Adding OTP token without using IPA UI

[dd4321 Dey]

Hi

Is it possible to add/generate OTP token without using IPA user interface ? Due to
security reasons, i don't want to give access to IPA web interface to users. Recently,
i have configured password manager which integrates OpenLDAP/IPA server. So each user can
change their password using password manager eliminating needs for accessing IPA web UI.
In the same way, is it possible to do the same i.e generating OTP token using any third
party application ?

Regards

[Russell Long]

Not sure if it's what you're looking for, but I developed a bash script to
auto-generate tokens daily for all users not in my service-accounts group
if they did not exist. It then emails a QR code to the user and a
notification email to the management email.  This may not be the best way
to do it, but it works for us.

https://gogs.tfmm.co/tfmm/freeipa-generate-otp-tokens

--Russ

On Thu, Mar 11, 2021 at 8:39 AM dd4321 Dey via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Hi
>
>  Is it possible to add/generate OTP token without using IPA user interface
>  ? Due to security reasons, i don't want to give access to IPA web interface
>  to users. Recently, i have configured password manager which integrates
>  OpenLDAP/IPA server. So each user can change their password using password
>  manager eliminating needs for accessing IPA web UI. In the same way, is it
>  possible to do the same i.e generating OTP token using any third party
>  application ?
>
>  Regards
>
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Alexander Bokovoy]

On to, 11 maalis 2021, dd4321 Dey via FreeIPA-users wrote:
> Hi
>
> Is it possible to add/generate OTP token without using IPA user
> interface ? Due to security reasons, i don't want to give access to IPA
> web interface to users. Recently, i have configured password manager
> which integrates OpenLDAP/IPA server. So each user can change their
> password using password manager eliminating needs for accessing IPA web
> UI. In the same way, is it possible to do the same i.e generating OTP
> token using any third party application ? 
Use IPA command line tools. They have everything you see in UI and even
more as some functionality is not implemented in Web UI yet.

'ipa otptoken-add' would add the token and display the QR code in
console. This is basically the same as in UI.

IPA command line tools have help and self-discovery, use it:

  ipa help
  ipa help topics
  ipa help otp
  ipa help otptoken
  ipa help otptoken-add


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[dd4321 Dey]

Hi

Russel, Thanks for the pointer/quick reply as well as for the shell script :) which i will
definitely go through and modify as per my requirements.

Warm regards