freeipa

#9387 FreeIPA OTP Allows Users with Expired Tokens to Authenticate
Closed: fixed by frenaud. Opened by kschin.

Closed: fixed
Reopen Issue

Issue

Our FreeIPA instance allows a user to bypass OTP even with "passowrd+otp" (only) enabled when his OTP token has expired or is deleted.

Steps to Reproduce

  1. Create a user with ONLY the "password+otp" authentication option enabled
  2. Associate an OTP token with the user
  3. Test user can ONLY login with password+otp
  4. Set OTP token expiration "Validity end" date in the past
  5. Log in with password only

Actual behavior

When a user's OTP has expired, he can log in with a single factor even when the account is explicitly set to ONLY "password+otp"

Expected behavior

The user should not be able to log in without a second factor until the validity end date is extended or a new valid token is issued.

Version/Release/Distribution

  • RHEL 7.9
    • ipa-server-4.6.8-5.el7_9.14.x86_64
    • ipa-client-4.6.8-5.el7_9.14.x86_64
    • 389-ds-base-1.3.11.1-1.el7_9.x86_64
    • pki-ca-10.5.18-25.el7_9.noarch
    • krb5-server-1.15.1-55.el7_9.x86_64

Additional info:

Our IPA servers are pretty much vanilla with OTP enabled.

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2142587

Issue linked to bug 2142587

Metadata Update from @mreynolds:
- Issue assigned to mreynolds

Metadata Update from @mreynolds:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-4915 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2142587)

Jira:

https://issues.redhat.com/browse/RHEL-4915

master:

  • 9ab6601c3103cee1341fb3674a62180ebc482789 Do not let user with an expired OTP token to log in if only OTP is allowed

ipa-4-12:

  • 18303b94bea4e08a0c889fc357df6ba2f308fa0d Do not let user with an expired OTP token to log in if only OTP is allowed

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-4915, https://issues.redhat.com/browse/RHEL-63325 (was: https://issues.redhat.com/browse/RHEL-4915)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.