Allow to disable OTP

[xvitaly]

Once enabled, OTP cannot be disabled due to the following error:

Sorry, You cannot delete your last active token.

[abompard]

Yes, this is a security precaution. It is explained on the OTP creation page (in bold) that once you create an OTP token, you can't disable two-factor authentication.

[abompard]

If you have a GPG key in your account, you can however ask admins to delete your token by sending a signed email to admin @ fedoraproject dot org.

[xvitaly]

Yes, this is a security precaution. It is explained on the OTP creation page (in bold) that once you create an OTP token, you can't disable two-factor authentication.

I don't think this a good idea. The user should be able to manually disable it if needed. All services with OTP support allow this.

[abompard]

Re-opening so that security experts can chime in.

[abompard]

@tiran Do you have an opinion on that?

[tiran]

I don't have a hard opinion. If you implement the feature request, then you should protect it with an additional verification step, e.g. require re-authentication with a valid password and OTP.

FreeIPA doesn't let you remove the last token by default. You have to disable the last token plugin:

dn: cn=IPA OTP Last Token,cn=plugins,cn=config
only:nsslapd-pluginenabled: off

[ryanlerch]

IMO, here on on the noggin side, what we should do is make sure noggin works properly (and doenst show the warnings) if the lasttoken plugin is disabled in freeipa.

Then whoever is managiing the ipa instance noggin is interacting with can make the security decision to disable last token. (in the case of Fedora Accounts, this would probably rest on the security minded folks in the fedora-infra team )

[nirik]

The only case where I can see this being undesired by us is for users with sudo access. We want them all to make sure and have a otp token enrolled. If they don't someone could sniff or otherwise aquire their password and have access to everything they do.
Ideally, there would be some way to mark groups as 'otp required' and 'last otp cannot be removed', but allow no otp/removal by everyone else.

[abompard]

There's one issue, if we allow the deletion of the last token, we can't really prevent users from doing it without re-authentication. Noggin can add that step, but users can login to people.fp.o and do ipa otptoken-del, which will remove the token without re-auth.