How to use TOTP with SamAccountName or UPN

SecureAuth IdP Version Affected: 9.2 and below

Description: When trying to login via UPN, TOTP is not showing up as a MFA option

Cause: Most of the time, users enroll their Authenticate app using SamAccountName rather than UPN.  Because of this, the searchable attribute stated in the Data tab is used as a salt to encrypt the seed value.  

Resolution: If your enrollment realm is set to use samAccountName, and you want to login to another realm using UPN, the search attribute in the Data tab will need to be samAccountName.  The searchFilter will need to be "(&(objectClass=user)(|(sAMAccountName=%v)(userPrincipalName=%v))) ".  Then delete the domain in the datastore connection and you are set.  If using L4E, the search filter has to match what L4E is sending, which is samAccountName, but the searchable attribute has to match what was set in the enrollment realm.  

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.