Repository: privacyidea/privacyidea

Issue:
Messages in /var/log/privacyidea/privacyidea.log
I do run a combination of yubikey/yubico token adn have the following in privacyidea.log:

[2016-07-04 20:07:04,897][22950][139759062931200][INFO][privacyidea.api.lib.postpolicy:169] We only sign JSON response data.
[2016-07-04 20:07:04,897][22950][139759062931200][INFO][privacyidea.api.lib.postpolicy:169] We only sign JSON response data.
[2016-07-04 20:07:04,898][22950][139759054538496][ERROR][privacyidea.lib.tokens.yubicotoken:182] The hash of the return from the Yubico Cloud server does not match the data!
[2016-07-04 20:07:04,898][22950][139759054538496][ERROR][privacyidea.lib.tokens.yubicotoken:182] The hash of the return from the Yubico Cloud server does not match the data!

I'm sure that didn't happen with 2.12 and started with 2.13.



Discussion:
What problem do you experience?

Cornelius Kölbel notifications@github.com writes:

> What problem do you experience?

Authentication works fine, but I get an error mail from privacyidea - I
find that mildly annoying.

## 

The only problem with troubleshooting is that the trouble shoots back.

Obiviously you get this due to the error in 
privacyidea.lib.tokens.yubicotoken:182

Yeah. This code sounds somehow wrong:

```
if signature_valid:
    log.error("The hash of the return from the Yubico "
                   "Cloud server does not match the data!")
```

Should probably be "not signature_valid" ;-)
But still, the last change of this file was in April, 
https://github.com/privacyidea/privacyidea/commits/master/privacyidea/lib/tokens/yubicotoken.py
so I do not know, why you get this log, now.

Anyway, we should change line 181.

Cornelius Kölbel notifications@github.com writes:

> Obiviously you get this due to the error in 
> privacyidea.lib.tokens.yubicotoken:182
> 
> Yeah. This code sounds somehow wrong:
> 
> ```
> if signature_valid:
>     log.error("The hash of the return from the Yubico "
>                    "Cloud server does not match the data!")
> ```
> 
> Should probably be "not signature_valid" ;-)
> But still, the last change of this file was in April, 
> https://github.com/privacyidea/privacyidea/commits/master/privacyidea/lib/tokens/yubicotoken.py
> so I do not know, why you get this log, now.

That was my first check too - but I'll try to take a deeper look into it.

Jochen

## 

The only problem with troubleshooting is that the trouble shoots back.


Resolving patch:
diff --git a/privacyidea/lib/tokens/yubicotoken.py b/privacyidea/lib/tokens/yubicotoken.py
--- a/privacyidea/lib/tokens/yubicotoken.py
+++ b/privacyidea/lib/tokens/yubicotoken.py
@@ -178,9 +178,10 @@ def check_otp(self, anOtpVal, counter=None, window=None, options=None):
                     # check signature:
                     signature_valid = yubico_check_api_signature(data, apiKey)
 
-                    if signature_valid:
-                        log.error("The hash of the return from the Yubico "
-                                  "Cloud server does not match the data!")
+                    if not signature_valid:
+                        log.error("The hash of the return from the yubico "
+                                  "authentication server ({0!s}) "
+                                  "does not match the data!".format(yubico_url))
 
                     if nonce != return_nonce:
                         log.error("The returned nonce does not match "


Test patch: