Troubleshooting: TOTP Shows as Invalid After Changing the Search Filter

Version Affected: Prior to 21.04
 
 

Overview

After changing the Search Filter on the realm's Data tab, Time-based One-Time Passcode (TOTP) still appears as an available MFA option, but every user who tries to use it is told the code is invalid.

Cause

SecureAuth looks up the user with the Search Filter and the Search Attribute configured on the Data tab. If the Search Filter doesn't also include the configured Search Attribute, SecureAuth cannot correctly match the user record needed to validate the TOTP code, so validation fails even though the code itself is correct.

Resolution:

Make sure the Search Filter includes the Search Attribute configured on the Data tab.

For example, if users log in with their email address, the Search Filter would be:

(&(mail=%v)(objectclass=user))

But if the Search Attribute is set to SamAccountName, the Search Filter also needs to allow SamAccountName, for example:

(&(|(samAccountName=%v)(mail=%v))(objectclass=user))

Special Considerations

If using Login for Endpoints (L4E), the Search Filter must match the attribute L4E actually sends, which is samAccountName -- but the Search Attribute configured on the Data tab still needs to match whatever attribute was used when the user originally enrolled.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.