Bug 1364157

Summary:	external auth(httpd): two factor authentication fails with user password and otp.
Product:	Red Hat CloudForms Management Engine	Reporter:	amogh <amavinag>
Component:	Appliance	Assignee:	Gregg Tanzillo <gtanzill>
Status:	CLOSED DUPLICATE	QA Contact:	amogh <amavinag>
Severity:	high	Docs Contact:
Priority:	medium
Version:	5.6.0	CC:	abellott, dajohnso, jhardy, jvlcek, obarenbo
Target Milestone:	GA
Target Release:	5.7.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	auth
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-11 12:06:45 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description amogh 2016-08-04 14:55:34 UTC

Description of problem:
external auth(httpd): two factor authentication with user password and otp fails.


Version-Release number of selected component (if applicable):
5.6.1.0.20160726144018_810a94f

How reproducible:
always.

Steps to Reproduce:
1. Configure CFME Administrative UI for external auth(httpd)
2. Configure External Authentication from appliance_console
3. Enabling 2-Factor Authentication for user in IPA server. 
4. create/retrieve ldap user group in the CFME.
4. Try to login with username, and password + OTP. observe that login (auth) fails.
5. The user login with password+OTP works fine for IPA login.
6. observe that there is conflicting log messages in CFME audit.log & evm.log


[root@cfmeappliancesaxpxin log]# tail -f evm.log| grep ldaptest
[----] I, [2016-08-04T10:41:36.759965 #16920:1403084]  INFO -- : <AuditSuccess> MIQ(Authenticator.authenticate) userid: [ldaptest] - User ldaptest successfully validated by External httpd
[----] I, [2016-08-04T10:41:36.919721 #16920:1403084]  INFO -- : MIQ(Authenticator::Httpd#authorize) Authorized User: [ldaptest]
[----] I, [2016-08-04T10:41:37.017044 #16920:1403084]  INFO -- : <AuditSuccess> MIQ(Authenticator.authenticate) userid: [ldaptest] - Authentication successful for user ldaptest
[----] W, [2016-08-04T10:41:37.880881 #16901:1404718]  WARN -- : <AuditFailure> MIQ(Authenticator.authenticate) userid: [ldaptest] - Authentication failed for userid ldaptest: Failure setting user credentials

Actual results:
two factor authentication with user password and otp fails.

Expected results:
two factor authentication with username, (password+OTP) is expected to work.

Additional info:
1. the user login works fine with "user authentication type" option in IPA set to "password"
2. http://file.rdu.redhat.com/abellott/manageiq_docs/master/auth/ipa_2fa.html
3. screenshot(ipa_user_two_factor_auth) for user configuration in IPA is attached.

Comment 4 amogh 2016-08-08 21:51:56 UTC

the problem might be with WEBUI. api request with 2-factor auth for IPA user is successful.

http://<appliance-ip>/api provide 'user_name' and 'password + OTP', observe the api request is successful and response data is displayed correctly.

Comment 5 Joe Vlcek 2016-11-11 12:06:45 UTC


*** This bug has been marked as a duplicate of bug 1390349 ***