On Wed, Dec 04, 2019 at 02:15:59PM -0000, Michael Deffenbaugh via FreeIPA-users
wrote:
> I'm having an issue where users who were previously enrolled in OTP (and had
> it enforced) which then were removed from OTP and have no tokens are still
> prompted for "First Factor/Second Factor". Up until recently this has been
> an inconvenience as a user could just leave the field blank and it would
> authenticate; they would only have to wait for IPA to process the
> non-existent OTP token.
>
> Recently I've ran across an application which doesnt support OTP prompting at
> all, and the fact that users are getting prompted for First/Second factor
> breaks the application. While I do have a github issue in with the project
> to properly support OTP, there should be some way to disable the MFA prompt
> that users are getting (via PAM/SSSD?) given we're no longer using it. Any
> thoughts as to where I should look? There's a fair amount of documentation
> on how to enable it, less so on disabling it. Thanks in advance!
Hi,
how did you enable OTP? Globally with
ipa config-mod --user-auth-type=...
or individually for each user with
ipa user-mod --user-auth-type=...
Depending on this you should remove 'otp' either from the global
configuration or for each user.
HTH
bye,
Sumit
>
> Regards,
> Mike
> _______________________________________________
> FreeIPA-users mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[email protected]
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
