Enroll via multichallenge (EMAIL)

1

Hi
We’ve activated policy for users
enroll_via_multichallenge - EMAIL
passthru - userstore

When user authenticates with the login and password on citrix netscaler gateway, then token is being created automaticaly with property dynamic_email - true and PI asks “Please enter your new email addrees!”

If user refreshes page (F5) token saved with property dynamic_email
If user enters correct address, token change email address and sends OTP
But when user enters incorrect adress - blank or without @, after timeout citrix gateway authenticates user without OTP and all next attempts will be succeded.

Can you

  1. Add new policy which disables request for new email (manual input), only dynamic
  2. If user enters blank adress, token saved as dynamic
  3. Checking correction of email address for @ sign presence

Also there is a bug: when policies “challenge_text”, “challenge_text_footer”, “challenge_text_header” are actvated, then message “Please enter your new email addrees!” is being replaced with values of these policies.

thanks

2

No. Use an event handler to do this. This is not done via multichallenge enroll.

Please open an issue at github for this request.

This works as intended.

3

I think there is little misunderstanding. I mean that if a user logins for the first time and doesn’t have any tokens yet instead of hard coded “Please enter your email address!”, header challenge text + footer challenge text are displayed (which should be displayed when asking for OTP).

4

Hm, interesting.
I am not sure about this. Would you please also open an issue at github.

In regards to the dynamic email address.

So your intended behaviour is:

  • users could have an email address in the user store
  • users are asked if they want to enroll an email token with a destinct email address or…
  • …enter nothing an then use the dynamic email address?

Would you really want to let users choose between new/destinct email and dynamic email?

What kind of user base is this?

5

yes

why not if the email token with dynamic property is created first anyway

MS AD (LDAP)