{"action":"closed","issue":{"url":"https://api.github.com/repos/privacyidea/privacyidea/issues/338","repository_url":"https://api.github.com/repos/privacyidea/privacyidea","labels_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/338/labels{/name}","comments_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/338/comments","events_url":"https://api.github.com/repos/privacyidea/privacyidea/issues/338/events","html_url":"https://github.com/privacyidea/privacyidea/issues/338","id":139405128,"number":338,"title":"yubikeytoken: can't use pam_yubico - authentication fails","user":{"login":"jh23453","id":4837658,"avatar_url":"https://avatars.githubusercontent.com/u/4837658?v=3","gravatar_id":"","url":"https://api.github.com/users/jh23453","html_url":"https://github.com/jh23453","followers_url":"https://api.github.com/users/jh23453/followers","following_url":"https://api.github.com/users/jh23453/following{/other_user}","gists_url":"https://api.github.com/users/jh23453/gists{/gist_id}","starred_url":"https://api.github.com/users/jh23453/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jh23453/subscriptions","organizations_url":"https://api.github.com/users/jh23453/orgs","repos_url":"https://api.github.com/users/jh23453/repos","events_url":"https://api.github.com/users/jh23453/events{/privacy}","received_events_url":"https://api.github.com/users/jh23453/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/privacyidea/privacyidea/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":{"login":"cornelinux","id":1908620,"avatar_url":"https://avatars.githubusercontent.com/u/1908620?v=3","gravatar_id":"","url":"https://api.github.com/users/cornelinux","html_url":"https://github.com/cornelinux","followers_url":"https://api.github.com/users/cornelinux/followers","following_url":"https://api.github.com/users/cornelinux/following{/other_user}","gists_url":"https://api.github.com/users/cornelinux/gists{/gist_id}","starred_url":"https://api.github.com/users/cornelinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cornelinux/subscriptions","organizations_url":"https://api.github.com/users/cornelinux/orgs","repos_url":"https://api.github.com/users/cornelinux/repos","events_url":"https://api.github.com/users/cornelinux/events{/privacy}","received_events_url":"https://api.github.com/users/cornelinux/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/privacyidea/privacyidea/milestones/22","html_url":"https://github.com/privacyidea/privacyidea/milestones/2.11%20Integration","labels_url":"https://api.github.com/repos/privacyidea/privacyidea/milestones/22/labels","id":1554356,"number":22,"title":"2.11 Integration","description":"SAML Integration and easy migration with RADIUS settings.\r\n\r\nMove the Due date, since SAML integration take some time.\r\nWe move the due date to past the Cebit and CLT, but not on Good Friday but after Easter.","creator":{"login":"cornelinux","id":1908620,"avatar_url":"https://avatars.githubusercontent.com/u/1908620?v=3","gravatar_id":"","url":"https://api.github.com/users/cornelinux","html_url":"https://github.com/cornelinux","followers_url":"https://api.github.com/users/cornelinux/followers","following_url":"https://api.github.com/users/cornelinux/following{/other_user}","gists_url":"https://api.github.com/users/cornelinux/gists{/gist_id}","starred_url":"https://api.github.com/users/cornelinux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cornelinux/subscriptions","organizations_url":"https://api.github.com/users/cornelinux/orgs","repos_url":"https://api.github.com/users/cornelinux/repos","events_url":"https://api.github.com/users/cornelinux/events{/privacy}","received_events_url":"https://api.github.com/users/cornelinux/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":11,"state":"open","created_at":"2016-01-31T23:13:34Z","updated_at":"2016-03-15T15:00:56Z","due_on":"2016-03-28T22:00:00Z","closed_at":null},"comments":4,"created_at":"2016-03-08T21:56:02Z","updated_at":"2016-03-15T15:00:56Z","closed_at":"2016-03-15T15:00:56Z","body":"When using pam_yubico there are some restriction on the token initialization:\r\nWe need to use 6 bytes as prefix, nothing else will work. mass_enroll\r\nshould just handle that right, and the webui should check that.\r\n\r\nAfter that authentication still fails, because we don't find the right token in /ttype/yubikey.\r\n\r\nMy investigations showed, that we store the (internal) uid in the tokeninfo table, but we can't\r\nget back from the prefix to the uid (and from there to the serial number or the token).\r\n\r\nThe following patch stores the prefix instead of the uid when enrolling a yubikey token in the webui:\r\n\r\n--- yubikeytoken.py.orig        2016-03-08 21:09:14.669076518 +0100\r\n+++ yubikeytoken.py     2016-03-08 22:25:26.508837984 +0100\r\n@@ -248,14 +249,14 @@\r\n \r\n         tokenid = self.get_tokeninfo(\"yubikey.tokenid\")\r\n         if not tokenid:\r\n-            log.debug(\"Got no tokenid for %r. Setting to %r.\" % (serial, uid))\r\n-            tokenid = uid\r\n+            log.debug(\"Got no tokenid for %r. Setting to %r.\" % (serial, yubi_prefix))\r\n+            tokenid = yubi_prefix\r\n             self.add_tokeninfo(\"yubikey.tokenid\", tokenid)\r\n \r\n-        if tokenid != uid:\r\n+        if tokenid != yubi_prefix:\r\n             # wrong token!\r\n             log.warning(\"The wrong token was presented for %r. Got %r, expected %r.\"\r\n-                        % (serial, uid, tokenid))\r\n+                        % (serial, yubi_prefix, tokenid))\r\n             return -2\r\n\r\nNow we'll at least have a chance to get further, but this is something for another day."}}