Repository: privacyidea/privacyidea

Issue:
Wrong text during enrolling email via multichallenge
if a user logins for the first time and doesn’t have any tokens yet instead of hard coded “Please enter your email address!”, header challenge text + footer challenge text are displayed (which should be displayed when asking for OTP)


Discussion:

Resolving patch:
diff --git a/privacyidea/api/lib/postpolicy.py b/privacyidea/api/lib/postpolicy.py
--- a/privacyidea/api/lib/postpolicy.py
+++ b/privacyidea/api/lib/postpolicy.py
@@ -798,8 +798,8 @@ def multichallenge_enroll_via_validate(request, response):
     :return:
     """
     content = response.json
-    # check, if the authentication was successful, then we need to do nothing
     result = content.get("result")
+    # check, if the authentication was successful, then we need to do nothing
     if result.get("value") and result.get("authentication") == "ACCEPT":
         user_obj = request.User
         if user_obj.login and user_obj.realm:
@@ -834,6 +834,9 @@ def construct_radius_response(request, response):
     results in an empty response with a HTTP 204 status code.
     An unsuccessful authentication results in an empty response
     with a HTTP 400 status code.
+
+    This needs to be the last decorator, since the JSON response is then lost.
+
     :return:
     """
     if request.url_rule.rule == '/validate/radiuscheck':
diff --git a/privacyidea/api/validate.py b/privacyidea/api/validate.py
--- a/privacyidea/api/validate.py
+++ b/privacyidea/api/validate.py
@@ -216,11 +216,11 @@ def offlinerefill():
 @validate_blueprint.route('/check', methods=['POST', 'GET'])
 @validate_blueprint.route('/radiuscheck', methods=['POST', 'GET'])
 @validate_blueprint.route('/samlcheck', methods=['POST', 'GET'])
+@postpolicy(construct_radius_response, request=request)
 @postpolicy(is_authorized, request=request)
+@postpolicy(multichallenge_enroll_via_validate, request=request)
 @postpolicy(mangle_challenge_response, request=request)
-@postpolicy(construct_radius_response, request=request)
 @postpolicy(preferred_client_mode, request=request)
-@postpolicy(multichallenge_enroll_via_validate, request=request)
 @postpolicy(no_detail_on_fail, request=request)
 @postpolicy(no_detail_on_success, request=request)
 @postpolicy(add_user_detail_to_response, request=request)


Test patch:
diff --git a/tests/test_api_validate.py b/tests/test_api_validate.py
--- a/tests/test_api_validate.py
+++ b/tests/test_api_validate.py
@@ -5744,6 +5744,11 @@ def test_03_enroll_EMail(self):
         # Set Policy scope:auth, action:enroll_via_multichallenge=email
         set_policy("pol_multienroll", scope=SCOPE.AUTH,
                    action="{0!s}=email".format(ACTION.ENROLL_VIA_MULTICHALLENGE))
+        # Challenge header and footer should not disturb the enrollment text
+        set_policy("pol_challengetext_head", scope=SCOPE.AUTH,
+                   action="{0!s}=challenge-head".format(ACTION.CHALLENGETEXT_HEADER))
+        set_policy("pol_challengetext_foot", scope=SCOPE.AUTH,
+                   action="{0!s}=challenge-foot".format(ACTION.CHALLENGETEXT_FOOTER))
         # Now we should get an authentication Challenge
         with self.app.test_request_context('/validate/check',
                                            method='POST',