edumfa 2.7.2__tar.gz → 2.9.0__tar.gz

edumfa-2.9.0/PKG-INFO

@@ -0,0 +1,304 @@
+Metadata-Version: 2.4
+Name: edumfa
+Version: 2.9.0
+Summary: eduMFA: identity, multifactor authentication (OTP), authorization, audit
+Author-email: "edumfa.io" <edumfa@listserv.dfn.de>
+License-Expression: AGPL-3.0-only
+Project-URL: Homepage, https://edumfa.io/
+Project-URL: Documentation, https://edumfa.readthedocs.io/
+Project-URL: Repository, https://github.com/eduMFA/eduMFA.git
+Project-URL: Issues, https://github.com/eduMFA/eduMFA/issues
+Keywords: OTP,two factor authentication,management,security
+Classifier: Framework :: Flask
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Topic :: Internet
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: <3.15,>=3.10
+Description-Content-Type: text/x-rst
+License-File: LICENSE
+License-File: AUTHORS.md
+Requires-Dist: alembic==1.18.0
+Requires-Dist: argon2-cffi==25.1.0
+Requires-Dist: argon2-cffi-bindings==25.1.0
+Requires-Dist: async-timeout==5.0.1
+Requires-Dist: babel==2.17.0
+Requires-Dist: bcrypt==4.3.0
+Requires-Dist: beautifulsoup4==4.14.3
+Requires-Dist: blinker==1.9.0
+Requires-Dist: cachetools==6.2.4
+Requires-Dist: cbor2==5.8.0
+Requires-Dist: certifi==2026.1.4
+Requires-Dist: cffi==2.0.0
+Requires-Dist: charset-normalizer==3.4.4
+Requires-Dist: click==8.3.1
+Requires-Dist: configobj==5.0.9
+Requires-Dist: croniter==6.0.0
+Requires-Dist: cryptography==46.0.3
+Requires-Dist: defusedxml==0.7.1
+Requires-Dist: flask==3.1.2
+Requires-Dist: flask-babel==4.0.0
+Requires-Dist: flask-migrate==4.1.0
+Requires-Dist: flask-sqlalchemy==3.1.1
+Requires-Dist: google-auth==2.47.0
+Requires-Dist: grpcio==1.76.0
+Requires-Dist: huey==2.6.0
+Requires-Dist: idna==3.11
+Requires-Dist: importlib-metadata==8.7.0
+Requires-Dist: itsdangerous==2.2.0
+Requires-Dist: jinja2==3.1.6
+Requires-Dist: ldap3==2.9.1
+Requires-Dist: lxml==6.0.2
+Requires-Dist: mako==1.3.10
+Requires-Dist: markupsafe==3.0.3
+Requires-Dist: netaddr==1.3.0
+Requires-Dist: passlib==1.7.4
+Requires-Dist: pyasn1==0.6.1
+Requires-Dist: pyasn1-modules==0.4.2
+Requires-Dist: pycparser==2.23
+Requires-Dist: pydash==8.0.5
+Requires-Dist: pyjwt==2.10.1
+Requires-Dist: pymysql==1.1.2
+Requires-Dist: pyopenssl==25.3.0
+Requires-Dist: pyrad==2.4
+Requires-Dist: python-dateutil==2.9.0.post0
+Requires-Dist: python-gnupg==0.5.6
+Requires-Dist: pytz==2025.2
+Requires-Dist: pyyaml==6.0.3
+Requires-Dist: redis==7.1.0
+Requires-Dist: requests==2.32.5
+Requires-Dist: rsa==4.9.1
+Requires-Dist: segno==1.6.6
+Requires-Dist: six==1.17.0
+Requires-Dist: smpplib==2.2.4
+Requires-Dist: soupsieve==2.8.1
+Requires-Dist: sqlalchemy==2.0.45
+Requires-Dist: typing-extensions==4.15.0
+Requires-Dist: urllib3==2.6.3
+Requires-Dist: werkzeug==3.1.5
+Requires-Dist: zipp==3.23.0
+Requires-Dist: setuptools==80.9.0
+Provides-Extra: lint
+Requires-Dist: ruff==0.14.11; extra == "lint"
+Provides-Extra: docs
+Requires-Dist: furo==2025.12.19; extra == "docs"
+Requires-Dist: docutils==0.21.2; extra == "docs"
+Requires-Dist: imagesize==1.4.1; extra == "docs"
+Requires-Dist: packaging==25.0; extra == "docs"
+Requires-Dist: pyenchant==3.3.0; extra == "docs"
+Requires-Dist: Pygments==2.19.2; extra == "docs"
+Requires-Dist: snowballstemmer==3.0.1; extra == "docs"
+Requires-Dist: Sphinx==9.0.4; python_version >= "3.11" and extra == "docs"
+Requires-Dist: sphinxcontrib-applehelp==2.0.0; extra == "docs"
+Requires-Dist: sphinxcontrib-devhelp==2.0.0; extra == "docs"
+Requires-Dist: sphinxcontrib-htmlhelp==2.1.0; extra == "docs"
+Requires-Dist: sphinxcontrib-httpdomain==1.8.1; extra == "docs"
+Requires-Dist: sphinxcontrib-jsmath==1.0.1; extra == "docs"
+Requires-Dist: sphinxcontrib-qthelp==2.0.0; extra == "docs"
+Requires-Dist: sphinxcontrib-serializinghtml==2.0.0; extra == "docs"
+Requires-Dist: sphinxcontrib-spelling==8.0.2; python_version >= "3.10" and extra == "docs"
+Requires-Dist: sphinx-copybutton==0.5.2; extra == "docs"
+Requires-Dist: sphinx-inline-tabs==2025.12.21.14; extra == "docs"
+Provides-Extra: test
+Requires-Dist: attrs==25.4.0; extra == "test"
+Requires-Dist: coverage==7.13.1; extra == "test"
+Requires-Dist: exceptiongroup==1.3.1; extra == "test"
+Requires-Dist: iniconfig==2.3.0; extra == "test"
+Requires-Dist: mock==5.2.0; extra == "test"
+Requires-Dist: packaging==25.0; extra == "test"
+Requires-Dist: pluggy==1.6.0; extra == "test"
+Requires-Dist: pyparsing==3.3.1; extra == "test"
+Requires-Dist: pytest==9.0.2; extra == "test"
+Requires-Dist: pytest-cov==7.0.0; extra == "test"
+Requires-Dist: pytest-github-actions-annotate-failures==0.3.0; extra == "test"
+Requires-Dist: responses==0.25.8; extra == "test"
+Requires-Dist: testfixtures==8.3.0; extra == "test"
+Requires-Dist: tomli==2.4.0; extra == "test"
+Requires-Dist: types-PyYAML==6.0.12.20250915; extra == "test"
+Provides-Extra: postgres
+Requires-Dist: psycopg2==2.9.11; extra == "postgres"
+Provides-Extra: hsm
+Requires-Dist: PyKCS11==1.5.18; extra == "hsm"
+Provides-Extra: kerberos
+Requires-Dist: gssapi==1.10.1; extra == "kerberos"
+Provides-Extra: grpc
+Requires-Dist: protobuf==6.33.4; extra == "grpc"
+Requires-Dist: google==3.0.0; extra == "grpc"
+Dynamic: license-file
+
+eduMFA
+===========
+
+.. image:: https://codecov.io/gh/eduMFA/eduMFA/coverage.svg?branch=main
+    :target: https://codecov.io/gh/eduMFA/eduMFA?branch=main
+
+.. image:: https://img.shields.io/pypi/v/eduMFA.svg
+    :alt: Latest Version
+    :target: https://pypi.python.org/pypi/eduMFA/#history
+
+.. image:: https://img.shields.io/pypi/pyversions/edumfa.svg
+    :alt: PyPI - Python Version
+    :target: https://pypi.python.org/pypi/edumfa/
+
+.. image:: https://img.shields.io/github/license/edumfa/edumfa.svg
+    :alt: License
+    :target: https://pypi.python.org/pypi/edumfa/
+    
+.. image:: https://readthedocs.org/projects/edumfa/badge/?version=latest
+    :alt: Documentation
+    :target: http://edumfa.readthedocs.org/en/latest/
+
+    
+eduMFA is an open solution for strong two-factor authentication like
+OTP tokens, SMS, smartphones or SSH keys.
+Using eduMFA you can enhance your existing applications like local login
+(PAM, Windows Credential Provider), 
+VPN, remote access, SSH connections, access to websites or web portals with
+a second factor during authentication. Thus boosting the security of your 
+existing applications.
+
+The project eduMFA is based on the privacyIDEA Project and aims to provide up-to-date multifactor authentication for academic institutions.
+
+Overview
+========
+
+eduMFA runs as an additional service in your network, and you can connect different
+applications to eduMFA.
+
+eduMFA does not bind you to any decision of the authentication
+protocol, nor does it dictate you where your user information should be
+stored. This is achieved by its totally modular architecture.
+eduMFA is not only open as far as its modular architecture is
+concerned. But eduMFA is completely licensed under the AGPLv3.
+
+It supports a wide variety of authentication devices like OTP tokens 
+(HMAC, HOTP, TOTP, OCRA, mOTP), Yubikey (HOTP, TOTP, AES), FIDO U2F, as well
+as FIDO2 WebAuthn devices like Yubikey and Plug-Up, smartphone Apps like Google
+Authenticator, FreeOTP, Token2  or TiQR, SMS, Email, SSH keys, x509 certificates
+and Registration Codes for easy deployment.
+
+eduMFA is based on Flask and SQLAlchemy as the python backend. The
+web UI is based on angularJS and bootstrap.
+A MachineToken design lets you assign tokens to machines. Thus, you can use
+your Yubikey to unlock LUKS, assign SSH keys to SSH servers or use Offline OTP
+with PAM.
+
+
+
+Setup
+=====
+
+For setting up the system to *run* it, please read install instructions 
+at `edumfa.readthedocs.io <http://edumfa.readthedocs.io/en/latest/installation/index.html>`_.
+
+If you want to setup a development environment start like this::
+
+    git clone https://github.com/edumfa/edumfa.git
+    cd edumfa
+    virtualenv venv
+    source venv/bin/activate
+    pip install .
+    
+.. _testing_env:
+
+You may additionally want to set up your environment for testing, by adding the
+additional dependencies::
+
+    pip install .[test]
+
+
+Getting and updating submodules
+===============================
+
+The client-side library for the registering and signing of WebAuthn-Credentials
+resides in a submodule.
+
+To fetch all submodules for this repository, run::
+
+   git submodule update --init --recursive
+
+When pulling changes from upstream later, you can automatically update any outdated
+submodules, by running::
+
+   git pull --recurse-submodules
+
+Running it
+==========
+
+First You need to create a `config-file <https://edumfa.readthedocs.io/en/latest/installation/system/inifile.html>`_.
+
+Then create the database tables and the encryption key::
+
+    ./edumfa-manage create_tables
+    ./edumfa-manage create_enckey
+
+If You want to keep the development database upgradable, You should `stamp
+<https://edumfa.readthedocs.io/en/latest/installation/upgrade.html>`_ it
+to simplify updates::
+
+    ./edumfa-manage db stamp head -d migrations/
+
+Create the key for the audit log::
+
+    ./edumfa-manage create_audit_keys
+
+Create the first administrator::
+
+    ./edumfa-manage admin add <username>
+
+Run it::
+
+    ./edumfa-manage runserver
+
+Now you can connect to ``http://localhost:5000`` with your browser and login
+as administrator.
+
+Run tests
+=========
+
+If you have followed the steps above to set up your
+`environment for testing <#testing-env>`__, running the test suite should be as
+easy as running `pytest <http://pytest.org/>`_ with the following options::
+
+    python -m pytest -v --cov=eduMFA --cov-report=html tests/
+
+Contributing
+============
+
+There are a lot of different ways to contribute to eduMFA, even
+if you are not a developer.
+
+If you found a security vulnerability please report it to us using the reporting form provided by GitHub
+
+You can find detailed information about contributing here:
+https://github.com/eduMFA/eduMFA/blob/main/CONTRIBUTING.md
+
+Code structure
+==============
+
+The database models are defined in ``models.py`` and tested in 
+tests/test_db_model.py.
+
+Based on the database models there are the libraries ``lib/config.py`` which is
+responsible for basic configuration in the database table ``config``.
+And the library ``lib/resolver.py`` which provides functions for the database
+table ``resolver``. This is tested in tests/test_lib_resolver.py.
+
+Based on the resolver there is the library ``lib/realm.py`` which provides
+functions
+for the database table ``realm``. Several resolvers are combined into a realm.
+
+Based on the realm there is the library ``lib/user.py`` which provides functions 
+for users. There is no database table user, since users are dynamically read 
+from the user sources like SQL, LDAP, SCIM or flat files.
+
+Versioning
+==========
+eduMFA adheres to `Semantic Versioning <http://semver.org/>`_.

edumfa-2.9.0/deploy/docker/edumfa.py

@@ -0,0 +1,63 @@
+from os import getenv
+
+
+def get_content_from_file(path: str) -> str:
+    """Return the normalized content from a path.
+
+    :param path: The path to read the file from.
+    :return: The content of the file stripped of newlines.
+    :raises FileNotFoundError: If the file at path can't be found.
+    """
+    with open(path) as fp:
+        return fp.read().strip()
+
+
+def _getenv(key: str, default: str | None) -> str:
+    """
+    Get an environment variable and raise an exception if it does not exist and
+    no default is given.
+
+    :param key: The environment variable to get.
+    :param default: The value to return if the environment variable doesn't
+        exist.
+    :return: The environment variable's value or the default if given.
+    :raises ValueError: If the variable is not set and there is no default
+        value.
+    """
+    value = getenv(key, default)
+    if not value:
+        raise ValueError(f"Environment variable '{key}' not set! Can't start...")
+    else:
+        return value
+
+
+def get_var(key: str, default: str | None = None) -> str:
+    """
+    Decide whether to get the variable from the environment or a file,
+    depending on if there is a environment variable with a _FILE-suffix
+    which overrides the environment variable without it.
+
+    :param key: The environment variable to get.
+    :param default: The value to return if the environment variable doesn't
+        exist.
+    :return: The variable's value or the default if given.
+    :raises ValueError: If the variable is not set and there is no default
+        value.
+    """
+    path = getenv(f"{key}_FILE")
+    if path:
+        return get_content_from_file(path)
+    return _getenv(key, default)
+
+
+SQLALCHEMY_DATABASE_URI = f"{get_var('DB_DRIVER')}://{get_var('DB_USER')}:{get_var('DB_PASSWORD')}@{get_var('DB_HOSTNAME')}/{get_var('DB_DATABASE')}"
+SUPERUSER_REALM = get_var("SUPERUSER_REALM", "super,administrators").split(",")
+SECRET_KEY = get_var("SECRET_KEY")
+EDUMFA_PEPPER = get_var("EDUMFA_PEPPER")
+EDUMFA_ENCFILE = "/etc/edumfa/enckey"
+EDUMFA_AUDIT_KEY_PRIVATE = "/etc/edumfa/private.pem"
+EDUMFA_AUDIT_KEY_PUBLIC = "/etc/edumfa/public.pem"
+EDUMFA_LOGFILE = "/var/log/edumfa/edumfa.log"
+EDUMFA_LOGCONFIG = "/etc/edumfa/logging.yml"
+EDUMFA_UI_DEACTIVATED = get_var("EDUMFA_UI_DEACTIVATED", "False") == "True"
+EDUMFA_AUDIT_SQL_TRUNCATE = True

edumfa-2.9.0/deploy/docker/entrypoint.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/bash
+set -e
+
+GEN_PWD="$(openssl rand -base64 42)"
+EDUMFA_ADMIN_USER="${EDUMFA_ADMIN_USER:-admin}"
+EDUMFA_ADMIN_PASS="${EDUMFA_ADMIN_PASS:-$GEN_PWD}"
+
+# Make sure the config is working by executing it once.
+python3 "/etc/edumfa/edumfa.cfg"
+
+# Create enckey if doesn't exist yet
+edumfa-manage -q create_enckey || true
+
+# Create audit keys if they don't exist yet
+edumfa-manage -q create_audit_keys || true
+
+# Create DB
+echo "Creating DB"
+# FIXME: this creates a exception trace on every attempt
+attempts=10
+until edumfa-manage -q create_tables 
+do
+  if [[ $attempts -eq 0 ]]; then
+    echo "Exhausted database connection tries. Stopping."
+    exit 1
+  else
+    echo "Cannot connect to database. Trying again..."
+    sleep 3
+    attempts=$((attempts-1))
+  fi
+done
+
+# Check and stamp DB
+STAMP=$(edumfa-manage -q db current -d /usr/local/lib/edumfa/migrations)
+if [[ -z "${STAMP//Running online/}" ]]; then
+  edumfa-manage -q db stamp head -d /usr/local/lib/edumfa/migrations
+fi
+
+# Upgrading DB
+echo "Upgrading Database"
+edumfa-schema-upgrade /usr/local/lib/edumfa/migrations --skipstamp
+
+# Create admin user
+echo "Creating Admin"
+edumfa-manage -q admin add "$EDUMFA_ADMIN_USER" -p "$EDUMFA_ADMIN_PASS"
+
+# Execute user scripts
+shopt -s nullglob
+for script in /opt/edumfa/user-scripts/*.sh; do
+  echo "Executing user script $script..."
+  bash $script
+done
+
+echo "
+    You can login with the following credentials:
+    username: $EDUMFA_ADMIN_USER
+    password: $EDUMFA_ADMIN_PASS
+"
+
+echo "Starting Server"
+gunicorn --bind 0.0.0.0:8000 --workers 4 app

edumfa-2.9.0/deploy/docker/logging.yml

@@ -0,0 +1,40 @@
+{
+    "version": 1,
+    "formatters": {
+        "detail": {
+            "()": "edumfa.lib.log.SecureFormatter",
+            "format": "[%(asctime)s][%(process)d][%(thread)d][%(levelname)s][%(name)s:%(lineno)d] %(message)s"
+        }
+    },
+    "handlers": {
+        "stdhandler": {
+            "class": "logging.StreamHandler",
+            "formatter": "detail",
+            "stream": "ext://sys.stdout"
+        }
+    },
+    "loggers": {
+        "root": {
+            "handlers": ["stdhandler"],
+            "level": "INFO"
+        },
+        "alembic": {
+            "handlers": ["stdhandler"],
+            "qualname": "alembic",
+            "level": "INFO",
+            "propagate": 0
+        },
+       "sqlalchemy.engine": {
+            "handlers": ["stdhandler"],
+            "qualname": "sqlalchemy.engine",
+            "level": "WARN",
+            "propagate": 0
+        },
+        "edumfa": {
+            "handlers": ["stdhandler"],
+            "qualname": "edumfa",
+            "level": "INFO",
+            "propagate": 0
+        }
+    }
+}

edumfa-2.9.0/deploy/docker-example/db_password.txt

@@ -0,0 +1 @@
+pass

edumfa-2.9.0/deploy/docker-example/docker-compose.yml

@@ -0,0 +1,47 @@
+services:
+  mariadb:
+    image: docker.io/mariadb:lts-noble
+    restart: always
+    volumes:
+      - mariadb-data:/var/lib/mysql:rw
+    environment:
+      MARIADB_DATABASE: ${MARIADB_DATABASE}
+      MARIADB_USER: ${MARIADB_USER}
+      MARIADB_PASSWORD: ${MARIADB_PASSWORD}
+      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      start_period: 10s
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  edumfa:
+    build: ../..
+    restart: always
+    ports:
+      - "8000:8000"
+    volumes:
+      - edumfa-keys:/etc/edumfa/:rw
+      - ./edumfa-setup.sh:/opt/edumfa/user-scripts/01-setup.sh:ro
+      - ./example-policy.py:/opt/edumfa/policy.py:ro
+      - ./my-login.html:/opt/edumfa/edumfa-package/static/components/login/views/login.html
+      - ./db_password.txt:/etc/edumfa/db_password.txt:ro
+    environment:
+      DB_DRIVER: ${DB_DRIVER}
+      DB_HOSTNAME: mariadb
+      DB_USER: ${MARIADB_USER}
+      DB_PASSWORD_FILE: /etc/edumfa/db_password.txt
+      DB_DATABASE: ${MARIADB_DATABASE}
+      SECRET_KEY: ${EDUMFA_SECRET_KEY}
+      EDUMFA_PEPPER: ${EDUMFA_PEPPER}
+      EDUMFA_ADMIN_USER: ${EDUMFA_ADMIN_USER}
+      EDUMFA_ADMIN_PASS: ${EDUMFA_ADMIN_PASS}
+      EDUMFA_UI_DEACTIVATED: ${EDUMFA_UI_DEACTIVATED}
+    depends_on:
+      mariadb:
+        condition: service_healthy
+
+volumes:
+  edumfa-keys:
+  mariadb-data:

edumfa-2.9.0/deploy/docker-example/edumfa-setup.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/bash
+
+edumfa-manage -q resolver create_internal testresolver
+edumfa-manage -q realm create testrealm testresolver
+
+edumfa-manage -q config importer -i /opt/edumfa/policy.py
+

edumfa-2.9.0/deploy/docker-example/env-example

@@ -0,0 +1,15 @@
+## eduMFA docker config
+MARIADB_USER="edumfa"
+MARIADB_PASSWORD="pass"
+MARIADB_DATABASE="edumfa"
+MARIADB_ROOT_PASSWORD="rootpass"
+
+DB_DRIVER="mysql+pymysql"
+
+EDUMFA_SECRET_KEY="Test"
+EDUMFA_PEPPER="Never know..."
+
+EDUMFA_ADMIN_USER="admin"
+EDUMFA_ADMIN_PASS="Passwort123"
+SUPERUSER_REALM="super,administrators"
+EDUMFA_UI_DEACTIVATED="False"

edumfa-2.9.0/deploy/docker-example/example-policy.py

@@ -0,0 +1,25 @@
+{
+    "policy": [
+        {
+            "action": {
+                "deletion_confirmation": True,
+                "hide_welcome_info": True,
+                "logout_time": "180",
+            },
+            "active": True,
+            "adminrealm": [],
+            "adminuser": [],
+            "check_all_resolvers": False,
+            "client": [],
+            "conditions": [],
+            "edumfanode": [],
+            "name": "webui",
+            "priority": 1,
+            "realm": [],
+            "resolver": [],
+            "scope": "webui",
+            "time": "",
+            "user": [],
+        }
+    ]
+}

edumfa-2.9.0/deploy/docker-example/my-login.html

@@ -0,0 +1,95 @@
+<div class="well" ng-show="hsmReady === 'True'">
+
+    <div class="container" ng-show="!loginWithCredentials">
+        <form name="formRemoteUserLogin" class="form-signin" role="form">
+            <div class="text-center">
+                <img ng-src="{{ instanceUrl }}/static/css/{{ piLogo }}"
+                     width="90px">
+            </div>
+            <h2 class="form-signin-heading" translate>Login as
+                {{ remoteUser }}</h2>
+
+            <p translate>
+                You are authenticated by the web server as user
+                <b>{{ remoteUser }}</b>.
+                You may login as this user to eduMFA without any further
+                credentials.
+            </p>
+
+            <div class="text-center">
+                <button ng-click="authenticate_remote_user()"
+                        class="btn btn-primary btn-block" translate>Log In
+                </button>
+                <button ng-hide="forceRemoteUser === 'True'"
+                        ng-click="loginWithCredentials = true"
+                        class="btn btn-info btn-block" translate>
+                    Login with credentials
+                </button>
+            </div>
+        </form>
+    </div>
+
+    <div ng-show="loginWithCredentials">
+        <div class="alert alert-info alert-dismissible" role="alert">
+            <button type="button" class="close" data-dismiss="alert"
+                    aria-label="Close">
+                <span aria-hidden="true">&times;</span></button>
+	    This is an example modification.
+        </div>
+
+
+
+        <div class="container">
+            <div class="text-center">
+                    <img ng-src="{{ instanceUrl }}/static/css/{{ piLogo }}"
+                         width="90px">
+                </div>
+            <div class="text-center">
+                <h2 ng-hide="piLoginText" class="form-signin-heading" translate>Please sign in</h2>
+                <h2 ng-show="piLoginText" class="form-signin-heading">{{ piLoginText }}</h2>
+            </div>
+            <form name="formSignin" class="form-signin" role="form" novalidate>
+                <label for="username" class="sr-only" translate>Username</label>
+                <input name="username" id="username"
+                       class="form-control round-top"
+                       ng-model="login.username" required
+                       placeholder="{{ 'Username'|translate }}"
+                       autofocus/>
+                <label for="realm" class="sr-only" translate>Realm</label>
+                <select class="form-control round-none"
+                        name="realm"
+                        placeholder="Realm"
+                        ng-show="piRealms.length > 0"
+                        id="realm"
+                        ng-model="login.realm"
+                        ng-options="realm for realm in piRealms">
+                    <!-- We add a placeholder, if we do not have an empty realm -->
+                    <option ng-hide="piRealms[0]===''" value="" selected translate>Choose a realm...</option>
+                </select>
+                <label for="password" class="sr-only" translate>Password</label>
+                <input name="password" type="password"
+                       id="password" class="form-control round-bottom"
+                       ng-model="login.password" required
+                       placeholder="{{ 'Password'|translate }}"/>
+
+                <div class="text-center">
+                    <button ng-click="authenticate_first();"
+                            ng-disabled="formSignin.$invalid"
+                            class="btn btn-primary btn-block" translate>Log In
+                    </button>
+                    <p class="text-right" ng-show="passwordReset === 'True'">
+                        <a ui-sref="recovery" translate>Reset Password</a>
+                    </p>
+                </div>
+
+            </form>
+        </div>
+    </div>
+</div>
+
+<div class="well" ng-show="hsmReady === 'False'">
+    <div class="alert alert-danger" role="alert" translate>
+        The HSM is not ready. eduMFA can not work properly. Please start
+        the HSM and reload this page.
+    </div>
+</div>