MFA TOTP code

[kalsure]

Hi @redhook62,

I am configured MFA and Enabled Options TOTP only. It works fine for a week but now users have to enter the two times same codes.

Users are getting MFA code and entering code for signing and it is not signed a site it shows "The operation completed successfully". Again entered the same code and it get signed in successfully.

Verified time sync on a mobile device as well as AD FS server time. Is it required to restart any services?

Thank you in advance.

Regards

[redhook62]

Hi @kalsure

Frankly, this TOTP module has been working fine for over 5 years.
I don't have too many ideas.

First, I will check that your servers are well synchronized with an atomic clock, as well as your devices. a time difference produces authentication errors.

If it appears after a week, this may be where it is necessary to look.

regards

[redhook62]

@kalsure

Some news ?

[kalsure]

Hi @redhook62

Restarted MFA services. It works. We are not getting any more errors as I said above.
But I do MFA service restart every weekend for as of now.

[redhook62]

@kalsure

Ok, I think you don't need to restart the servers every week. To see in time.

regards

[kalsure]

Hi @redhook62

Can we get any details to stack trace into event viewer regarding this above one error "The operation completed successfully"?

For now, we got the server events:-

Event Viewer is getting the Event ID 900:
"AuthenticationProvider: TryEndAuthentication Error : Userid@domain.com : "

Can we do any modifications to the code to get the details events logs?
Still, we are restarting the MFA service for this issue.

Thank you.
Regards

[redhook62]

Hi @kalsure

This type of error... "The operation completed successfully" is a Win32 error. We are going to check if we set "SetLastError = true" on the DLL imports in order to get the real exception message.

From there we can check where the error comes from.

Can you tell us how many servers in your ADFS farm?
For totp, what type of key are you using (RSA, AES, ...)?

regards

[redhook62]

Hi, @kalsure

We completed a win32 function call to get the actual error message.
We also added the release of a global handle for retrieving the ADFS service SID 'adfssrv" Marshal.FreeHGlobal.

However, these functions are only used when creating processes and the system.db file (cache of security information)

You can test this build, it's the latest version.
If you want to be able to go back, you must save your configuration with Export-MFASystemConfiguration
Then please tell us the new error messages if there are any, and check if after a week the problem still occurs.

regards
adfsmfa.zip

[kalsure]

Thank you @redhook62

Will check internally and get back to you.

[kalsure]

Hi @redhook62,

On this version, MFA Neos-Sdi Version: 3.1.2202.1 We are getting the same error "The operation completed successfully".

Kindly advise,

Thank you in advance.

[kalsure]

Hi @redhook62,

Please see the below - TOTP config.

We have only one ADFS farm.

[redhook62]

Hi, @kalsure

This problem has been solved in version 3.1.2202.2 (2/14/2022)
You can try with the latest 3.1.2206.0

regards

[kalsure]

Okay. Thank you @redhook62. will try with newer version.

[kalsure]

Hi @redhook62 ,

Still, we are facing issues. We are on MFA version latest 3.1.2206.0

Could you please advise if any other MFA settings or configuration-related issues?

Thank you in advance.

Regards

[redhook62]

Hi @kalsure

You know, I still have a lot of different configurations with my clients, not to mention interactions with GitHub.
I haven't detected this problem anywhere else.
The only thing I can recommend is since you used 512 bits (64 bytes) RNG keys, why did you select the Key Display Size of 2048 bits (256 bytes)?
Try changing this setting to 512 bits.

regards

[kalsure]

Okay. Thank you. Let me try the same settings.

[kalsure]

@redhook62 ,

Sorry to ping you on this again. One more point double confirming.
While we changing on this 'Key Display Size' is there any effect on existing MFA registered users?
We don't want to re-register again :

Thank you.

[redhook62]

No, there will be no effects, so no need to re-register.
And if that didn't solve your problem, you can go back to 2048 bits

[derSchweiger]

@kalsure sorry to ping you here but did you solve this problem? We experience the same behaviour from time to time and haven't found a solution, nor can reproduce this issue on a constant basis.