OTP Failing on Secondary Server with FileSync

SecureAuth IdP Version Affected: 9.x

FileSync Version: 4.0.9

Description: 
After configuring Filesync, the secondary server receives the configuration successfully, but "Unable to Use Selected Registration Method" displays when attempting to send a OTP via SMS or Phone.
 
Cause:
Cloud Client Certificate is either missing or the private key permissions are incorrect. 

Although Filesync syncs the primary certificate, in some circumstance the cloud certificate can be different and not get copied
 
Resolution:
 
1. On the Primary, Open the admin console and go to the System Info tab for the realm and scroll to WSE 3.0 Configuration section

2. Next to Client Cert Serial Nbr, click Select Certificatre

3. Make a note of the Certificate

4. On the Secondary, open up the Certificates Console 

D:\MFCApp_Bin\Certificates Console.msc

5. Check that the Certificate is present on the secondary. 

6. Right Click on the Cert and select All Tasks | Manage Private Keys

7. Ensure Network Service and IIS AppPool\SecureAuth0Pool have read permission.

8. If using Windows SSO, you may also need to add Authenticated Users to the permissions.
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.
Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.