Microsoft / Google Authenticator and OATH Verifier Node

Integrations
, , ,
1

Hello

I have a TOTP journey configured (and working) for users to register, get recovery codes, etc. and everything works with Forgerock authenticator, open otp, and browser extension authenticator. But, 2 things are happenng / having issues.

  1. Microsoft authenticator (scanning QR code / adds account) cannot verify the token that is displayed in the app. Though, do see the device registered for the user so know is being registered, just can’t verify the code.
  2. Google authenticator will not allow me to scan the QR code / add to Google.

Has anyone seen the above issues / challenges?

Thanks
Nick

2

Knowledge - ForgeRock BackStage shows how to make the OOTB work with Google

3

I tried this and it does not work.

4

Once I had done the
Enter a new value in the Minimum Secret Key Length field that avoids padding; choosing a value of 40 should typically work.
I was successful and why this KB was written

1 Like
5

David

Thanks for the information. I can now at least scan / register in the google authenticator app, but post the recovery code screen on verification it is still failing to validate the token. This is for both google and microsoft authenticator at this point. Anything else you had to do to get this working?

Thanks
Nick

1 Like
6

You may also want to see this recent KB article:

iOS Google Authenticator fails to register a device with an Invalid barcode error when using OATH nodes in Advanced Identity Cloud or PingAM

To recap, there were a couple of issues, one around QR scanning and the other where Microsoft Authenticator could not verify the token displayed on the app.

We’ve had similar issues due to MS Authenticator App it seems that the app itself does NOT support key values higher than the SHA1 https://answers.microsoft.com/en-us/msoffice/forum/all/authenticator-app-not-working-with-sha-256-and-sha/f0023746-2d4b-499e-aee5-2463d96a8144

Both issues have been identified and resolved by introducing a lower HASH Algorithm and the KB article Knowledge - ForgeRock BackStage by setting the Minimum Secret Key Length = 40

I hope you find this helpful.