Unable to login using FreeIPA users with 2FA Enabled #3632
Comments
|
I am having the same issue. Users with FreeIPA 2fa enabled are not able to log in. I see the bindRequest for TestUser1 leave NC and a reply from FreeIPA as bindResponse success. Then the NC is sending 2 unbindRequests, followed by the a new bindRequest for that uses the same password+otp as was originally entered for TestUser1 and this returns a bindResponse "Invalid credentials" For those that don't know, the FreeIPA 2fa asks that you concatenate your PW and the OTP you generate all on one line, unlike most systems that ask for them on separate lines/fields. In this case I have only tested with HOTP, going to try TOTP and will update. I have had this issue on a PaloAlto firewall where we had to allow a cookie to be generated at login to prevent having to go back on every request for the PW as it changes after each use. Is there a cookie option setting in php-ldap we can flag? NC 12.0.4, php70 Remi, maria5.5, RHEL 7 in FIPS MODE, Apache2.4 |
|
Are you talking about Nextcloud's 2FA or one provided with FreeIPA? |
ChristophWurst
added
feature: authentication
0. Needs triage
Im running into the same issue. Using FreeIPA's 2FA. I can connect with a browser but the apps fail as it tries to re-authenticate with the same pass+OTP Mine is dockerized and I am more than happy to provide any info you may need. |
|
Any Updates @ChristophWurst ? We have the same issue. Our FreeIPA Instance is configured with 2FA and those Uses which uses 2FA are automatically kicked out after some minutes. |
Yeah, that won't work. Nextcloud keeps the login password in memory to be able to connect to external storage with the same credentials. Therefore it also validates the password every five minutes. For obvious reasons this will fail and the session gets terminated. I'm concluding that FreeIPA in combination with it's 2FA is unfortunately incompatible as user back-end in Nextcloud.
This just confirms my suspicious from above. Closing thus. Thanks for reporting ✌️ |
|
I am sorry for commenting on a closed issue, but could it be possible to implement 2FA with an LDAP backend.
|
Steps to reproduce
Expected behaviour
I would expect to be able to log in as the FreeIPA user, using the 2FA code generated for this account within FreeIPA
Actual behaviour
If it is the first time they have tried logging in, you will get an internal server error. If you have previously disabled the 2FA on the account (within FreeIPA) and logged in, once you re-enable 2FA, you will log in but no files will be there and no links work. Also, as soon as you refresh the page you will be logged out.
Any user that doesnt have 2FA enabled on their FreeIPA account can login fine.
Server configuration
Operating system: Centos 7
Web server: Apache/2.4.6
Database: 5.5.52-MariaDB
**PHP version:**PHP 5.6.30
Nextcloud version: 11.0.1 (stable)
Updated from an older Nextcloud/ownCloud or fresh install: Tried Both
Where did you install Nextcloud from:
https://download.nextcloud.com/server/releases/nextcloud-11.0.1.zip
Signing status:
Signing status
List of activated apps:
App list
The content of config/config.php:
Config report
Are you using external storage, if yes which one: NONE
Are you using encryption: no
Are you using an external user-backend, if yes which one: LDAP (FreeIPA)
LDAP configuration (delete this part if not used)
LDAP config
Client configuration
Browser: Chromium Version 56.0.2924.87 (64-bit)
Operating system: Arch Linux
Logs
Web server error log
Web server error log (NOTE: I access this through a reverse proxy)
Nextcloud log (data/nextcloud.log)
Nextcloud log
Browser log
Browser log
Interestingly, those console errors do not appear when logging in with a user in the internal user list, or with an LDAP user that has 2FA disabled.
The text was updated successfully, but these errors were encountered: