Keep getting 'An error has occurred' when logging in LDAP user with 2FA

[neonbit]

Hi guys,

I've been testing a FAUTH (VM 4.3.1) in my lab with the 2FA and have seen some strange behaviour with LDAP users logging into the FAUTH with 2FA enabled (either token or email). Each time I try to login with an LDAP remote user the FAUTH gives me a webpage with 'An error has occurred'. 

If I login using a local user with 2FA enabled then the correct 2FA page shows up asking for the token.

Logging in with the LDAP user and 2FA disabled is fine. It just seems to be the token request page doesn't show up when LDAP users are used.

The logs show that the LDAP user has authenticated, the FAUTH is waiting for the token and that a token has been sent (in the case of email).

I can see the below GUI internal server errors in the debug when this happens with the last error being AttributeError: 'RemoteLdapUser' object has no attribute 'profile'. I have a feeling that I've missed something basic here and wanted to see if anyone else has seen this before I created a ticket with support.

2017-03-27 13:39:23,108 error django.request base 3273 140194606880512 Internal Server Error: /login/token-auth/
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line 113, in get_response
response = callback(request, *callback_args, **callback_kwargs)
File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 68, in view
return self.dispatch(request, *args, **kwargs)
File "./fac/fac/apps/fac_auth/views/login.py", line 371, in dispatch
File "/usr/lib/python2.7/dist-packages/django/utils/decorators.py", line 25, in _wrapper
return bound_func(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/django/views/decorators/debug.py", line 75, in sensitive_post_parameters_wrapper
return view(request, *args, **kwargs)
File "/usr/lib/python2.7/dist-packages/django/utils/decorators.py", line 21, in bound_func
return func(self, *args2, **kwargs2)
File "/usr/lib/python2.7/dist-packages/django/utils/decorators.py", line 25, in _wrapper
return bound_func(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/django/views/decorators/csrf.py", line 77, in wrapped_view
return view_func(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/django/utils/decorators.py", line 21, in bound_func
return func(self, *args2, **kwargs2)
File "/usr/lib/python2.7/dist-packages/django/utils/decorators.py", line 25, in _wrapper
return bound_func(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/django/views/decorators/cache.py", line 89, in _wrapped_view_func
response = view_func(request, *args, **kwargs)
File "/usr/lib/python2.7/dist-packages/django/utils/decorators.py", line 21, in bound_func
return func(self, *args2, **kwargs2)
File "./fac/fac/apps/fac_auth/views/login.py", line 82, in dispatch
File "/usr/lib/python2.7/dist-packages/django/views/generic/base.py", line 86, in dispatch
return handler(request, *args, **kwargs)
File "./fac/fac/apps/fac_auth/views/login.py", line 91, in get
File "./fac/fac/apps/fac_auth/views/login.py", line 335, in get_context_data
File "./fac/fac/apps/fac_auth/views/login.py", line 2193, in _can_user_revoke
AttributeError: 'RemoteLdapUser' object has no attribute 'profile'

[neonbit]

Ok all fixed. Downgraded to 4.2.1, reconfigured and it worked. Upgraded to 4.3.0 and it worked, then upgraded back to 4.3.1 and it's all working. I can't figure it out but at least it's working now :)

**edit** pinpointed the problem to the token self provisioning options. If I enable any option user self revocation option or the allow users to request token from admin option then the error comes up.