On ke, 30 touko 2018, Adam Bishop via FreeIPA-users wrote:
I'm using the latest FreeIPA build from CentOS 7.5 - users have
mandatory multifactor access configured.
When binding against the compat tree, I'm able to log in with only a password - is
this expected?
This ticket indicates that if regular binds require multifactor access, compat binds
should too:
https://pagure.io/freeipa/issue/4897
Has the behaviour changed intentionally?
No, there is no behavior change. Did you
supply password+token as a
single string?
More details on how you have configured the system are needed, ideally
with ipa CLI and ldapsearch commands to demonstrate the issue.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland