Hi guys, thanks for your input here. Phones these days have very accurate time on account
of the demands of TDMA, so it never struck me that the phone could be “out of sync”.
Rather, there may be some TZ quirk that a single sync would have cured the very first time
I tried it and never knew to do it.
That said, I do need to get the issue created so the issue isn’t lost.
best, Brian
On Dec 5, 2018, at 9:04 PM, Simo Sorce <simo(a)redhat.com>
wrote:
On Tue, 2018-12-04 at 09:43 +0100, Florence Blanc-Renaud via FreeIPA-
users wrote:
> On 12/3/18 6:10 PM, Brian Topping via FreeIPA-users wrote:
>> Hi all, I have a question about TOTP authenticators (Google Authenticator, Authy,
FreeOTP):
>>
>> Why is it that a given URL/QRCode can load into all three authenticators, but all
three give different OTP values at any given time and only FreeOTP actually works?
>
> Hi,
>
> TOTP values are generated using the current time to ensure their
> uniqueness. I didn't have any issue when using Google Authenticator and
> FreeOTP, but you need to make sure that the clocks are in sync when
> using TOTP.
Keep in mind that a hardware (or even software) token may have clock
drifting issues. These are handled by the server via token re-sync.
It is best to have clocks in sync, but if the clock doesn't jump wildly
the server should be able to handle clock differences with, at most, a
re-sync.
Simo.
>>
>> When I run `ipa otp-sync` with values from Authy, it crashes:
>>
>> ```
>> [root@ns-0 /]# ipa otptoken-sync 752f744e-1879-4499-a9c5-8932f739d26a
>> User ID: player1
>> Password:
>> First Code:
>> Second Code:
>> ipa: ERROR: non-public: AttributeError: 'NoneType' object has no
attribute 'name'
>> Traceback (most recent call last):
>> File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 139,
in execute
>> result = self.Command[_name](*args, **options)
>> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447,
in __call__
>> return self.__do_call(*args, **options)
>> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475,
in __do_call
>> ret = self.run(*args, **options)
>> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1199,
in run
>> return self.forward(*args, **options)
>> File "/usr/lib/python2.7/site-packages/ipaclient/plugins/otptoken.py",
line 168, in forward
>> query['token'] = DN((obj.primary_key.name, args[0]),
>> AttributeError: 'NoneType' object has no attribute 'name'
>> ipa: ERROR: an internal error has occurred
>> ```
>>
>
> I could consistently reproduce the AttributeError exception. Could you
> please open a ticket on pagure for this issue
> (
https://pagure.io/freeipa/new_issue)?
>
> flo
>
>
>> Thanks kindly for any leads on this!
>>
>> Brian
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
<
https://getfedora.org/code-of-conduct.html>
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
<
https://fedoraproject.org/wiki/Mailing_list_guidelines>
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
Simo Sorce
Sr. Principal Software Engineer
Red Hat, Inc