Change PIN on First Use + Event Trigger not working as expected

droo · February 11, 2019, 5:03pm

I have an enrollment policy with change_pin_on_first_use selected. This works expected and sets the next_pin_change value within the tokeninfo once a token is initially created or the PIN is set.

I then also have an event trigger that fires on token_init and token_setpin (I have also tried adding token_assign, unassign, enable, disable, and set to troubleshoot) that will delete the next_pin_change tokeninfo if the token is a RADIUS token with local_checkpin set to 0.

Unfortunately this is not working as expected, so please let me know if I am doing something incorrectly. When the token is created, the trigger fires to delete the token info, but it appears the policy takes effect even after the trigger and still sets that tokeninfo value.

If I later go back into the token and do a fake PIN change, the event fires as expected and removes the tokeninfo.

cornelinux · February 12, 2019, 3:46pm

The decorator, that sets the pin_change in the tokeninfo is executed after the event wrapper decorator.

github.com

privacyidea/privacyidea/blob/master/privacyidea/api/token.py#L134


@prepolicy(init_random_pin, request)
@prepolicy(encrypt_pin, request)
@prepolicy(check_otp_pin, request)
@prepolicy(check_external, request, action="init")
@prepolicy(init_token_defaults, request)
@prepolicy(papertoken_count, request)
@prepolicy(sms_identifiers, request)
@prepolicy(tantoken_count, request)
@prepolicy(u2ftoken_allowed, request)
@prepolicy(u2ftoken_verify_cert, request)
@postpolicy(save_pin_change, request)
@CheckSubscription(request)
@event("token_init", request, g)
@log_with(log, log_entry=False)
def init():
"""
create a new token.


:jsonparam otpkey: required: the secret key of the token
:jsonparam genkey: set to =1, if key should be generated. We either
               need otpkey or genkey

droo · February 22, 2019, 5:03pm

Okay, I’ll just leave my workaround in place where I fake an “enable” token after I initialize them forcing the event to take place and remove the tokeninfo entry.

Thank you for confirming!