MFA/TOTP Authentication Failures on Citrix DAAS intermittently
Article ID: CTX696724
Updated On:
Description
There are multiple users reporting these authentication failures and below is what they see:-
Invalid username, password or token
An error occurred while registering your token device.
Cause
Time-based One-Time Passwords (TOTP) generated by Microsoft Authenticator are highly time-sensitive.
If the mobile device's internal clock is out of sync with the network time by even a few seconds, the generated tokens will be invalid.
Resolution
Action:
Ensure the mobile device used during the test has its clock set to "Automatic" or is manually synchronized.
In this case we manage to fix by syncing the mobile phone internal clock for all users that reported the issue.
Issue/Introduction
-
MFA Method: Active Directory (AD) + Time-based One-Time Password (TOTP)
-
Trigger: Issues began reporting following an AD password rotation.
-
Primary Symptoms:
-
Error: "Invalid username, password or token" during standard login.
-
Error: "An error occurred while registering your token device" during re-enrollment attempts.
-
