freeipa

#7804 `ipa otptoken-sync` fails with stack trace
Closed: fixed by cheimes. Opened by briantopping.

Closed: fixed
Reopen Issue

Issue

When synchronizing a token using ipa otptoken-sync, incorrect parameters to the invocation properly fail, but correct parameters give a stack trace.

Steps to Reproduce

  1. Follow steps in https://bugzilla.redhat.com/show_bug.cgi?id=1217009#c11

Actual behavior

[root@freeipa-vpn-0 /]# ipa otptoken-sync 752f744e-1879-4499-a9c5-8932f739d26a
User ID: player1
Password: 
First Code: 
Second Code: 
ipa: ERROR: non-public: AttributeError: 'NoneType' object has no attribute 'name'
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 139, in execute
    result = self.Command[_name](*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1199, in run
    return self.forward(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipaclient/plugins/otptoken.py", line 168, in forward
    query['token'] = DN((obj.primary_key.name, args[0]),
AttributeError: 'NoneType' object has no attribute 'name'
ipa: ERROR: an internal error has occurred

Expected behavior

As in the example, a result of Token synchronized.

Version/Release/Distribution

[root@ns-0 /]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.4-10.el7.centos.x86_64
ipa-client-4.6.4-10.el7.centos.x86_64
389-ds-base-1.3.8.4-18.el7_6.x86_64
pki-ca-10.5.9-6.el7.noarch
krb5-server-1.15.1-34.el7.x86_64

Additional info:

Behavior was confirmed by @frenaud in https://lists.fedorahosted.org/archives/list/freeipa-users%40lists.fedorahosted.org/thread/EKJLQ3NASR6MYRT6QPD3LNFUEVEIFJHL/

The otptoken-sync feature is still broken in 4.8.2. It looks like there is also a bug in the Python 3 port:

# ipa otptoken-sync
User ID: testuser
Password: 
First Code: 
Second Code: 
ipa: ERROR: non-public: TypeError: POST data should be bytes, an iterable of bytes, or a file object. It cannot be of type str.
Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/ipalib/backend.py", line 141, in execute
    return self.Command[_name](*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipalib/frontend.py", line 1208, in run
    return self.forward(*args, **options)
  File "/usr/lib/python3.7/site-packages/ipaclient/plugins/otptoken.py", line 179, in forward
    rsp = urllib.request.build_opener(handler).open(sync_uri, query)
  File "/usr/lib64/python3.7/urllib/request.py", line 523, in open
    req = meth(req)
  File "/usr/lib64/python3.7/urllib/request.py", line 1247, in do_request_
    raise TypeError(msg)
TypeError: POST data should be bytes, an iterable of bytes, or a file object. It cannot be of type str.
ipa: ERROR: an internal error has occurred

Metadata Update from @cheimes:
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.8.4

Metadata Update from @cheimes:
- Issue assigned to cheimes

Metadata Update from @cheimes:
- Custom field rhbz adjusted to https://github.com/freeipa/freeipa/pull/3951

Metadata Update from @cheimes:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1777811 (was: https://github.com/freeipa/freeipa/pull/3951)

Issue linked to Bugzilla: Bug 1777811

master:

  • 095d3f9bc94e5d43f5ebb89b88ee87b330af5c1d Add test case for OTP login
  • e8b98555fcbdc76c2e728d0c93cbbabeebad9a26 Fix otptoken_sync plugin

ipa-4-8:

  • 90f2866163b6fb4ec7f533e8d4820089b804d707 Fix otptoken_sync plugin
  • dfa356e3d60468fab9eb873adfa0b08a7f8fd842 Add test case for OTP login

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-7:

  • 85b595aefacd8a52ca9cadf53bdd74184aeb2ba8 Add test case for OTP login
  • 40359d2e1a1c4038ac9fc1afa2841e55b11073d8 ipatests: Added test when 2FA prompting configurations is set.

ipa-4-6:

  • cabb7abfc07b093a9912b20ee712baaa40d16d19 Add test case for OTP login
  • b36c4a70fc0e577265bb587de1e1b7bd739a8709 ipatests: Added test when 2FA prompting configurations is set.
  • 734121fa1497ef2e074d2879ab9fc54c0ace95b8 Mark xfail for tests using sssd-1.16.3

ipa-4-6:

  • e2238fdf92b1df15e510d190cf3c4201dd51cbee ipa otptoken-sync: return error when sync fails
  • 0c62aef1482ea97aaa04af667980a99faa0071a8 ipatests: add negative test for otptoken-sync
  • 69c376b9e62c39f73bc9dbce081c29a0c448f3ca ipatests: python2 does not support f-strings
  • d587d0f48b488e862674bdd8c2b6d0a75eee0612 Fix otptoken_sync plugin
Metadata
None
None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.