Repository: privacyidea/privacyidea

Issue:
Probably missing url encoding in TiQR URL
Hi all,

as mentioned in the community [https://community.privacyidea.org/t/tiqr-token-reflections-and-possible-improvements/2434](url), could be that the actual process in generation of the QR Code needs to be a little bit improved.

Based on the documentation a QR code need to have this schema :

`tiqrauth://[<identityIdentifier>@]
<serviceIdentifier>/
<sessionKey>/
<challenge>[?<return Url>]`

Analyzing the code here : [privacyidea/tiqrtoken.py at master · privacyidea/privacyidea · GitHub](https://github.com/privacyidea/privacyidea/blob/master/privacyidea/lib/tokens/tiqrtoken.py#L430)

I find out that at the end inside the QR code is also present the “service_displayname”. As in the WebUI in PI is not prevented the usage of white spaces (TiQR Service Displayname under Config → Tokens → TiQR), in case of the presence of white spaces the QR Code is generated with those present and as per result an error in authentication. 

Just checked adding a dash instead of the space. In this case the auth is working prefectly.

So making a small change in the PI code mentioned before and using “service_identifier” in this line [privacyidea/tiqrtoken.py at master · privacyidea/privacyidea · GitHub 2](https://github.com/privacyidea/privacyidea/blob/master/privacyidea/lib/tokens/tiqrtoken.py#L435) instead of “service_displayname”, the problem described before using the Mobile App is not present anymore and the authentication process is working perfectly and always with positive results.

Many Thanks & Best Regards,
Luca


Discussion:
Thank you for filing an issue and sharing your observations or ideas. Please be sure to provide as many information as possible to help us working on this issue.
I think we need to check if

a) we really need to put the `service_identifier` in the URL of the qr code or
b) if we need to urlencode it anyways.
Your doubts are for sure right and valid. 
My findings are coming from an analysis using the only Mobile App that I know present, at least in Apple Store world, and available if you want to play with this kind of Auth Token.
Could be that a different and custom App Token can react in a different way, but at the moment I cannot confirm that.
At least with this mobile App and after the analysis of the QR Code provided from the [tiqr demo website](https://demo.tiqr.org) , with mine suggested enhancements the App was super happy.
In theory also without the `service_identifier` is supposed to be working, except some complaints from the App itself.
Also this latest part was tested by me and working.
So probably your point a) would be the best approach for being more flexible in the future. But I can also be wrong.

Resolving patch:
diff --git a/privacyidea/lib/tokens/tiqrtoken.py b/privacyidea/lib/tokens/tiqrtoken.py
--- a/privacyidea/lib/tokens/tiqrtoken.py
+++ b/privacyidea/lib/tokens/tiqrtoken.py
@@ -80,7 +80,7 @@
 This code is tested in tests/test_lib_tokens_tiqr.
 """
 
-from six.moves.urllib.parse import quote_plus
+from six.moves.urllib.parse import quote, quote_plus
 
 from privacyidea.api.lib.utils import getParam
 from privacyidea.lib.config import get_from_config
@@ -432,8 +432,7 @@ def create_challenge(self, transactionid=None, options=None):
                                               service_identifier,
                                               db_challenge.transaction_id,
                                               challenge,
-                                              service_displayname
-                                              )
+                                              quote(service_displayname))
         image = create_img(authurl, width=250)
         attributes = {"img": image,
                       "value": authurl,


Test patch: