1:19 p.m.
On Mon, Dec 16, 2019 at 01:46:19PM -0500, Michael Deffenbaugh wrote:
Not off the top of my head but with the power of google I'm sure
I can
figure it out. If you have an example readily available I won't fight you
for it =)
Hi,
please create a small file e.g. mod.ldif:
-----------------------------------------------------------
dn: uid=IPAUSERNAME,cn=users,cn=accounts,<LDAPBASEDN>
changetype: modify
delete: krbExtraData
krbExtraData:: AAtvdHAAW3siaW5kaWNhdG9ycyI6IFsib3RwIl19XQA=
-----------------------------------------------------------
and then on an IPA server
kinit admin
ldapmodify -Y GSSAPI -f mod.ldif
This should remove the offending attribute.
I guess my bigger question is how did you figure out that *that* attribute
is what was messing me up? I assumed that it was something kerberos
related as my reading (ironically something you wrote:
https://docs.pagure.org/SSSD.sssd/design_pages/pam_conversation_for_otp.html)
led me to understand that the Kerberos server was telling the client pam
stack on what prompts to provide. But I couldn't for the life of me figure
out where the kerberos server was getting that info.
Is there a method that a mere-mortal such as myself could use in the future
to figure that out? If not, I'm happy to accept "it's PFM" on this
one.
Thanks again!
The content of this attriture value is:
$ echo -n AAtvdHAAW3siaW5kaWNhdG9ycyI6IFsib3RwIl19XQA= | base64 -d | od -c
0000000 \0 \v o t p \0 [ { " i n d i c a t
0000020 o r s " : [ " o t p " ] } ] \0
0000040
This is a value used internally to indicate that the ipauserauthtype is
set to 'otp'. I think some older versions of IPA accidentially wrote
this back into the user data in LDAP and as a result 'otp' is enabled
twice, once via ipauserauthtype and the second time via the krbExtraData
value. If 'otp' is removed from ipauserauthtype the krbExtraData is
still present and as a result 'otp' is still advertised and SSSD is
still prompting for it.
HTH
bye,
Sumit
On Mon, Dec 16, 2019 at 11:59 AM Sumit Bose <sbose(a)redhat.com> wrote:
> On Mon, Dec 16, 2019 at 08:29:16AM -0500, Michael Deffenbaugh wrote:
> > Hey Sumit, I pasted it here: https://paste.centos.org/view/6ea2a800
>
> Thanks,
>
> please remove the
>
> krbExtraData: AAtvdHAAW3siaW5kaWNhdG9ycyI6IFsib3RwIl19XQA=
>
> Iirc 'ipa user-mod' cannot handle binary data, so you need a LDAP editor
> or use ldapmodify directly. Do you know how to do it?
>
> bye,
> Sumit
>
> >
> > Max time is 1 day so if you need me to re-paste it let me know. Thanks
> > again!
> >
> > On Mon, Dec 16, 2019 at 6:55 AM Sumit Bose via FreeIPA-users <
> > freeipa-users(a)lists.fedorahosted.org> wrote:
> >
> > > On Wed, Dec 04, 2019 at 12:44:59PM -0500, Michael Deffenbaugh via
> > > FreeIPA-users wrote:
> > > > Hey Sumit, thank you for the reply.
> > > >
> > > > I'm pretty sure I had set it on a per user basis, but it might
have
> been
> > > > globally. I removed the OTP setting using the WebUI in both the
> default
> > > > user config (Global settings), and I forced my user (one of the
> accounts
> > > > experiencing the issue) to password only. This is reflected
> correctly at
> > > > the command line too.
> > > >
> > > > ipa config-show
> > > > ...
> > > > Default user authentication types: password
> > > >
> > > > and ipa user-show <my username>
> > > > ...
> > > > User authentication types: password
> > > >
> > > > Is there something I'm missing? Thanks!
> > >
> > > Hi,
> > >
> > > can you send the output of
> > >
> > > ipa user-show --all --raw <my username>
> > >
> > > I'm especially interested in the 'krbExtraData' attributes,
feel free
> > > to drop or sanitize the other attributes.
> > >
> > > bye,
> > > Sumit
> > >
> > > >
> > > > Regards,
> > > > Mike
> > > >
> > > >
> > > > On Wed, Dec 4, 2019 at 12:35 PM Sumit Bose <sbose(a)redhat.com>
wrote:
> > > >
> > > > > On Wed, Dec 04, 2019 at 02:15:59PM -0000, Michael Deffenbaugh
via
> > > > > FreeIPA-users wrote:
> > > > > > I'm having an issue where users who were previously
enrolled in
> OTP
> > > (and
> > > > > had it enforced) which then were removed from OTP and have no
> tokens
> > > are
> > > > > still prompted for "First Factor/Second Factor". Up
until recently
> > > this
> > > > > has been an inconvenience as a user could just leave the field
> blank
> > > and it
> > > > > would authenticate; they would only have to wait for IPA to
> process the
> > > > > non-existent OTP token.
> > > > > >
> > > > > > Recently I've ran across an application which doesnt
support OTP
> > > > > prompting at all, and the fact that users are getting prompted
for
> > > > > First/Second factor breaks the application. While I do have a
> github
> > > issue
> > > > > in with the project to properly support OTP, there should be
some
> way
> > > to
> > > > > disable the MFA prompt that users are getting (via PAM/SSSD?)
given
> > > we're
> > > > > no longer using it. Any thoughts as to where I should look?
> There's a
> > > > > fair amount of documentation on how to enable it, less so on
> disabling
> > > it.
> > > > > Thanks in advance!
> > > > >
> > > > > Hi,
> > > > >
> > > > > how did you enable OTP? Globally with
> > > > >
> > > > > ipa config-mod --user-auth-type=...
> > > > >
> > > > > or individually for each user with
> > > > >
> > > > > ipa user-mod --user-auth-type=...
> > > > >
> > > > > Depending on this you should remove 'otp' either from
the global
> > > > > configuration or for each user.
> > > > >
> > > > > HTH
> > > > >
> > > > > bye,
> > > > > Sumit
> > > > >
> > > > > >
> > > > > > Regards,
> > > > > > Mike
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
> > > > > > To unsubscribe send an email to
> > > > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > > > Fedora Code of Conduct:
> > > > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > > > List Guidelines:
> > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > > List Archives:
> > > > >
> > >
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > > > >
> > > > >
> > >
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
> > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > Fedora Code of Conduct:
> > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > >
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
> > > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > >
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > >
>
>