multiOTP / multiotp

multiOTP open source strong two factor authentication PHP library, OATH certified, with TOTP, HOTP, Mobile-OTP, YubiKey, SMS, QRcode provisioning, etc.
http://www.multiOTP.net/
GNU Lesser General Public License v3.0
346 stars 74 forks source link

Windows RDP SMS doesn't work #192

Closed rmoreRojoli closed 2 weeks ago

rmoreRojoli commented 2 months ago

Hi, I have moved a 5.8.2.9 server running in docker to 5.9.7.1, uninstalled the old Credential Provider on Windows and installed the new 5.9.7.1 version. On the server when I test a user like multiotp USERNAME sms I receive the SMS and I see the debug logs as well working. However when I try to log in through RDP on the Windows side it says SMS sent but in the logs I get the following:

debug CredentialProviderRequest Info: Value for IsCredentialProviderRequest: 0 364801b3491b debug Server-Client Info: CheckUserExists server request for USERNAME with challenge XXX 0 364801b3491b debug Server-Client Info: CheckUserExists intermediate error code: 22 0 364801b3491b debug Server-Client Info: Server secret used for command CheckUserExists with error code result 22: b3b8af57b6b247b5 0 364801b3491b debug CredentialProviderRequest Info: Value for IsCredentialProviderRequest: 0 364801b3491b debug Server-Client Info: ReadUserData server request for USERNAME 0 364801b3491b debug Server-Client Info: *Server secret used for command ReadUserData with error code result 19: b3b8af57b6b247b5 0 364801b3491b

I have installed the Cred Provider with https://IP:8443 and server secret, no cache, allow SMS on login screen, remote only option

Is there something I left out or changed in the config? Thanks for the help!

multiOTP commented 1 month ago

Hello, it looks like your secret is not the same on the server and on the Credential provider. In docker can you please run the following command : php multiotp.php -config server-secret=abcd1234 (try with abcd1234, juste to make sure there is no special caracters that are not supported)

Then on the Windows RDS go to the registry and change the value of : HKEY_CLASSES_ROOT\CLSID{FCEFDFAB-B0A1-4C4D-8B2B-4FF4E0A3D978}\multiOTPSharedSecret to abcd1234

Try to login

If it works change the secret to something more complex.

Best regards

rmoreRojoli commented 1 month ago

Issue seems to persist even with that change and a reboot:

2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_time was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for encryption_hash was 99CCFC0D033729754B6BB4832FE786A1 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_time was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for encryption_hash was 99CCFC0D033729754B6BB4832FE786A1 0 b3d142ebcf56 2024-07-17 08:24:19 debug CredentialProviderRequest Info: Value for IsCredentialProviderRequest: 0 b3d142ebcf56 2024-07-17 08:24:19 debug Server-Client Info: CheckUserExists server request for USERNAME with challenge MOSH55fa0e55f45a5011cb14973e1bbb5940 0 b3d142ebcf56 2024-07-17 08:24:19 debug Server-Client Info: CheckUserExists intermediate error code: 22 0 b3d142ebcf56 2024-07-17 08:24:19 debug Server-Client Info: Server secret used for command CheckUserExists with error code result 22: abcd1234 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_time was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for encryption_hash was 99CCFC0D033729754B6BB4832FE786A1 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for create_time was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update was 1720792995 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for last_update_host was b3d142ebcf56 0 b3d142ebcf56 2024-07-17 08:24:19 debug System Debug: ReadConfigData, stat value for encryption_hash was 99CCFC0D033729754B6BB4832FE786A1 0 b3d142ebcf56 2024-07-17 08:24:19 debug CredentialProviderRequest Info: Value for IsCredentialProviderRequest: 0 b3d142ebcf56 2024-07-17 08:24:19 debug Server-Client Info: ReadUserData server request for USERNAME 0 b3d142ebcf56 2024-07-17 08:24:19 debug Server-Client Info: *Server secret used for command ReadUserData with error code result 19: abcd1234 0 b3d142ebcf56

multiOTP commented 1 month ago

Do you click on the button "Receive an OTP by SMS" ? Did you configure the SMS provider settings ? (sms-password, sms-userkey, sms-provider)

What is you sms provider ?

Best regards

rmoreRojoli commented 1 month ago

These logs are generated when I click "Receive an OTP by SMS" Using the custom SMS provider I have Twilio set up, which works with the multiotp USERNAME sms command

multiOTP commented 1 month ago

Is it the case for all users ?

multiOTP commented 1 month ago

Hello, can you please delete all the files in [ProgramFiles]\multiOTP\users and try again.

If it's still not working can you please check if the user.db file is created in this folder

Best regards