Description of problem:
Users are defined to use only Two factor authentication (password + OTP).
Although the while running automation IdM periodically prompt the user for a
"Password:" instead of the First Factor/ Second Factor prompts.  The real
concern is if the user is prompt for just the "Password", and enters it, he/she
now is granted access to the resources which originally required two factor
authentication.
Note: After repetitive attempts we were  also able to perform manually in a
terminal while system under load.
Automation load calculating 14% failure rate
How reproducible:
Steps to Reproduce:
1. added 100 users with associated tokens totp/hotp
2. config a group of 10 users setting for two factor authentication only
3. config diff group of 80 users for sudo tests with defined sudo rules
4. start STR system test with concurrent authn/totp and sudo test load
scenarios
Actual results:
1. auth totp automation test periodically prompt for "Password:" instead of two
factor authn.  In this state if the user enters the ldap password, authn
succeeds and allow access to protected resources.
Expected results:
1. expected all authn challenges to be prompted for two factor authn with First
Factor/ Second Factor prompts
Additional info:
STR RunID: R-1761
rpm -qi ipa-server
Name        : ipa-server
Version     : 4.5.0
Release     : 21.el7_4.1.2
Architecture: x86_64
Install Date: Mon 16 Oct 2017 10:58:54 AM EDT
Group       : System Environment/Base
Size        : 1050087
License     : GPLv3+
Signature   : RSA/SHA256, Thu 17 Aug 2017 03:51:44 AM EDT, Key ID
199e2f91fd431d51
Source RPM  : ipa-4.5.0-21.el7_4.1.2.src.rpm
Build Date  : Wed 16 Aug 2017 02:31:08 PM EDT
Build Host  : x86-041.build.eng.bos.redhat.com
rpm -qi 389-ds-base
Name        : 389-ds-base
Version     : 1.3.6.1
Release     : 19.el7_4
Architecture: x86_64
Install Date: Mon 16 Oct 2017 10:58:39 AM EDT
Group       : System Environment/Daemons
Size        : 5480103
License     : GPLv3+
Signature   : RSA/SHA256, Fri 25 Aug 2017 03:59:01 AM EDT, Key ID
199e2f91fd431d51
Source RPM  : 389-ds-base-1.3.6.1-19.el7_4.src.rpm
Build Date  : Tue 22 Aug 2017 09:33:10 AM EDT
Build Host  : x86-019.build.eng.bos.redhat.com
**Test Environment:
IdM ver 4.5
1. master 1
Red Hat Enterprise Linux Server release 7.4 (Maipo) - metal
master.qe.sti.com 3.10.0-514.el7.x86_64 #1 SMP Wed Oct 19 11:24:13 EDT 2016
x86_64 x86_64 x86_64 GNU/Linux
ram:       16251636 kB
cpu 4core/ 16 proc
2. replica 1 - metal
Red Hat Enterprise Linux Server release 7.4 (Maipo)
replica2.qe.sti.com 3.10.0-514.el7.x86_64 #1 SMP Wed Oct 19 11:24:13 EDT 2016
x86_64 x86_64 x86_64 GNU/Linux
ram:       65689944 kB
cpu 10 core / 40 proc
3. client 1 -metal
Red Hat Enterprise Linux Server release 7.4 (Maipo)
replica1.qe.sti.com 3.10.0-514.el7.x86_64 #1 SMP Wed Oct 19 11:24:13 EDT 2016
x86_64 x86_64 x86_64 GNU/Linux
ram:       65689944 kB
cpu 10 core / 40 proc
**users:
str_user90-99
user authentication types:  [X ] Two factor authentication (password + OTP)
**tokens:
Unique ID: totp-90-99
Type: TOTP
Description: STI
Owner: str_user94
Algorithm sha1
Digits 6
Clock offset (seconds) 0
Clock interval (seconds) 30
**Reproduced manually on a terminal after subsequent tries:
...
...
...
[root@replica2 ~]# ssh str_user94@replica2.qe.sti.com
First Factor:
[root@replica2 ~]# ssh str_user94@replica2.qe.sti.com
First Factor:
[root@replica2 ~]# ssh str_user94@replica2.qe.sti.com
Password:
Last login: Mon Oct 30 10:55:56 2017 from replica2.qe.sti.com
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by baiesi@redhat.com.
**Authn/TOTP Test scenario:
Authn totp test simulating 10 user threads all with valid token and setup for
Two factor authentication (password + OTP) only