search

multiOTP / multiOTPCredentialProvider

multiOTP Credential Provider is a V2 Credential Provider for Windows 7/8/8.1/10/2012(R2)/2016 with options like RDP only and UPN name support
Apache License 2.0
228 stars 75 forks source link

Wrong token length #93

Closed kanand72 closed 1 year ago

kanand72 commented 1 year ago

Im using the vm appliance. I have synced with AD. When I test the otp with google authenticator on the webpage, it shows OK. I have installed the multiOTPCredentialProvider on PC....when i authenticate from there, it always gives error.

LOG 2023-05-23 15:14:10 warning (user xxxxxxxx) User Error: authentication failed for user xxxxxx

LOG 2023-05-23 15:14:10 warning (user xxxxxxxx) User (authentication typed by the user is 13 chars long instead of 6 chars) 98 ERROR: Authentication failed (wrong token length)

LOG 2023-05-23 15:14:10 debug Debug Debug: *Attributes sent to the RADIUS server: Reply-Message := "ERROR: Authentication failed (wrong token length)" Reply-Message := "ERROR: Authentication failed (wrong token length)"

I am also not able to enable the log file in the multiotp sever.... I am checking the log by using the command ..... multiotp -debug -log -display-log

kanand72 commented 1 year ago

similar problem was reported earlier ... https://github.com/multiOTP/multiotp/issues/133 this seems to have been sorted out... I am using simple secret code ...

kanand72 commented 1 year ago

@multiOTP environment is : the multiotp server has been installed from vm appliance. multiotp cp has been installed from latest 5.9.6.1 version and older 5.9.2.1 versions .....same error in both...

multiOTP commented 1 year ago

Hello, thanks for trying our product. Can you please tell me which version of multiOTP server you are using ? (opensource, PRO, Enterprise and version number)

Best regards

kanand72 commented 1 year ago

I'm using the opensource version.

Sent from Yahoo Mail on Android

On Wed, 24 May 2023 at 6:41 PM, @.***> wrote:

Hello, thanks for trying our product. Can you please tell me which version of multiOTP server you are using ? (opensource, PRO, Enterprise and version number)

Best regards

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

The default secret in the multiOTP version is : multiotpsecret Did you use this secret in the credential provider ?

kanand72 commented 1 year ago

Tried with that and also with secret2OTP as given in this guide after running multiotp -config server-secret=secret2OTP on the server, Enable Two-Factor Authentication (2FA) in Windows with MultiOTP | Windows OS Hub

|
Enable Two-Factor Authentication (2FA) in Windows with MultiOTP Window...

In this article, we will show how to implement two-factor authentication (2FA) for users on a Windows domain usi... |

|

|

getting the same error in both cases.Also, the log file is not getting generated. RegardsAnand

On Wednesday, May 24, 2023 at 07:17:03 PM GMT+5:30, multiOTP ***@***.***> wrote:

The default secret in the multiOTP version is : multiotpsecret Did you use this secret in the credential provider ?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

Did you run this command "multiotp -config server-secret=secret2OTP" on the multiOTP server ? Can you send us a copy of the registry content "HKEY_CLASSES_ROOT\CLSID{FCEFDFAB-B0A1-4C4D-8B2B-4FF4E0A3D978}" from the PC with the credential provider installed ?

Best regards

kanand72 commented 1 year ago

Yes, I ran the command on the multiOTP server. Should I paste the contents of the registry key here or should I send by email ?

On Thursday, May 25, 2023 at 11:39:22 AM GMT+5:30, multiOTP ***@***.***> wrote:

Did you run this command "multiotp -config server-secret=secret2OTP" on the multiOTP server ? Can you send us a copy of the registry content "HKEY_CLASSES_ROOT\CLSID{FCEFDFAB-B0A1-4C4D-8B2B-4FF4E0A3D978}" from the PC with the credential provider installed ?

Best regards

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

You can sent it by email to support@multiotp.com

kanand72 commented 1 year ago

sent you the details by mail.Thanx for very prompt responses... Anand On Thursday, May 25, 2023 at 11:43:11 AM GMT+5:30, multiOTP @.***> wrote:

You can sent it by email to @.***

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

kanand72 commented 1 year ago

Hi...Were you able to check anything ?

multiOTP commented 1 year ago

Hello, I sent you an email maybe you didn't recieve it : Your multiOTP open source server has the ip : 10.129.20.158 ? What is your PC ip address ? From the computer where you have the credential provider installed can you ping the address 10.129.20.158 ?

Best regards

kanand72 commented 1 year ago

Hi,Think I missed you email..maybe it went into the SPAM folder...yahoo is pretty bad on that count ... Yes, I am able to ping the multiOTP server from the PC ...Thats why the error message is coming on the server when I try to login on the PC

On Tuesday, May 30, 2023 at 09:58:33 AM GMT+5:30, multiOTP ***@***.***> wrote:

Hello, I sent you an email maybe you didn't recieve it : Your multiOTP open source server has the ip : 10.129.20.158 ? What is your PC ip address ? From the computer where you have the credential provider installed can you ping the address 10.129.20.158 ?

Best regards

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

Is it possible to do remote support tomorrow (Wednesday 31st) at 2pm swiss time ?

kanand72 commented 1 year ago

2pm Swiss tome is 5:30PM IST. Is it possible to do at 1 PM swiss time ? My office finishes by 6 PM IST..So we will get more time to troubleshoot if we start at 1 PM swiss time .... Regards Anand On Tuesday, May 30, 2023 at 12:41:12 PM GMT+5:30, multiOTP @.***> wrote:

Is it possible to do remote support tomorrow (Wednesday 31st) at 2pm swiss time ?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

ok for 1pm. On which number Can I call you ? (you can send it to our support email)

kanand72 commented 1 year ago

Thank you. 

Sent from Yahoo Mail on Android

On Tue, 30 May 2023 at 10:32 PM, @.***> wrote:

ok for 1pm

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

I think I found the problem: This command doesn't exists : multiotp -debug -log -display-log

In order to have debug log you need to run this command on your server: multiotp -config debug=1

the switch -log and -display-log are only used when calling multiOTP in command line. For example: multiotp -display-log -log -debug jimmy ea2315

The authentication doesn't work because on the PC with the credential provider you need to specify the port to user. In the registry key multiOTPServers please add the port ":8112" at the end of the ip. (Do not forget the ":")

It should work that way. Best regards

kanand72 commented 1 year ago

I tried by adding :8112 at the end of the servers but still its not working.My line in registry :

On Wednesday, May 31, 2023 at 10:37:28 AM GMT+5:30, multiOTP ***@***.***> wrote:

I think I found the problem: This command doesn't exists : multiotp -debug -log -display-log

In order to have debug log you need to run this command on your server: multiotp -config debug=1

the switch -log and -display-log are only used when calling multiOTP in command line. For example: multiotp -display-log -log -debug jimmy ea2315

The authentication doesn't work because on the PC with the credential provider you need to specify the port to user. In the registry key multiOTPServers please add the port ":8112" at the end of the ip. (Do not forget the ":")

It should work that way. Best regards

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

Make sure you do not have a firewall on your multiOTP server ?

kanand72 commented 1 year ago

I am using the ova ..so in that is it enabled ?  On Wednesday, May 31, 2023 at 10:56:33 AM GMT+5:30, multiOTP @.***> wrote:

Make sure you do not have a firewall on your multiOTP server ?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

kanand72 commented 1 year ago

ran systemctl --type=service   ..no firewall is active . On Wednesday, May 31, 2023 at 10:56:33 AM GMT+5:30, multiOTP @.***> wrote:

Make sure you do not have a firewall on your multiOTP server ?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

port 8112 is for the Windows service since you are using ova you do not need to specify the port. Please remove it from the registry. Can you please change http to https in the registry for the key "multiOTPServers" Did you set a prefix for the user ? If so when you login with the credential provider you must not type in the prefix. Juste the OTP.

kanand72 commented 1 year ago

I removed the 8112 ...and tried with https instead of http...Still error is coming. no prefix is used. When testing from web gui, the otp coming on the authenticator app is getting verified. On Wednesday, May 31, 2023 at 11:38:00 AM GMT+5:30, multiOTP @.***> wrote:

port 8112 is for the Windows service since you are using ova you do not need to specify the port. Please remove it from the registry. Can you please change http to https in the registry for the key "multiOTPServers" Did you set a prefix for the user ? If so when you login with the credential provider you must not type in the prefix. Juste the OTP.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

We installed the latest version of multiOTP and it works

kanand72 commented 1 year ago

Thank you very much for taking the time for the remote session.Yes its working now.Could you tell me the use of the developer_mode and demo_mode in the config files ? ThanxAnand On Wednesday, May 31, 2023 at 04:45:11 PM GMT+5:30, multiOTP @.***> wrote:

We installed the latest version of multiOTP and it works

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

multiOTP commented 1 year ago

developer_mode => display more logs demo_mode => Used to provide a multiOTP server in demo mode (some settings are not editable)