Authentication chaining does not work if the user search attribute of the LDAP authentication module does not match that of the data store

[tsujiguchitky]

Description

When using e-mail address as user name at login and performing multi-factor authentication such as HOTP by authentication chain, it is considered that the following settings are made.

1. Configure LDAP data store with uid as LDAP Users Search Attribute
2. Configure LDAP auth module with mail as Attributes Used to Search for a User to be Authenticated
3. Configure HOTP auth module
4. Configure auth chain with required modules LDAP + HOTP
5. Try the above auth chain

However, this configuration does not work. That's because what is passed as a username for HOTP authentication is an email address, and with this value HOTP authentication can not get the user from the data store.

The fix for OPENAM-4856 has been changed to use alias attribute. This is for only HOTP auth. Therefore, multiple authentication modules have the same problem.

The alias attribute allows multiple searches to identify users. Not only does this increase processing, I think that there is a risk of matching another user. We need a solution that does not use alias attributes.

Steps to reproduce

See Description.

Expected Results

HOTP authentication works fine.

Actual Results

Because HOTP authentication can not identify the user, it can not send one-time passwords.

References

• [OPENAM-4856] HOTP auth module can not be used in auth chain if the username in sharedstate map does not 'match' the search attribute of the data store
• [OPENAM-5429] OATH auth module can not be used in auth chain if the username in sharedstate map does not 'match' the search attribute of the data store
• [OPENAM-10971] FR-OATH auth module can not be used in auth chain if the username in sharedstate map does not 'match' the search attribute of the data store
• [OPENAM-11115] Push authentication should use alias attributes to find identities
• [OPENAM-11627] DeviceIdSave does not work with User alias search ( if the username in sharedstate map does not 'match' the search attribute of the data store)
• [OPENAM-11177] Scripted auth module can not be used in auth chain if the username in sharedstate map does not 'match' the search attribute of the data store