Troubleshooting: QR or URL Enrollment Fails

Version Affected: 24.04+
 
 

Overview

QR or URL enrollment can fail for more than one reason. Causes 1 through 3 below share a qrProvision verify exception logged in the Error log -- the exact message, and the cause, depends on the realm type and configuration. Cause 4 is a separate, unrelated failure with its own distinct symptom:

• See Cause 1 - on a Classic realm, the message is The settings property 'OATHToken' was not found (or a similar property name).
• See Cause 2 - on a New Experience realm, the message is Object reference not set to an instance of an object, and the MIGRATION_MODE environment variable is present.
• See Cause 3 - the same New Experience message can also occur when the enrollment realm authenticates via Windows SSO (IWA), regardless of MIGRATION_MODE.
• See Cause 4 - on any realm, the Authenticate App shows Something went wrong, please try again instead of a qrProvision message in the Error log.
• See Cause 5 - on any realm, enrollment fails with Unable to save in the Authenticate App, and A Constraint violation has occurred in the Error log.

Check each cause below. The causes are not related, so a fix for one will not resolve another.
 

In this article

• Cause 1: Missing web.config property (Classic realms)
• Cause 2: MIGRATION_MODE environment variable (New Experience realms)
• Cause 3: Enrollment realm authenticates via Windows SSO / IWA (New Experience realms)
• Cause 4: Missing or Incorrect Certificate in Cloud Services (Any Realm Type)
• Cause 5: Constraint Violation Saving an Enrollment Attribute (Any Realm Type)

Cause 1: Missing web.config property (Classic realms)

On a Classic realm, this shows up as a warning in the logs such as The settings property 'kbq1' was not found. or The settings property 'kba1' was not found. (most often seen with the KBQ/KBA security-question properties, but it can occur with other settings properties too) — the named property is missing from the realm's web.config.

Resolution 1:

Add the missing property back into the realm's web.config. Updating the web.config file restores any missing properties automatically. If that's too invasive, decrypt the realm's web.config and add the specific missing setting manually, for example:

<add name="kbq1" />
<add name="kbq2" />
<add name="kbq3" />
<add name="kba1" />
<add name="kba2" />
<add name="kba3" />

Cause 2: MIGRATION_MODE environment variable (New Experience realms)

This is a known defect (EE-3815, currently Open - No Permanent Fix). The MIGRATION_MODE environment variable changes how enrollments are handled, and can cause the enrollment to fail to write to the on-prem data store for 3rd party authenticator apps:

• With mode1, the enrollment is pushed to Mobile Service but not written to the on-prem data store. Logging into a realm to use the app for MFA still works, since the device is read from Mobile Service.
• With mode2, the enrollment is also pushed to Mobile Service but not written to the on-prem data store. However, logging into a realm triggers a sync of the user's enrolled devices; since the device isn't in the on-prem data store, it's treated as orphaned, removed from Mobile Service, and no longer offered as an MFA option.

Resolution 2:

1. Remove the MIGRATION_MODE environment variable from the IdP server(s).
2. Reboot the IdP server(s) for the change to take effect.
3. Enroll via the 3rd party authenticator app again.

Cause 3: Enrollment realm authenticates via Windows SSO / IWA (New Experience realms)

This is a known defect (EE-3741). It has been seen on enrollment realms (URL or QR) that authenticate via Windows SSO (IWA), including on 24.4.2 Build 5 and 24.4.3 Build 10 — this isn't an exhaustive list, and other versions/builds may also be affected. As of testing in July 2025, a fix was going through QA; check current release notes for status. To confirm this cause, test whether disabling Windows SSO and authenticating via Forms-Based Authentication (FBA) instead resolves the enrollment failure.

Resolution 3:

We strongly recommend waiting for a release with the fix, rather than relying on a workaround. If a workaround is needed in the meantime, either of the following can be used:

• Disable IWA for the enrollment realm(s).
• Contact Support — an updated DLL may be available, but only for 24.4.3 Build 10.

Cause 4: Missing or Incorrect Certificate in Cloud Services (Any Realm Type)

On any realm, the Authenticate App itself shows Something went wrong, please try again during QR or URL enrollment, rather than a qrProvision message in the Error log. This is caused by an incorrect or missing certificate in the Cloud Services section of the realm's System Info tab -- the Client Cert Serial Nbr no longer points to a valid certificate (self-signed, missing, or expired). On older versions, this section may be labeled WSE 3.0 / WCF Configuration instead of Cloud Services.

Resolution 4:

1. Open the SecureAuth Admin Console and navigate to the realm (Classic View).
2. Click the System Info tab and scroll to the Cloud Services section.
3. Check what's currently set for Client Cert Serial Nbr -- it's likely the wrong certificate (self-signed, missing, or out of date).
4. Select the current appliance certificate and save.

Cause 5: Constraint Violation Saving an Enrollment Attribute (Any Realm Type)

On any realm, enrollment can fail with Unable to save in the Authenticate App, and A Constraint violation has occurred logged in the Error log. This happens when one of the AD attributes mapped for the enrollment data is incompatible with the value being written to it -- for example, too small a size, or the wrong LDAP syntax for the OATH Seed/Token or push notification data.

Resolution 5:

1. Open the Admin Console and check which OATH method the enrollment realm's Post Auth tab uses (OATH Seed vs. Token).
2. On the Data tab, check the attributes mapped for OneTimeOathList, the OATH Seed/Token, and Push Notifications.
3. Compare each attribute against the requirements below, and remap if needed:

• One Time Oath list -- Directory String, minimum size 200 (example: otherTelephone)
• Oath Seed -- Directory String, minimum size 4096 (example: postalAddress)
• Oath Token (binary) -- Octet String, minimum size 4096 (example: registeredAddress)
• Oath Token (JSON) -- Directory String, minimum size 4096 (example: otherIPPhone)
• Push Notification (binary) -- Octet String, minimum size 4096 (example: jpegPhoto)
• Push Notification (JSON) -- Directory String, minimum size 4096 (example: altSecurityIdentities)

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.