<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Jun 27, 2014, at 1:49 PM, Simo Sorce <<a href="mailto:simo@redhat.com">simo@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">On Fri, 2014-06-27 at 19:19 +0200, Petr Vobornik wrote:<br><blockquote type="cite">On 27.6.2014 19:00, Simo Sorce wrote:<br><blockquote type="cite">On Fri, 2014-06-27 at 19:55 +0300, Alexander Bokovoy wrote:<br><blockquote type="cite">On Fri, 27 Jun 2014, Martin Kosek wrote:<br><blockquote type="cite">Hello team,<br><br>As we are about to very soon release the FreeIPA 4.0, I triaged all the pending<br>tickets and divided them to following milestones:<br><br>1) FreeIPA 4.0 GA - last work that is required for the release. When this<br>milestone is completed, we will release. All tickets in this milestone are thus<br>the top priority for people working on 4.0 - this applies both for development<br>and for reviews.<br></blockquote>Endi found that with TOTP we don't yet enforce a requirement to prevent<br>reuse of OTP code multiple times within the same time step (you are able<br>to login with TOTP and reuse it for password change within 30 seconds,<br>for example). RFC3268 part 5.2 clearly says that the verifier MUST NOT<br>allow this behavior.<br><br>I'll look into this case on Monday but so far this is a release blocker.<br></blockquote><br>This is a well known limitation.<br><br>The reason we allow for it is due to performance issues with replication<br>if we did so, we do not have a good way to mark used values in a<br>distributed fashion.<br><br></blockquote><br><blockquote type="cite">It's for the same reason that we have not implemented HOTP yet.<br></blockquote><br>Not entirely true:<br><a href="http://www.redhat.com/archives/freeipa-devel/2014-January/msg00069.html">http://www.redhat.com/archives/freeipa-devel/2014-January/msg00069.html</a><br></blockquote><br>I should probably have said we have not implemented it *for* HOTP.<br><br>That said using HOTP is not really something I would recommend at this<br>point as each authentication will cause a replication event to be fired.<br>That is probably ok if you have very few users/authentications, but in<br>large domains it would quickly be problematic.<br><br>Responding to Alexander, yes we need to document that we have this<br>limitation.<br></div></blockquote></div><br><div>+1, we need to clearly document it. I plan to work on this next week.</div><div><br></div><div>Just to outline the situation:</div><div><br></div><div>We currently implement two features: TOTP and HOTP. We currently only recommend deploying TOTP due to the aforementioned replication issues.</div><div><br></div><div>HOTP will not permit key reuse, but TOTP will. We call this feature for TOTP “high watermark.” The reasons for this are twofold.</div><div><br></div><div>First, we have a general concern about replication storms when recording the high watermark. We hope to solve this problem in the next release by defining a mechanism for high priority replication and, hopefully, custom replication conflict resolvers to prevent a possible scenario where the counter would move backwards.</div><div><br></div><div>Second, when using HOTP, a bug is triggered in SSSD password changing where a token is implicitly used twice in a row. Enabling high watermark support for TOTP also triggers this bug. Fixing this in SSSD is also high on the priority list for the next release.</div><div><br></div><div>So, in short, it is a known defect that is not a blocker for this release and that needs to be appropriately documented.</div><div><br></div><div>Nathaniel</div></body></html>