Hi guys, thanks for your input here. Phones these days have very accurate time on account of the demands of TDMA, so it never struck me that the phone could be “out of sync”. Rather, there may be some TZ quirk that a single sync would have cured the very first time I tried it and never knew to do it. 

That said, I do need to get the issue created so the issue isn’t lost.

best, Brian

On Dec 5, 2018, at 9:04 PM, Simo Sorce <simo@redhat.com> wrote:

On Tue, 2018-12-04 at 09:43 +0100, Florence Blanc-Renaud via FreeIPA-
users wrote:
On 12/3/18 6:10 PM, Brian Topping via FreeIPA-users wrote:
Hi all, I have a question about TOTP authenticators (Google Authenticator, Authy, FreeOTP):

Why is it that a given URL/QRCode can load into all three authenticators, but all three give different OTP values at any given time and only FreeOTP actually works?

Hi,

TOTP values are generated using the current time to ensure their 
uniqueness. I didn't have any issue when using Google Authenticator and 
FreeOTP, but you need to make sure that the clocks are in sync when 
using TOTP.

Keep in mind that a hardware (or even software) token may have clock
drifting issues. These are handled by the server via token re-sync.
It is best to have clocks in sync, but if the clock doesn't jump wildly
the server should be able to handle clock differences with, at most, a
re-sync.

Simo.


When I run `ipa otp-sync` with values from Authy, it crashes:

```
[root@ns-0 /]# ipa otptoken-sync 752f744e-1879-4499-a9c5-8932f739d26a
User ID: player1
Password:
First Code:
Second Code:
ipa: ERROR: non-public: AttributeError: 'NoneType' object has no attribute 'name'
Traceback (most recent call last):
 File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 139, in execute
   result = self.Command[_name](*args, **options)
 File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__
   return self.__do_call(*args, **options)
 File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call
   ret = self.run(*args, **options)
 File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 1199, in run
   return self.forward(*args, **options)
 File "/usr/lib/python2.7/site-packages/ipaclient/plugins/otptoken.py", line 168, in forward
   query['token'] = DN((obj.primary_key.name, args[0]),
AttributeError: 'NoneType' object has no attribute 'name'
ipa: ERROR: an internal error has occurred
```


I could consistently reproduce the AttributeError exception. Could you 
please open a ticket on pagure for this issue 
(https://pagure.io/freeipa/new_issue)?

flo


Thanks kindly for any leads on this!

Brian
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org


_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org

-- 
Simo Sorce
Sr. Principal Software Engineer
Red Hat, Inc