Allow users to remove their last OTP token

See: fedora-infra/noggin#579
Signed-off-by: Christian Heimes <[email protected]>

README.md

@@ -319,6 +319,12 @@ the moment we have about 120k users and we're hitting the default
 500k.
 
 
+## OTP Token
+
+The *IPA OTP Last Token* plugin is disabled to permit users to remove
+their last OTP token.
+
+
 ## License
 
 See file 'COPYING' for use and warranty information

updates/89-fas.update

@@ -14,7 +14,6 @@ only:ipaUserAuthType: otp
 add:ipaUserObjectClasses: fasuser
 only:ipaUserSearchFields: uid,givenname,sn,mail,fasIRCNick
 
-
 # self-service permissions to allow users to modify their own mail address
 # and their own FAS attributes
 dn: $SUFFIX
@@ -110,5 +109,9 @@ add:aci: (targetattr = "memberUser")(targetfilter = "(&(objectclass=fasagreement
 dn: cn=config,cn=ldbm database,cn=plugins,cn=config
 replace: nsslapd-pagedlookthroughlimit:0::500000
 
+# Allow users to delete their last OTP token
+dn: cn=IPA OTP Last Token,cn=plugins,cn=config
+only:nsslapd-pluginenabled: off
+
 # Update Permissions (keep this at the bottom of the file)
 plugin: update_managed_permissions