Troubleshooting: ADFS VAM Issues with MFA Options Screen and OTP Validation

Version Affected: All
 
 

Overview

This article covers two unrelated issues that can occur when using the ADFS Validation Adapter Module (ADFS VAM) with SecureAuth: the MFA options screen failing to display correctly, and one-time passcode (OTP) validation failing during authentication.

• See Cause 1 - The MFA options screen fails to display correctly, and the browser's developer console shows a Content Security Policy error.
• See Cause 2 - Authentication fails after the user receives an SMS or Voice OTP, and the ADFS VAM logs show "PIN does not match OTP."

These causes are not related, so a fix for one cause will not resolve the other cause.

 

In this article

• Cause 1: MFA Options Screen Blocked by Content Security Policy
• Cause 2: PIN Does Not Match OTP on SMS or Voice Authentication

Cause 1: MFA Options Screen Blocked by Content Security Policy

Windows Server 2019 and later include a default Content Security Policy (CSP) on Active Directory Federation Services (ADFS) that restricts which origins a page's scripts and images can load from. Because the ADFS VAM retrieves content from the Identity Provider (IdP) server, which resides in a different domain, the default CSP blocks that request and the MFA options screen fails to display. The browser's developer console typically shows an error similar to: "Refused to load the script '<url>' because it violates the following Content Security Policy directive: 'default-src'."

Resolution 1:

To resolve this:

1. On the ADFS server, open PowerShell.
2. Run the following commands, replacing https://domain1.com with the IdP domain shown in the browser console error:
   

   Set-AdfsResponseHeaders -SetHeaderName "Content-Security-Policy" -SetHeaderValue "default-src https://domain1.com 'unsafe-inline' 'unsafe-eval'; img-src https://domain1.com data:;"
   Set-AdfsResponseHeaders -SetHeaderName "X-Frame-Options" -SetHeaderValue "deny"
   Set-AdfsResponseHeaders -EnableResponseHeaders $true

3. If more than one IdP domain needs to be trusted, list each additional domain after the first, separated by a space:
   

   Set-AdfsResponseHeaders -SetHeaderName "Content-Security-Policy" -SetHeaderValue "default-src https://domain1.com https://domain2.com 'unsafe-inline' 'unsafe-eval'; img-src https://domain1.com https://domain2.com data:;"
   Set-AdfsResponseHeaders -SetHeaderName "X-Frame-Options" -SetHeaderValue "deny"
   Set-AdfsResponseHeaders -EnableResponseHeaders $true

For more information about the Content-Security-Policy header, see Microsoft's ADFS security header documentation.

Cause 2: PIN Does Not Match OTP on SMS or Voice Authentication

This occurs when the realm used by the ADFS VAM is also used for another purpose. If that realm is also configured for Login for Endpoints, or has an OTPFieldMapping value set for the Validate OTP endpoint, the OTP validation logic can conflict, causing a valid OTP entered via SMS or Voice to be rejected. The ADFS VAM logs show an entry similar to: "SecureAuthAdapter.ValidateProofData - Pin does not match sent OTP, returning false."

Resolution 2:

To resolve this:

1. Create or select a realm that is used only by the ADFS VAM.
2. In that realm's Web.config editor, search for OTPFieldMapping and remove it if present.
3. On the API tab, confirm Login for Endpoints is not enabled for this realm.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.