Troubleshooting: Login for Windows Doesn't Show All MFA Options Before the Initial Login

Version Affected: All
 
 

Overview

Login for Windows can show fewer Multi-Factor Authentication (MFA) options than expected the first time a device is used.

Cause

Login for Windows defaults to offline (cached) mode. In this mode, the very first login on a device must use a Time-based One-Time Password (TOTP) code so that the OATH seed gets stored locally -- storing that seed is what allows offline mode to work at all. Until that initial TOTP login happens, other MFA options are not available.

Resolution:

If a TOTP-first initial login is acceptable, no change is needed -- once the user completes that first TOTP login, the remaining MFA options become available on that device from then on.

If a TOTP-first initial login is not wanted, disable local seed storage instead by editing the config.json file used to install Login for Windows:

1. Open config.json in a text editor.
2. Set the store_seeds key to false.
3. Save the file and reinstall/redeploy Login for Windows with the updated configuration file.

Below is an example of a properly configured file with store_seeds set to false:

{
  "multiple_user": true,
  "conf_version": 4,
  "adaptive_enabled": false,
  "idm_sspr_url": "",
  "idm_sspr_label": "Password Reset",
  "alternate_providers": [],
  "version": "v2",
  "platform": "windows",
  "type": "idp",
  "apis":[
  { "host": "https://<realm_1_url>/SecureAuth2",
             "id": "****",
             "secret": "****"
   },
   { "host": "https://<realm_2_url>/SecureAuth2",
                                                "id": "****",
                                                "secret": "*****"
   }],
  "access_level": 0,
  "group_bypass": ["MFA Bypass"],
  "store_seeds": false,
  "allow_self_signed": true
}

Once this configuration file is deployed, all MFA options are available from the very first login on that device.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.