Repository: privacyidea/privacyidea

Issue:
Trigger challenge fails if android app is deinstalled
<!--
Thank you for filing a bug within privacyIDEA.
Please read the following blog post.
https://www.privacyidea.org/getting-help/

The more information you provide, the easier it is to identify 
the problem!

Issues are not meant for asking questions!
If you simply wonder how things work and need some explanation 
please visit the community forum:

https://community.privacyidea.org

If you do not like the NO-WARRANTY of this software and need
reliable, professional help, please consider getting either
- consultancy 
  (https://netknights.it/en/leistungen/one-time-services/)
- or the privacyIDEA Enterprise Edition 
  (https://netknights.it/en/leistungen/service-level-agreements/)

If you still think, you should open an issue, please do so:
-->

# What did you try to do?

* Enrolled push token with android app
* Removed android app (push token is still in privacyIDEA)
* validate/triggerchallenge

# What outcome did you expect?

Trigger challenge shows my tokens and their messages

# What outcome did you experience?

HTTP 400 BAD REQUEST
result -> error -> code: 401
result -> error -> message: "ERR401: Failed to submit message to firebase service."

# Configuration

* privacyIDEA Version: 3.0.1 (master branch)
* Installation method: venv

## more details: 

* OS: Ubuntu 19.04
* Webserver: Apache2
* Tokendatabase: MySQL
* Android: latest beta from play store (2.0.1?)

# Log file

The attached log file is the response after I did /validate/triggerchallange 

This repeats 134 times with different lines (see log file)
```
Traceback (most recent call last):
  File "/usr/lib/python2.7/logging/handlers.py", line 77, in emit
    self.doRollover()
  File "/usr/lib/python2.7/logging/handlers.py", line 142, in doRollover
    os.rename(self.baseFilename, dfn)
OSError: [Errno 13] Permission denied
Logged from file before_after.py, line 88
```
This is the last line
```
<my pi ip> - - [11/Jun/2019 12:39:29] "POST /validate/triggerchallenge HTTP/1.1" 400 -
```

[privacyidea.log](https://github.com/privacyidea/privacyidea/files/3276051/privacyidea.log)



Discussion:
It looks like as if this is due to the firebase token of the smartphone does not exist in Firebase anymore.
A more specific error message could be helpful.

Also: If the user has several challenge response tokens, this failing Firebase request should not result in having the complete challenge fail. 
I.e. If the user has a Push token and an sms token and he deletes the push token from his phone (but both tokens still exist in privacyIDEA server), the user should still be able to login (challenge response) with the SMS token.

We need to assure, that the failing submit to Firebase does not raise an exception in this way, that the complete /validate/Check or /validate/triggerchallenge fails.
On version 3.6dev4 this problem does not persist as described here. Instead, when triggering a challenge, nothing indicates that the challenge could not be delivered via firebase.

I will try to investigate if it is possible to give feedback to the user / write something to the server's log if supplying the challenge to firebase fails.

Note: The server allows polling but is not configured for poll-only.
I do not understand your "Note". The server can allow polling also in "firebase"-Mode. "poll-only" does only mean, that firebase is not used.

Resolving patch:
diff --git a/privacyidea/lib/tokens/pushtoken.py b/privacyidea/lib/tokens/pushtoken.py
--- a/privacyidea/lib/tokens/pushtoken.py
+++ b/privacyidea/lib/tokens/pushtoken.py
@@ -860,8 +860,10 @@ def create_challenge(self, transactionid=None, options=None):
                 db_challenge.save()
                 self.challenge_janitor()
 
-            # If sending the Push message failed, we still raise an error.
+            # If sending the Push message failed, we still raise an error and a warning.
             if not res:
+                log.warning(u"Failed to submit message to firebase service for token {0!s}."
+                            .format(self.token.serial))
                 raise ValidateError("Failed to submit message to firebase service.")
         else:
             log.warning(u"The token {0!s} has no tokeninfo {1!s}. "


Test patch: