported token doesn't work
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.