Troubleshooting: Multi-Factor Methods Tab Fails to Load Due to a Titan Connectivity Issue

Version Affected: 19.07+
 
 

Overview

When opening the Multi-Factor Methods tab on a realm, an error is shown instead of the tab loading. The appliance contacts Titan to confirm whether it is licensed for number profile, and either of two different-looking errors can appear depending on what is misconfigured:

• See Cause 1 - A "The operation has timed out." error.
• See Cause 2 - An "Object reference not set to an instance of an object" error, referencing MFA.SecureAuth.Provider.TitanNumberProfileProvider.

These causes are not related, so a fix for one cause will not resolve the other cause.

 

In this article

• Cause 1: Network or Proxy Misconfiguration Prevents Reaching Titan
• Cause 2: Missing or Invalid Certificates Prevent Reaching Titan

Cause 1: Network or Proxy Misconfiguration Prevents Reaching Titan

The appliance has a valid certificate mapped in SecureAuth0, but cannot reach Titan within the expected time due to a network or proxy misconfiguration. This raises a "The operation has timed out." error.

Resolution 1:

To resolve this:

1. Confirm the GlobalSettings.Json file has the correct Proxy settings configured, if a proxy is in use.
2. Confirm the System Info tab on SecureAuth0 has the correct Proxy Settings, if a proxy is in use.
3. Check the NumberProfileWSURL setting in web.config, and confirm the appliance can reach that URL.

Cause 2: Missing or Invalid Certificates Prevent Reaching Titan

The appliance cannot reach Titan because it is missing, has misconfigured, or lacks permissions for the Serial Certificate or Client Certificate that Titan uses to check licensing. This raises an "Object reference not set to an instance of an object" error, with the configuration error MFA.SecureAuth.Provider.TitanNumberProfileProvider shown, on every realm's Multi-Factor Methods tab.

Resolution 2:

To resolve this:

1. Open the System Info tab on SecureAuth0.
2. Confirm both the Serial Certificate and Client Certificate fields are populated with valid certificates.
3. The Client Certificate should be a SecureAuth SHA2 SecureAuth Certificate, with NETWORK SERVICE and IIS AppPool\SecureAuth0Pool read permissions.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.