<div dir="ltr"><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Hi Nathaniel, </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">I think your patch should work. Please give me a day to test and confirm. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">However, I changed this section in otptoken.py:</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace"> StrEnum('ipatokenotpalgorithm?',</font></div><div class="gmail_default"><font face="monospace, monospace"> cli_name='algo',</font></div><div class="gmail_default"><font face="monospace, monospace"> label=_('Algorithm'),</font></div><div class="gmail_default"><font face="monospace, monospace"> doc=_('Token hash algorithm'),</font></div><div class="gmail_default"><font face="monospace, monospace"> default=u'sha1',</font></div><div class="gmail_default"><font face="monospace, monospace"> autofill=True,</font></div><div class="gmail_default"><font face="monospace, monospace"> flags=('no_update'),</font></div><div class="gmail_default"><font face="monospace, monospace"> values=(u'sha1', u'sha256', u'sha384', u'sha512'),</font></div><div class="gmail_default"><font face="monospace, monospace"> )</font></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">to </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace"> StrEnum('ipatokenotpalgorithm?',</font></div><div class="gmail_default"><font face="monospace, monospace"> cli_name='algo',</font></div><div class="gmail_default"><font face="monospace, monospace"> label=_('Algorithm'),</font></div><div class="gmail_default"><font face="monospace, monospace"> doc=_('Token hash algorithm'),</font></div><div class="gmail_default"><font face="monospace, monospace"> default=<b>u'SHA1',</b></font></div><div class="gmail_default"><font face="monospace, monospace"> autofill=True,</font></div><div class="gmail_default"><font face="monospace, monospace"> flags=('no_update'),</font></div><div class="gmail_default"><font face="monospace, monospace"> values=<b>(u'SHA1', u'SHA256', u'SHA384', u'SHA512')</b>,</font></div><div class="gmail_default"><font face="monospace, monospace"> )</font></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">And the Google Authenticator installed on a iPhone was able to scan the QR code and work as expected. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Thanks for looking into this. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Regards. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">--Prashant</div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 17 June 2015 at 20:00, Nathaniel McCallum <span dir="ltr"><<a href="mailto:npmccallum@redhat.com" target="_blank">npmccallum@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Prashant,<br> <br> I have proposed a patch for the issue:<br> <a href="https://www.redhat.com/archives/freeipa-devel/2015-June/msg00505.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-devel/2015-June/msg00505.html</a><br> <br> Please test it and let me know if it works for you.<br> <br> Nathaniel<br> <div class="HOEnZb"><div class="h5"><br> On Wed, 2015-06-17 at 12:35 +0530, Prashant Bapat wrote:<br> > Simo is right! This issue is same as<br> > <a href="https://fedorahosted.org/freeipa/ticket/5047" rel="noreferrer" target="_blank">https://fedorahosted.org/freeipa/ticket/5047</a><br> ><br> > If I change the algorithm in the otp url to uppercase it scans in<br> > Google authenticator/iPhone.<br> ><br> > Further more I manually edited the /usr/lib/python2.7/site<br> > -packages/ipalib/plugins/otptoken.py and uppercases the 'sha' to<br> > 'SHA' in a test VM and it works as expected. I hate to do this in the<br> > production server though.<br> ><br> ><br> > On 12 June 2015 at 23:32, Prashant Bapat <<a href="mailto:prashant@apigee.com">prashant@apigee.com</a>> wrote:<br> > > Hi,<br> > ><br> > > Has anyone seen this ? When a user tries to scan the QR code he<br> > > gets a message saying "invalid barcode". This happens only with<br> > > iPhone + Google Authenticator.<br> > ><br> > > Thanks for your help.<br> > ><br> > > --Prashant<br> > ><br> </div></div><span class="HOEnZb"><font color="#888888">> --<br> > Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> </font></span></blockquote></div><br></div>