NetScaler native OTP (One-Time Password) device registration failure

NetScaler native OTP (One-Time Password) device registration failure

book

Article ID: CTX340212

calendar_today

Updated On:

Description

Can't register device for native OTP authentication in NetScaler.

Resolution

The following two methods can solve this problem, you can choose one according to your requirement:
  • Disable OTP encryption
set aaa otpparameter -encryption OFF
  • Enable OTP encryption and bind certificate to encrypt OTP secrets
set aaa otpparameter -encryption ON
bind vpn global -userDataEncryptionKey <certificate name>

Problem Cause

OTP Encryption enabled but no certificate binding to take effective.

In NetScaler /var/log/ns.log, we can see the following error:
Feb 16 12:00:59 <local0.info> <nsip>02/16/2022:04:00:59 GMT CloudUVPX 0-PPE-0 : default AAATM Message 820 0 : "Manage OTP: No devices for <poc01>, registering first device"
Feb 16 12:00:59 <local0.info> <nsip>02/16/2022:04:00:59 GMT CloudUVPX 0-PPE-0 : default AAATM Message 821 0 : "Manage OTP: cannot register device <test01> for <poc01>, reason <No Encryption cert>"
Feb 16 12:00:59 <local0.info> <nsip>2/16/2022:04:00:59 GMT CloudUVPX 0-PPE-0 : default AAATM Message 822 0 : "nFactor: OTP: failed to encrypt otp secret, user: <poc01>"
Feb 16 12:00:59 <local0.info> <nsip>02/16/2022:04:00:59 GMT CloudUVPX 0-PPE-0 : default SSLVPN Message 823 0 : "AAA Client Handler: Found extended error code 1245184, ReqType 16388 request /nf/auth/nsotp, cookie hdr NSC_TMAS=a87e0d77619a8721795633540fa50b63"

 

Additional Information

https://support.citrix.com/article/CTX570841
Powered by Wolken Software