Knowledge Base

Support Policies

Users cannot use TOTP or KBQ/KBA as Two-Factor Authentication Methods

Versions Affected: All

Description: Your users are not able to use TOTP or KBQ/KBA as a Two-Factor Authentication method if they login from a different SecureAuth server and you see this message in the Audit Logs.

Cause: There are multiple reasons for this, and one of the more common reasons is because there is a mismatch in the License Info certificate that is selected among your servers.  This certificate is used to encrypt and decrypt the attributes associated with your Active Directory for your Service Account.  If server A is using certificate A to encrypt and decrypt the values in your Active Directory, then if server B is using certificate B on another server, then server B will not be able to decrypt the values because it is using certificate B.  

 

Resolution: Export the certificate that is used from the working server and import it to the server that is not able to authenticate.  Once you import the certificate, add the proper permissions to this new certificate by going into the certificate console.  Make sure to add SecureAuth0Pool if you are on IdP version 9.0.2.  

Select the new certificate in the License Info section, then retype your Service Account password on your data tab.  Use the test connection button to make sure that the Service Account password is correct and your users should be able to log in the realm now.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.