Troubleshooting: URL Enrollment for the Authenticate App Is Unsuccessful with No Error

Version Affected: All
 
 

Overview

When a user enrolls using OATH URL Enrollment for the Authenticate app, they can successfully validate the time-based one-time passcode (TOTP) during enrollment. However, when they later try to use TOTP or Push, nothing was actually written to the data store or to the Mobile Service (mobilesvc), and mobilesvc logging shows no indication that enrollment succeeded — even though the realm's debug logging shows an enrollment attempt. QR Code Enrollment does not have this problem.
 
 

Cause

URL Enrollment requires the Authenticate app to make an HTTP POST back to the realm on the SecureAuth Identity Provider (IdP) server to complete enrollment. Because that POST happens independently of the app's own enrollment screen, the IdP server has no way to tell the user that the POST failed to arrive — enrollment simply never completes, with no error shown anywhere. QR Code Enrollment does not depend on this POST back, which is why it does not have this problem.
 
 

Resolution

Check the IIS logs on the IdP server for an HTTP POST back after a URL Enrollment attempt completes:

• If there is no POST back, something is likely blocking the app from reaching the SecureAuth server — for example, a firewall rule at a load balancer.
• If the POST back is present, the underlying issue should be visible in the realm's Debug logs, and eventually in the mobilesvc logs.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.