Yubikey HOTP suddenly stopped working

Version Affected:  All

Description:  

Yubikey HOTP was working fine for all Users and then suddenly more and more users started to report an error "Invalid Passcode"

Cause:  

HOTP uses a counter to work out the next OTP. 

If this is not kept in-sync between the Yubikey and SecureAuth, the OTP will be considered invalid

This counter gets out of sync if the Oath Token is not marked as writable on the Data tab for all realms where HOTP is used.

Resolution:  

To prevent this from happening in the future, you need to perform the following.

1. Open the Admin Console

2. Navigate to the Data Tab of the Realm in question

3. Check the writable checkbox

4. Save the changes.

If you're already having the issue, you'll also need to increase the "Look ahead" value for HOTP. This is the HOTP equivalent of allowing a larger clock skew in TOTP

1. Open the Admin Console

2. Navigate to the System Info tab of the realm in question

3. Click the Decrypt button.

4. Open the Web.Config and search for

<add key="OATHLookAhead" value="50" /

5. Change this value to 100

6. Save the Web.config

When the Users log in now, it will sync the Counter. You should then reduce the OATHLookAhead back to 50.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.