linotp.tokens.passwordtoken module

This file containes PasswordTokenClass

class linotp.tokens.passwordtoken.PasswordTokenClass(aToken)

Bases: HmacTokenClass

This Token does use a static Password as the OTP value. In addition, the OTP PIN can be used with this token. This Token can be used for a scenario like losttoken

checkOtp(anOtpVal, counter, window, options=None)

checks the static password - using the secret object password comparison method

Parameters

  • anOtpVal – the password to be compared

  • counter –

    • not used for the password token -

  • window –

    • not used for the password token -

  • options –

    • not used for the password token -

Returns

counter, which is 0 for success and -1 for failure

check_otp_exist(otp, window=10, user=None, autoassign=False)

checks if the given OTP value is/are values of this very token. This is used to autoassign and to determine the serial number of a token.

Parameters

  • otp (string) – the to be verified otp value

  • window (int) – the lookahead window for the counter

Returns

counter or -1 if otp does not exist

Return type

int

classmethod getClassInfo(key=None, ret='all')

getClassInfo - returns a subtree of the token definition

Parameters

  • key (string) – subsection identifier

  • ret (user defined) – default return value, if nothing is found

Returns

subsection if key exists or user defined

Return type

s.o.

classmethod getClassPrefix()
classmethod getClassType()

getClassType - return the token type shortname

Returns

‘hmac’

Return type

string

setOtpKey(otpKey, reset_failcount=True)

the seed / secret for the password token contains the unix hashed (hmac256) format of the password. the iv is used as indicator that we are using the new format, which is the ‘:1:’ indicator

Parameters

  • otpKey – the token seed / secret

  • reset_failcount – boolean, if the failcounter should be reseted

update(param)

update - the api, which is called during the token enrollment

we have to make sure that the otpkey, which carries our password is encoded as utf-8 to not break the storing

Raises

otpkey contains the password and is required therefore otherewise raises ParameterError

validate_seed(seed)

Accepts every seed because password token has no restrictions. This overrides the hmactoken’s seed validation (only hex).

Parameters

seed – a string that should be checked for

validity as a seed (aka otpkey)