Authenticator app's diffrent behaviour

1

Hi all

i am testing out 3 different apps with privacyIDEA. the 3 apps are google authenticator, microsoft authenticator and privacyIDEA authenticator.

when enrolling my test user, i scan the HOTP QR code with the 3 apps and ofcouse i have set a 4 digit PIN.

now when logging in to my application with 2FA consistently the combination of PIN + google authenticator 6 digit Token ALWAYS works.

PIN + microsoft authenticator 6 digit token is a hit and mis like it works 3 times out of 5 tries.
PIN + privacyIDEA authenticator 6 digit token also works 3 times out of 5 tries.

on my privacyIDEA server when i run

/etc/init.d/freeradius stop; freeradius -X

to debug i get the below error when the login fails.

(28) perl-privacyidea: &request:User-Password = $RAD_REQUEST{'User-Password'} -> '1234123636'

(28) perl-privacyidea: &reply:Reply-Message = $RAD_REPLY{'Reply-Message'} -> 'wrong otp value'

the OPT value i have set is 1234 so how can the privacyIDEA server be saying wrong OTP Value
is there something i should perhaps tweak in order to get all these apps working perfectly?

2

Microsoft Authenticator actually is not possible to work!
MS Authenticator is crap. You are enrolling HOTP, but MS authenticator will ignore this and interpret this as TOTP. So MS Authenticator should always create wrong values.

Check your audit log to ensure, that you are not using previous OTP values.

1 Like