Bug 1564390

Summary: OTP and Radius Authentication does not work in FIPS mode [rhel-7.5.z]
Product: Red Hat Enterprise Linux 7 Reporter: Oneata Mircea Teodor <toneata>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED ERRATA QA Contact: ipa-qe <ipa-qe>
Severity: unspecified Docs Contact:
Priority: high    
Version: 7.4CC: akasurde, davdunc, enewland, frenaud, godfrey.watama, ipa-maint, ipa-qe, ksiddiqu, lmanasko, mkosek, mvarun, myusuf, npmccallum, pasik, pvoborni, rcritten, rharwood, rpage, slaznick, ssekidde, toneata, tscherf, xdong
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
URL: https://github.com/freeipa/freeipa/pull/1621
Whiteboard:
Fixed In Version: ipa-4.5.4-10.el7_5.1 Doc Type: Bug Fix
Doc Text:
Previously, the one-time password (OTP) logins required APIs that were not available in the FIPS mode. As a consequence, authentication of OTP and RADIUS failed when the user installed Identity Management (IdM) on a machine with FIPS enabled. This update overcomes the described failure by using a different set of APIs for loading the OTP secret. As a result, IdM now supports the OTP and RADIUS authentication on machines with FIPS enabled.
Story Points: ---
Clone Of: 1544679 Environment:
Last Closed: 2018-05-14 16:11:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1544679    
Bug Blocks:    

Description Oneata Mircea Teodor 2018-04-06 07:13:08 UTC
This bug has been copied from bug #1544679 and has been proposed to be backported to 7.5 z-stream (EUS).

Comment 5 Mohammad Rizwan 2018-04-12 11:54:33 UTC
version:
ipa-server-4.5.4-10.el7_5.1.x86_64

Steps to Reproduce:
1. Install RHEL7.5 and enable FIPS mode
2. Add a user and enable two factor authentication
3. Add OTP token from FreeOTP
4. Login with password+otp

Actual result:
[root@master otp]# cat /proc/sys/crypto/fips_enabled 
1

Login with password+otp success

Expected result:
Login with password+otp success

Comment 6 Mohammad Rizwan 2018-04-12 11:56:25 UTC
Based on comment#5 making bug as verified.

Comment 7 Florence Blanc-Renaud 2018-04-25 08:28:53 UTC
Hi Nathaniel,
could you check/fix the Doc text that I just added? thanks

Comment 8 Nathaniel McCallum 2018-04-25 14:23:46 UTC
I updated the text.

Comment 13 errata-xmlrpc 2018-05-14 16:11:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1395