Chapter 7. Logging in to the Identity Management Web UI using one time passwords

Procedure

1. Log in to the IdM Web UI with IdM admin privileges.

2. Open the Identity Users Active users tab.

   

3. Select example.user to open the user settings.
4. In the User authentication types, select Two factor authentication (password + OTP).

5. Click Save.

   At this point, the OTP authentication is enabled for the IdM user.

   Now you or example.user must assign a new token ID to the example.user account.

Procedure

1. Add a RADIUS proxy:

   $ ipa radiusproxy-add proxy_name --secret secret

   Copy to Clipboard Toggle word wrap

   The command prompts you for inserting the required information.

   The configuration of the RADIUS proxy requires the use of a common secret between the client and the server to wrap credentials. Specify this secret in the --secret parameter.

2. Assign a user to the added proxy:

   ipa user-mod radiususer --radius=proxy_name

   Copy to Clipboard Toggle word wrap

3. If required, configure the user name to be sent to RADIUS:

   ipa user-mod radiususer --radius-username=radius_user

   Copy to Clipboard Toggle word wrap

   As a result, the RADIUS proxy server starts to process the user OTP authentication.

   When the user is ready to be migrated to the IdM native OTP system, you can simply remove the RADIUS proxy assignment for the user.

   Note

   In certain situations, such as running a RADIUS proxy in a slow network, the Identity Management (IdM) Kerberos Distribution Center (KDC) closes the connection before the RADIUS server responds because the connection timed out while waiting for the user to enter the token. You can change the timeout settings of the KDC.

4. Change the value of the timeout parameter in the [otp] section in the /var/kerberos/krb5kdc/kdc.conf file. For example, to set the timeout to 120 seconds:

   [otp]
   DEFAULT = {
     timeout = 120
     ...
   }

   Copy to Clipboard Toggle word wrap

5. Restart the krb5kdc service:

   # systemctl restart krb5kdc

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the IdM Web UI with your user name and password.
2. To create the token in your mobile phone, open the Authentication OTP Tokens tab.

3. Click Add.

   

4. In the Add OTP token dialog box, leave everything unfilled and click Add.

   At this stage, the IdM server creates a token with default parameters at the server and opens a page with a QR code.

5. Copy the QR code into your mobile phone.

6. Click OK to close the QR code.

   Now you can generate one time passwords and log in with them to the IdM Web UI.

   

Procedure

1. In the Identity Management login screen, enter your user name or a user name of the IdM server administrator account.
2. Add the password for the user name entered above.
3. Generate a one time password on your device.
4. Enter the one time password right after the password without a space.

5. Click Log in.

   If the authentication fails, synchronize OTP tokens.

   If your CA uses a self-signed certificate, the browser issues a warning. Check the certificate and accept the security exception to proceed with the login.

   If the IdM Web UI does not open, verify the DNS configuration of your Identity Management server.

   After a successful login, the IdM Web UI opens.

Procedure

1. On the IdM Web UI login screen, click Sync OTP Token.

   

2. In the login screen, enter your username and the Identity Management password.
3. Generate one time password and enter it in the First OTP field.
4. Generate another one time password and enter it in the Second OTP field.

5. Optional: Enter the token ID.

   

6. Click Sync OTP Token.
7. After a successful synchronization, you can log in to the IdM server.

Procedure

1. In the password expiration login screen, enter the user name.
2. Add the password for the user name entered above.
3. In the OTP field, generate a one time password, if you use one time password authentication.
4. Enter the new password twice for verification.

5. Click Reset Password.

   

   After a successful password change, the usual login dialog displays. Log in with the new password.

Procedure

1. Initialize the credentials cache by running the following command:

   [root@client ~]# kinit -n @IDM.EXAMPLE.COM -c FILE:armor.ccache

   Copy to Clipboard Toggle word wrap

   Note that this command creates the armor.ccache file that you need to point to whenever you request a new Kerberos ticket.

2. Request a Kerberos ticket by running the command:

   [root@client ~]# kinit -T FILE:armor.ccache <username>@IDM.EXAMPLE.COM
   Enter your OTP Token Value.

   Copy to Clipboard Toggle word wrap