Multiple push tokens

[skug67]

For a user with a single push token this proxy is working perfectly. But if there are multiple push tokens associated with a given user then I end up getting sequential push requests -- first to the first listed token and after than was is accepted another to the next token. This happens even if the second token is disabled.

Unfortunately, I'm utterly clueless as to how to proceed.....

[cornelinux]

We have not tested with multiple push tokens. You should assure to only enroll one push token to the users.

[skug67]

If users have two devices that they might want to use as authenticators (e.g., cellphone and tablet) would it be possible for them to share a single token? (I assume not, but was wondering)

[cornelinux]

No, copying the token between devices is not possible. For security reasons it is bound to two devices.
We will one day look into multiple tokens, but currently we have other higher prio issues (like the rewrite of the app itself)

[skug67]

More than fair enough. Just wondering.

…

Sent from my iPad

On Aug 9, 2020, at 11:49 AM, Cornelius Kölbel ***@***.***> wrote:  No, copying the token between devices is not possible. For security reasons it is bound to two devices. We will one day look into multiple tokens, but currently we have other higher prio issues (like the rewrite of the app itself) — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[cornelinux]

You are running with push_wait config, right?
Which version of privacyidea are you running?
This would be nothing ldap proxy or probably nothing app sepcific.

[skug67]

privacyidea 3.3.3 It seems to work with the Keycloak provider that it sends a push to both devices and responding on one is good enough to login.

…

Sent from my iPad

On Aug 9, 2020, at 1:06 PM, Cornelius Kölbel ***@***.***> wrote:  You are running with push_wait config, right? Which version of privacyidea are you running? This would be nothing ldap proxy or probably nothing app sepcific. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[cornelinux]

The keycloak plugin actually uses the full API, i.e. it polls privacyIDEA for a response.
THe LDAP proxy can only use push wait.
So I guess it is an issue in the push_wait of the privacyIDEA server.
See privacyidea/privacyidea#2323