Troubleshooting: Unable to Receive SMS or Voice OTP Outside the US

Version Affected: All
 
 

Overview

Users outside the United States may not receive an SMS or Voice one-time passcode (OTP), even though their phone number in Active Directory (AD) or LDAP appears correct and no error is shown at the login screen.
 
 

Cause

SecureAuth defaults to treating phone numbers as United States numbers: the default country code is 1 and the default region is US, unless a realm is configured otherwise. A debug log entry similar to the following confirms this:

Message="OneTimePasswordProvider.PrepPhone inputPhone = 9012344850"
Message="OneTimePasswordProvider.PrepPhone defaultCountryCode = 1"
Message="OneTimePasswordProvider.PrepPhone defaultRegion = US"

If a user's phone number is stored without a leading + and country code, SecureAuth has no way to recognize that a country code is already present, and treats the number as a US number. This was not required on Identity Platform 9.3 and earlier, so a phone number that worked before an upgrade to a later version may stop working afterward.
 
 

Resolution

There are two ways to resolve this, depending on the realm's user population:

Option 1 — Store each user's phone number with its country code: In the user's AD/LDAP profile, save the phone number in +XX-XXXXXXXXXX format, with a leading + before the country code.

The screenshot above shows a phone number correctly saved with a leading + and country code.

Option 2 — Set the realm's default country code: If every user on a realm is in the same country and their AD/LDAP phone numbers do not already include a country code, set that realm's default country code once instead of editing every user's phone number individually.

In current versions, this is set in the Admin Console: go to the Multi-Factor Methods tab, then Phone Settings, and enter the country code in Default Phone Country Code. The example below sets the default country code to 91 for India.

This Admin Console field sets the realm's defaultCountryCode application setting. On versions without this field in the Admin Console, set it directly instead: decrypt the realm's web.config file, and under <appSettings> add or edit the key. For example, for Australia:

<add key="defaultCountryCode" value="011" />

The screenshot above shows this key set directly in web.config.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.