Bug 1384964

Summary:	Document how to resolve lost OTP tokens and what are the security risks of general RBAC permissions
Product:	Red Hat Enterprise Linux 7	Reporter:	Petr Vobornik <pvoborni>
Component:	doc-Linux_Domain_Identity_Management_Guide	Assignee:	Marc Muehlfeld <mmuehlfe>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.3	CC:	rhel-docs
Target Milestone:	rc	Keywords:	Documentation
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-09 10:31:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Vobornik 2016-10-14 12:39:25 UTC

Description of problem:
This bz is based on https://fedorahosted.org/freeipa/ticket/6376 FreeIPA won't implement ticket #6376 because the RBAC permissions for help desk might depend on organization needs/structure.

Adding general "modify" permission as for other objects might cause a security risk - more on http://www.freeipa.org/page/V4/OTP#Helpdesk

A possible way to resolve lost token and what security risk a general permission might cause should be documented.

Otline, how to resolve lost token:
1. admin can enable password auth for the user
2. user can then create new otp token 
3. user can remove old token
4. admin can disable password auth

SME: Nathaniel McCallum

Comment 5 Marc Muehlfeld 2019-04-09 10:31:38 UTC

The update is now available on the Customer Portal.