14.2. Token Enrollment Wizard¶
The enrollment wizard helps the user to enroll his first token. When enrolling the first token, we assume, that the user is not very familiar with the privacyIDEA web UI. So the enrollment wizard only contains a very reduced interface.
14.2.1. Necessary requirements for the enrollment wizard¶
The enrollment wizard will only be displayed, if the user has no token assigned, yet. Thus the user must be able to log in to the web UI with his userstore password. This is the default behavior; otherwise set the corresponding policy.
Set a policy in scope webui and activate the policy action tokenwizard.
The user will not be able to choose a token type. The wizard enrolls the token type set in default_tokentype (HOTP if it is not set). If user policies are defined, the user needs the enroll right for this token type (e.g.
enrollHOTP, see User Policies); otherwise the wizard is shown, but the enrollment fails.
You can see the token enrollment wizard in action (recorded with the previous WebUI) here: https://www.youtube.com/watch?v=diAGbsiG8_A
14.2.2. Customization¶
There are two dialog windows in the wizard. You can add your own text to them
in HTML templates. In the WebUI, a non-empty *.top.html file replaces the
default content on top: the heading “Enroll <type> Token” before the
enrollment, and the message with the serial of the enrolled token after it.
The WebUI removes scripts, <style> elements and style attributes from
these files.
Before the token is enrolled you can add your custom text in these two files:
Previous WebUI:
static_old/customize/views/includes/token.enroll.pre.top.html
static_old/customize/views/includes/token.enroll.pre.bottom.html
WebUI:
static/public/customize/token-enrollment.wizard.pre.top.html
static/public/customize/token-enrollment.wizard.pre.bottom.html
When it is enrolled and the user needs to do something (e.g. scanning the QR code), you can modify the text here:
Previous WebUI:
static_old/customize/views/includes/token.enroll.post.top.html
static_old/customize/views/includes/token.enroll.post.bottom.html
WebUI:
static/public/customize/token-enrollment.wizard.post.top.html
static/public/customize/token-enrollment.wizard.post.bottom.html
The two post files of the WebUI can contain the variables {{ serial }}
(the serial of the new token), {{ qrCode }} (the PNG data URI of the QR
code, to be used in an <img> tag) and {{ url }} (the content of the QR
code, e.g. the otpauth:// URL of HOTP and TOTP tokens).
Note
You can change the directory static_old/customize to a URL that fits
your needs the best by defining a variable PI_CUSTOMIZATION in the file
pi.cfg. This way you can put all modifications in one place apart from the
original code.
This is only possible in the previous WebUI.
The WebUI always looks for the files in the path static/public/customize/.
14.2.2.1. Example¶
Your privacyIDEA system is running in the URL sub path /pi.
The files could be addressed via a path component mydesign (in this case pi/mydesign).
Thus the previous WebUI will look for the files in the URL path /pi/mydesign/views/includes/.
So you set in pi.cfg:
PI_CUSTOMIZATION = "/mydesign"
Your customized files are located in /etc/privacyidea/customize/views/includes/.
In the Apache webserver you need to map /pi/mydesign to /etc/privacyidea/customize:
Alias /pi/mydesign /etc/privacyidea/customize
