On 2017-05-17 12:06, Andrey Dudin wrote:
> Hello
>
> If I do ipa user-mod test --user-auth-type=password
> --user-auth-type=otp I have user:
>
> [root@ipa-centos]# ipa user-show test
> User login: test
> First name: test
> Last name: test
> Home directory: /home/test
> Login shell: /bin/sh
> Principal name: test@MYDOMAIN.COM <mailto:test@MYDOMAIN.COM>
> Principal alias: test@MYDOMAIN.COM <mailto:test@MYDOMAIN.COM>
> Email address: test@mydomain.com <mailto:test@mydomain.com>
> UID: 152200001
> GID: 152200001
> User authentication types: otp, password
> Account disabled: False
> Password: True
> Member of groups: trust admins, ipausers, admins
> Kerberos keys available: True
>
> I can login into ipa-client.mydomain.com
> <http://ipa-client.mydomain.com > to ssh using password+otp token, but
> for login to IPA Web UI I also need password+otp. I need just password
> for IPA Web UI and password+otp token for ssh on ipa-client.mydomain.com
> <http://ipa-client.mydomain.com >.
It's currently not possible to use password-only login when both 2FA and
password-only are enabled for a user. It's a limitation of the web UI. I
filed a bug report to track the issue, https://pagure.io/freeipa/issue/7068
Regards,
Christian
--
Christian Heimes
Senior Software Engineer, Identity Management and Platform Security
Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael Cunningham, Michael
O'Neill, Eric Shander