Syncing a authentication realm deletes user TFA keys

[lodex]

I'm currently implementing multi-factor authentication throughout our network. We plan to use Yubikeys in various ways and wanted to use Yubico OTP for our authentication realm in PVE. This authentication realm synchronizes users and groups from an OpenLDAP server. After setting up Yubico OTP for this authentication realm and adding my Key ID to my user object, I could login without any issues. Since PVE doesn't automatically sync authentication realms (which still baffles me), we have set up a cronjob to do this periodically. After the latest sync, I couldn't login anymore and noticed that the personal Key ID had been removed from my user object. This also happens when an user adds personal TFA with U2F for example. TFA gets simply set to 'No' after each sync. This also happens when I synchronize the realm manually through the GUI.

How can I prevent this?

 

[t.lamprecht]

Hi,

can you please open a report for this over at https://bugzilla.proxmox.com/ so that we can track it and see what a better solution over the current behavior is and implement that.

 

[lodex]

Done. Here's the link to the bug report for reference: https://bugzilla.proxmox.com/show_bug.cgi?id=3668