Don't report a failed signup when only the OTP seed failed

Activation created the LDAP account and then requested an OTP seed in
the same try block. If the OTP server was unreachable, the user got an
error page although their account existed, and their next attempt
failed with "username taken". OTP errors are now logged, as non-201
responses already were, and activation still succeeds.

dal/tests/test_flows.py

@@ -135,6 +135,17 @@ class RegisterTests(LdapTestCase):
         # Activation link is single use
         self.assertEqual(self.client.get(link).status_code, 404)
 
+    def test_otp_server_down_does_not_fail_activation(self):
+        import requests
+        self.otp_post.side_effect = requests.ConnectionError("otp down")
+        data = self.form()
+        self.track(data["username"])
+        self.client.post(REGISTER, data)
+        with self.assertLogs("dal.views", "ERROR"):
+            resp = self.client.get(self.last_mail_link())
+        self.assertTemplateUsed(resp, "usercreated.html")
+        self.assertTrue(self.can_bind(data["username"], "reg-pass-12345"))
+
     def test_tampered_activation_token_is_rejected(self):
         data = self.form()
         self.track(data["username"])

dal/views.py

@@ -539,6 +539,13 @@ class ActivateAccount(View):
                 pending.username, pending.password_hash,
                 pending.firstname, pending.lastname, pending.email
             )
+        except Exception as e:
+            return render(request, 'error.html', {'urlname': 'register',
+                                                  'service': 'register an user',
+                                                  'error': e})
+        # The account exists from here on. An OTP seed failure is logged but
+        # must not tell the user that registration failed.
+        try:
             req = requests.post(settings.OTP_SERVER, data=json.dumps(
                 {
                     'auth_token': TOTP(settings.OTP_ADMIN_SEED).now(),
@@ -550,12 +557,8 @@ class ActivateAccount(View):
                 timeout=settings.OTP_TIMEOUT)
             if req.status_code != 201:
                 logger.error("User {} failed to create its otp seed".format(pending.username))
-
-            #Send welcome email
-        except Exception as e:
-            return render(request, 'error.html', {'urlname': 'register',
-                                                  'service': 'register an user',
-                                                  'error': e})
+        except requests.RequestException as e:
+            logger.error("User {} failed to create its otp seed: {}".format(pending.username, e))
         return render(request, 'usercreated.html', { 'user': pending.username } )