Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: external auth(httpd): two factor authentication with user password and otp fails. Version-Release number of selected component (if applicable): 5.6.1.0.20160726144018_810a94f How reproducible: always. Steps to Reproduce: 1. Configure CFME Administrative UI for external auth(httpd) 2. Configure External Authentication from appliance_console 3. Enabling 2-Factor Authentication for user in IPA server. 4. create/retrieve ldap user group in the CFME. 4. Try to login with username, and password + OTP. observe that login (auth) fails. 5. The user login with password+OTP works fine for IPA login. 6. observe that there is conflicting log messages in CFME audit.log & evm.log [root@cfmeappliancesaxpxin log]# tail -f evm.log| grep ldaptest [----] I, [2016-08-04T10:41:36.759965 #16920:1403084] INFO -- : <AuditSuccess> MIQ(Authenticator.authenticate) userid: [ldaptest] - User ldaptest successfully validated by External httpd [----] I, [2016-08-04T10:41:36.919721 #16920:1403084] INFO -- : MIQ(Authenticator::Httpd#authorize) Authorized User: [ldaptest] [----] I, [2016-08-04T10:41:37.017044 #16920:1403084] INFO -- : <AuditSuccess> MIQ(Authenticator.authenticate) userid: [ldaptest] - Authentication successful for user ldaptest [----] W, [2016-08-04T10:41:37.880881 #16901:1404718] WARN -- : <AuditFailure> MIQ(Authenticator.authenticate) userid: [ldaptest] - Authentication failed for userid ldaptest: Failure setting user credentials Actual results: two factor authentication with user password and otp fails. Expected results: two factor authentication with username, (password+OTP) is expected to work. Additional info: 1. the user login works fine with "user authentication type" option in IPA set to "password" 2. http://file.rdu.redhat.com/abellott/manageiq_docs/master/auth/ipa_2fa.html 3. screenshot(ipa_user_two_factor_auth) for user configuration in IPA is attached.
the problem might be with WEBUI. api request with 2-factor auth for IPA user is successful. http://<appliance-ip>/api provide 'user_name' and 'password + OTP', observe the api request is successful and response data is displayed correctly.
*** This bug has been marked as a duplicate of bug 1390349 ***