Yubico Forum
https://forum.yubico.com/

[BUG] yubiauth and quotation mark in password
https://forum.yubico.com/viewtopic.php?f=31&t=1392		 Page 1 of 1
Author:  Tobias [ Thu Jun 05, 2014 10:14 am ]
Post subject:  [BUG] yubiauth and quotation mark in password
Hi

we are using the yubix appliance.

Code:
root@yubix:~# dpkg -l | grep yubi
ii  python-yubiadmin                   0.1.7-1~ppa1~precise1             Web interface for configuring Yubico services
ii  python-yubiauth                    0.3.8-1~ppa1~precise1             User management system with YubiKey validation
ii  python-yubico-client               1.9.1-1~ppa1~precise1             Python Yubico Client
ii  yubikey-ksm                        1.13-1~ppa1~precise1              Key Storage Module for YubiKey One-Time Password (OTP) tokens
ii  yubikey-val                        2.24-1~ppa1~precise1              One-Time Password (OTP) validation server for YubiKey tokens
ii  yubix                              0.5.6~ppa2~precise1               Sets up and configures basic YubiKey servers


We configured yubiauth with ldap.

When the User have a quotation mark (") in the password the auth fail with invalid password. after resetting the pw to something without a quoatation mark everything is fine.

Code:
[INFO] 2014-06-05 08:42:13 requests.packages.urllib3.connectionpool: Starting new HTTP connection (1): localhost
[INFO] 2014-06-05 08:42:13 yubiauth.client.controller: Authentication failed. Username: test, password: <invalid password>, OTP: fkfegieceecbibbnfuihchvkgbergbfebgruvirgnthv
[INFO] 2014-06-05 08:42:47 yubiauth.core.ldapauth: LDAP authentication successful. Bind DN: CN=test,OU=Users,OU=ICWneu,DC=icw,DC=int, server: ldap://kar-ws-1020.icw.int
[INFO] 2014-06-05 08:42:47 requests.packages.urllib3.connectionpool: Starting new HTTP connection (1): localhost
[INFO] 2014-06-05 08:42:47 yubiauth.client.controller: Authentication successful. Username: test, password: <valid password>, OTP: fkfegieceecblrcdeuebgjkerjbgjifckgckrvcdbehf


Is there a way to test the yubiauth component without the radius, to check if it is really the yubiauth and not the radius server that causes the problem.

Thanks and best regards
Tobias
Author:  Tobias [ Tue Jul 01, 2014 12:41 pm ]
Post subject:  Re: yubiauth and quotation mark in password
Hey there,

The ยง in a password is also not working. Same messages in the log file.

Hope somebody can help me with that.

Thanks and best regards
Tobias
Author:  dain [ Thu Jul 31, 2014 9:41 pm ]
Post subject:  Re: [BUG] yubiauth and quotation mark in password
The problems are likely just with the test form in YubiAdmin, since it uses the command line radtest utility and doesn't attempt to escape any strings. You can test authenticating to YubiAuth directly by using the YubiAuth client web interface (currently it lacks a lot of functionality) if it's enabled by going to http://<IP of server running YubiAuth>/yubiauth/ui/
Page 1 of 1 All times are UTC + 1 hour
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/