TOTP not working with Login for Windows

Version Affected:  All

Description:  

When trying to login to Login for Windows using an Oath / TOTP device, an error is returned

"something you entered is not correct."

If Sadiag is enabled, the error seen is "Failed to validate OTP locally: valid_otp=0, error: 1436"

Cause:  

A mismatch has occurred between the registration realm OTP timeout and the L4W realm OTP timeout. 

Resolution:  

Match the Passcode Change interval on the L4W/Api realm to the Device Enrollment realm. 

Special Considerations:  

If the Devices were originally enrolled as Oath Seed, they will be migrated to Oath Token from 9.2 onwards if you have both Oath Seed and Oath Token mapped on a realm. 

Make sure realms setup like this have the correct Passcode Change interval too.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.