PrivacyIDEA prompts for an OTP at the Windows sign-in screen even when the user enters an incorrect password, whereas OTP verification should only be initiated after the primary password has been successfully validated.

1

Title: PrivacyIDEA Requests OTP Even When the Windows Password Is Incorrect

Problem Description

I am using PrivacyIDEA for two-factor authentication (2FA) at Windows sign-in. The current authentication flow prompts the user to enter their username and password, followed by a one-time password (OTP).

However, I have noticed a security-related issue: even when the user enters an incorrect Windows password, PrivacyIDEA still prompts them to enter the OTP.

Expected Behaviour

The authentication process should validate the primary password first. If the password is incorrect, the login attempt should be rejected immediately, with an appropriate error message such as “Incorrect username or password.” The user should not be prompted to enter an OTP.

Only after the primary credentials have been successfully validated should the system proceed to the OTP verification stage.

Actual Behaviour

  1. The user enters their username and password at the Windows sign-in screen.

  2. Even if the password is incorrect, the system proceeds to the OTP prompt.

  3. The user is asked to enter the OTP despite the primary authentication having failed.

Security Concern

This behaviour may cause confusion about the authentication flow and could expose unnecessary information about the configured authentication mechanism. I would like to ensure that the authentication process follows the intended sequence and that the second-factor prompt is presented only after successful primary authentication, where supported by the Windows integration and authentication configuration.

Questions

  • Is this expected behaviour with the PrivacyIDEA Windows Credential Provider?

  • Is there a configuration option to validate the Windows password before displaying the OTP prompt?

  • Could this behaviour be related to the Windows Credential Provider configuration, the authentication backend, or the selected authentication mode?

  • What is the recommended configuration to achieve this authentication flow securely?

Any guidance or documentation on how to configure this correctly would be appreciated.

Thank you.