Bug 1544679

Short summary of the technical investigation done as part of this Bugzilla:

- We found a way how to make OTP and Radius work in FIPS mode. There is a POC upstream patch: https://github.com/freeipa/freeipa/pull/1621

- With this PR merged, we should be able to remove the code that disables OTP (and Radius maybe too) in FIPS mode as it would work, i.e. patches added in Bug 1486286

- However, note that current implementation of 2FA/OTP cannot be made truly FIPS compliant as it is based on symmetric keys (seeds) being shared between IdM and it's users' soft tokens, which is not OK from FIPS point of view. We would need to rely on other 2FA technology, that could be made FIPS compliant.

As agreed on the last meeting that we want to treat this gap as a Bug, rather an RFE (also given the findings in upstream PR development).

https://github.com/freeipa/freeipa/pull/1621 was merged, so moving to POST.

master:
    c9c58f2 Fix OTP validation in FIPS mode
    a01a24c Increase the default token key size
    d498d72 Revert "Don't allow OTP or RADIUS in FIPS mode"
    bffcef6 Log errors from NSS during FIPS OTP key import

ipa-4-6:

    acb59fc Fix OTP validation in FIPS mode
    6d4ce79 Increase the default token key size
    1df9767 Revert "Don't allow OTP or RADIUS in FIPS mode"
    63c2d2a Log errors from NSS during FIPS OTP key import

ipa-4-5:

    52c5998 Fix OTP validation in FIPS mode
    c7d383c Increase the default token key size
    98efe7c Revert "Don't allow OTP or RADIUS in FIPS mode"
    d23003e Log errors from NSS during FIPS OTP key import

version:
ipa-server-4.6.4-3.el7.x86_64
krb5-server-1.15.1-34.el7.x86_64

Steps:
Steps performed on FIPS enabled machine

1) add user otpuser and nonotp

2) kinit admin

3) ipa user-mod --user-auth-type=otp otpuser

4) ipa otptoken-add  --type=otp --no-qrcode --owner=otpuser

5) use python interpreter to decode the key from step4
   $ python
   >> import base64
   >> decode = base64.b64decode('key-from-step-2')
   >> otp = base64.b32encode(decode)
   >> print otp

6) oathtool -b <otp-from-step5> --totp

7) kinit nonotp

8) klsit  and copy the keyring

9) echo Secret123<otp-from-step6> | kinit -T <keyring-from-step8> otpuser

Actual result:

[root@master ~]# ipa user-mod --user-auth-type=otp otpuser
--------------------
Modified user "otpuser"
--------------------
  User login: otpuser
  First name: None
  Last name: None
  Home directory: /home/otpuser
  Login shell: /bin/sh
  Principal name: otpuser
  Principal alias: otpuser
  Email address: otpuser
  UID: 1820200009
  GID: 1820200009
  User authentication types: otp
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True

[root@master ~]# ipa otptoken-add  --type=totp --no-qrcode --owner=otpuser
------------------
Added OTP token ""
------------------
  Unique ID: 653ca943-f1d1-47a4-96a1-214892c91c00
  Type: TOTP
  Owner: otpuser
  Key: LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=
  Algorithm: sha1
  Digits: 6
  Clock offset: 0
  Clock interval: 30
  URI: otpauth://totp/otpuser:653ca943-f1d1-47a4-96a1-214892c91c00?digits=6&secret=FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO&period=30&algorithm=SHA1&issuer=otp2%40TESTRELM.TEST
[root@master ~]# 
[root@master ~]# python
Python 2.7.5 (default, Jul 16 2018, 19:52:45) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-36)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> decode = base64.b64decode('LRrZ1gm4Wr+0gUdE3xS0yiMWzXa6PwjKoE/Q8MK220R0sC4=')
>>> otp = base64.b32encode(decode)
>>> print otp
FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO
>>> 
[root@master ~]# oathtool -b  FUNNTVQJXBNL7NEBI5CN6FFUZIRRNTLWXI7QRSVAJ7IPBQVW3NCHJMBO --totp
585338
[root@master ~]# kinit nootp
Password for nootp: 
[root@master ~]# 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_XEsgLSI
Default principal: nootp

Valid starting       Expires              Service principal
08/09/2018 02:48:15  08/10/2018 02:48:12  krbtgt/TESTRELM.TEST
[root@master ~]# 
[root@master ~]# 
[root@master ~]# echo Secret123585338 | kinit -T KEYRING:persistent:0:krb_ccache_XEsgLSI otpuser
Enter OTP Token Value: 
[root@master ~]# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_PQ1xogc
Default principal: otpuser

Valid starting       Expires              Service principal
08/09/2018 02:49:02  08/10/2018 02:49:02  krbtgt/TESTRELM.TEST

Expected result:
kinit success with password+otp

Hey Robbie,

Could you change the status to ON_QA so that it can be marked as verified.

Based on observations in comment#19 marking the bug as verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187