multiOTP Credential Provider for multiOTP is a free and open source implementation of a V2 Credential Provider for the multiOTP strong two-factor authentication solution (Apache License, Version 2.0)
(c) 2016-2024 SysCo systemes de communication sa (enhancements since 2016 and simple installer with configuration options)
(c) 2017-2021 NetKnights GmbH
(c) 2015-2016 ArcadeJust ("RDP only" enhancement)
(c) 2013-2015 Last Squirrel IT
Current build: 5.9.8.0 (2024-08-26)
The binary download page is available here : https://download.multiotp.net/credential-provider/ (download link are at the bottom of the page)
Please consider supporting this project by making a donation via PayPal
Visit http://forum.multiotp.net/ for additional support.
multiOTP Credential Provider for multiOTP supporting Windows 7/8/8.1/10/2012(R2)/2016/2019
Launch the installer (in the installer directory) and configure the various parameters during the setup. You must have administrator access to successfully install the multiOTP Credential Provider.
Which Authentication Mode should I choose?
Be sure that last MSVC++ redistribuable are installed. If it's not the case, you can deploy them automatically using the four MSI provided in the VC++_MSI_Deployment folder
Using Orca, you can create Transform files in order to set the settings of the credential provider. The following properties can be set :
Copy the MSI and MST files to a share which is accessible in Read-Execute for every computers
Create a GPO that applies to the selected computers, adding the following settings:
Create a second GPO that applies to the selected computers, adding the following settings:
If MSVC++ redistributable are not already installed on those computers, create a GPO to deploy the 4 x86 AND x64 MSVC++ redistribuable files.
Finaly, create a GPO that applies to the selected computers to deploy the MSI with its MST file
To force to apply the GPO on the selected computers:
1) Install the multiOTP Credential Provider, which contains also multiOTP inside. 2) Using the wizard, answer to the different questions 3) To disable the Credential Provider, uninstall it from Windows, or execute multiOTPCredentialProvider-unregister.reg
1) First, install a multiOTP server (commercial or open source edition). (https://www.multiOTP.com or https://www.multiOTP.net) 2) On each client, install the multiOTP Credential Provider. 3) Using the wizard, type the URL of the multiOTP server(s). 4) To disable the Credential Provider, uninstall it from Windows, or execute multiOTPCredentialProvider-unregister.reg
HKEY_CLASSES_ROOT\CLSID\{FCEFDFAB-B0A1-4C4D-8B2B-4FF4E0A3D978}
the available registry keys are
cpus_logon Logon authentication type [0|1|2|3][e|d] 0: relevant for remote (RDP) and local operation 1: relevant for remote operation 2: relevant for local operation 3: relevent for remote and local operation - but multiOTP Credential Provider is completely disabled. e: Only the multiOTP Credential Provider is available. All other credential providers are not available. d: In addition all other credential providers are available. Example: cpus_logon = 0e: Only the multiOTP Credential Provider is available for Logon via remote and locally.
cpus_unlock Unlock authentication type [0|1|2|3][e|d]
cpus_credui Authentication in Windows authentication type (when action requires admin rights for example) [0|1|2|3][e|d]
excluded_account Specify an account that should be excluded from 2FA. The format is required to be domain\username or computername\username.
login_text Specify the text that is displayed underneath the Credential Provider logo and on the right side where available credentials arelisted.
multiOTPCacheEnabled [1|0], used directly by multiOTP
multiOTPDefaultPrefix [Default computer/domain, default is '']. multiOTP use automatically the domain name as default, or computer name if the computer is not in a domain. You can set here a manual default computer/domain, like for example '.'
multiOTPDisplaySmsLink [0|1]
multiOTPDisplayEmailLink [0|1]
multiOTPServers [multiOTP server(s) to contact, default is 'https://192.168.1.88'], used directly by multiOTP
multiOTPServerTimeout [timeout in seconds before switching to the next server, default is 5], used directly by multiOTP
multiOTPSharedSecret [secret to connect this client to the server, default is 'ClientServerSecret'], used directly by multiOTP
multiOTPTimeout [timeout in seconds, default is 60]
multiOTPUPNFormat [0|1] Set to 1 to use UPN username (kevin@test.com) instead of username (kevin)
numlockOn [0|1]Set to 1 to enable NumLock during published apps authentication
two_step_hide_otp [0|1] Set to 1 if the Credential Provider should ask for the user's OTP in a second step. In the first step the user will only be asked for the password.
two_step_send_password [0|1] Set to 1 if the Credential Provider should send the user's password to the multiOTP server
two_step_send_empty_password [0|1] Set to 1 if the Credential Provider should send an empty password to the multiOTP server
otp_text Speficy the text that is displayed in the OTP input field. Usually this is "One-Time Password", but you can change it to any other value you like.
otp_hint_text Speficy the text that is displayed when prompted to enter the OTP in the second step.
otp_fail_text Specify a custom text that is shown when the OTP verification failed. Include %s in the string where you want multiOTP error message to be displayed.
v1_bitmap_path The complete path and filename of a bitmap image. This is a customized login image. The image must be a version 3 Windows BMP file with a resolution of 128x128 pixels.
multiOTPTimeoutUnlock Timeout (in minutes) before asking 2FA again on unlock (0 means always ask)
multiOTPDisplayLastUser [0|1] Set to 1 to display a button in order to autocomplete the username with the last username authenticated
multiOTPWithout2FA [0|1] Set to 1 to disable 2FA prompt for multiTOP without2FA users
Report if you have any problems or questions regarding this app.
2024-08-26 5.9.8.0 ENH: Detailed error messages available when authentication is refused
2023-12-03 5.9.7.1 FIX: Using domain prefix for windows authentication in addition to using it during multiOTP authentication
FIX: Third party VPN client works on the login page when credential provider is active
FIX: Comparing pointer content instead of pointer address during registry readings
ENH: nlohmann JSON for Modern C++ update to 3.11.2
2023-05-10 5.9.6.1 ENH: PHP 8.2 x64 integration (don't need x86 MSVC++ redistribuable files anymore)
ENH: x86 edition of multiOTP Credential Provider can now be created/compiled from the source on GitHub
2023-02-10 5.9.5.6 ENH: New option to enable NumLock during published apps authentication
ENH: Unlock timeout handling supported for multiple accounts, FastUserSwitching is available again
2022-11-04 5.9.4.0 FIX: Last user account is now also stored when doing unlock, which will fix some unlock timeout issues
FIX: One step 2FA hide unwanted link on the login form
2022-10-21 5.9.3.1 FIX: Better special characters support in username and password
ENH: Accounts with Without2FA tokens can now also be stored in cache
2022-08-09 5.9.2.1 ENH: Support without2FA user, unlock timeout without 2FA
ENH: Users without 2FA tokens don't see the second screen during logon
ENH: Autocomplete username (with the last connected username)
2022-06-17 5.9.1.0 ENH: FastUserSwitching inactivation done during wizard (to fix unlock issue)
ENH: Last connected user available
2022-05-26 5.9.0.3 ENH: UPN and Lecagy cache handling when the domain controller is not reachable
ENH: Better UPN account handling when the domain controller is not reachable
ENH: Once SMS or EMAIL link is clicked, the link is hidden and a message
is displayed to let the user know that the token was sent
2022-05-06 5.8.8.0 FIX: Second factor authentication failed if no domain controller is reachable
2022-04-29 5.8.7.1 ENH: PHP 8.1 integration
2022-04-28 5.8.7.0 ENH: PHP 7.4 integration
2022-04-20 5.8.6.1 ENH: If username doesn't exist in multiOTP, it try automatically a shorter domain name step by step
ENH: Email token can be requested from the Credential Provider
ENH: Better domain name support
2022-01-04 5.8.5.1 ENH: Documentation added for credsui and UPN
2021-12-24 5.8.5.0 ENH: UPN notation support reintroduced in the new implementation
2021-09-14 5.8.4.0 FIX: multiOTPServerTimeout is now saved in a DWORD
FIX: Upgrade from a previous MSI installation without uninstall and reinstall
2021-09-14 5.8.3.0 ENH: Allow again a tile image in the same folder of the DLL
ENH: Remote server is optional again
2021-08-19 5.8.2.9 ENH: MSI deployment supported
ENH: password expiration is now managed
ENH: password must not be typed twice anymore
2021-03-14 5.8.1.1 FIX: In some cases, the HOTP/TOTP was not well computed (in the multiOTP.exe companion)
2020-09-26 5.8.0.3 FIX: vcruntime140.dll has been removed from PHP subfolder
2020-08-31 5.8.0.0 ENH: Integration of last multiOTP.exe
FIX: Registry entries are read protected against regular users
2019-11-26 5.6.1.6 ENH: Silent install supported (WARNING! No test will be done, be sure the regitry parameters are correct !)
2019-10-23 5.6.1.5 FIX: Better handling of parameters in debug mode
FIX: swprintf_s problem with special chars (thanks to anekix)
ENH: Optional manual default computer/domain setup
ENH: PHP 7.3 used in the one single file
2019-01-25 5.4.1.6 FIX: Username with space are now supported
ENH: Added integrated Visual C++ 2017 Redistributable installation
2018-09-14 5.4.0.1 FIX: Better domain name and hostname detection
FIX: The cache lifetime check process was buggy since 5.3.0.3
ENH: multiOTP Credential Provider files and objects have been reorganized
2018-08-26 5.3.0.3 FIX: Users without 2FA token are now supported
2018-08-21 5.3.0.0 FIX: Save flat domain name in the registry. While offline, use this value instead of asking the DC
ENH: Enigma Virtual Box updated to version 9.00 (to create the special all-in-one-file)
ENH: PHP 7.2.8 used in the one single file
ENH: The multiOTP timeout (how long the Credential Provider wait a response
from the multiOTP process) is now 60 seconds by default (instead of 10)
2018-03-11 5.2.0.0 ENH: New implementation from scratch
2018-03-05 5.1.0.8 ENH: Enigma Virtual Box updated to version 8.10 (to create the special all-in-one-file)
2018-02-27 5.1.0.7 FIX: [Receive an OTP by SMS] link is now fixed for Windows 10
2018-02-26 5.1.0.6 ENH: Credential Provider registry entries are now always used when calling multiOTP.exe
2018-02-21 5.1.0.5 FIX: To avoid virus false positive alert, multiOTP.exe is NO more packaged in one single file
using Enigma, a php folder is now included in the multiOTP folder
FIX: multiOTPOptions registry entry is now useless is ignored
2018-02-21 5.1.0.4 ENH: Credential Provider registry entries are used if available
2018-02-19 5.1.0.3 ENH: Setup wizard has one more page for better layout
ENH: Options stored in the multiOTPOptions registry are read and have more priorities than config file
ENH: Login title can be customized using the multiOTPLoginTitle registry
ENH: Tile image can be customized by saving a 128x128 bmp in the file [multiOTPPath]\multiotp.bmp
ENH: The default installation folder is now [ProgramFiles]\multiOTP
2017-12-11 5.0.6.2 ENH: [Receive an OTP by SMS] link can be displayed or not (option during installation)
ENH: UPN username format can be sent to the multiOTP server (by default, legacy username)
ENH: Better documentation
2017-12-04 5.0.6.1 FIX: [Synchronize OTP] link removed (useless, synchronization is done automatically by typing OTP1 + [space] + OTP2)
ENH: Default domain name support
ENH: User can request an SMS code using a command link
2017-11-10 5.0.6.0 ENH: Specific Credential Provider mode in the CLI version
2017-11-05 5.0.5.9 ENH: Full support for login@domain.name UPN notation (AD/LDAP should be synchronized using the userPrincipalName instead of sAMAccountName identifier)
2017-11-04 5.0.5.6 FIX: Removed digit OTP only check for the OTP field
ENH: Friendly name of the second factor field renamed from PIN to OTP
2017-06-02 5.0.4.6 FIX: Fixed default folder detection for the multiotp.exe file
2016-11-04 5.0.2.6 ENG: First public release with an installer, based on hard work done by Last Squirrel IT and ArcadeJust