On Sat, 03 Aug 2019, Russ Long via FreeIPA-users wrote:
Hey everyone,
I'm in the process of implementing a FreeIPA cluster for our EC2
environment in AWS. I've got everything configured and working (hoping
to do a full writeup and share later), however I'm running into one
issue. Our Security Team has chosen Okta Verify as the MFA/OTP token
application to be used. I've attempted to setup a token with Okta
Verify, and no matter the settings I choose on the token setup page,
the token just won't let me login. I can use FreeOTP, and the token
there works fine.
Any ideas what might be the cause or solution here?
My understanding is that Okta
Verify uses TOTP, so you technically can
set it up with FreeIPA tokens but you need to make sure the shared
secret and other parameters are correct for both.
Some soft token applications only support a specific token algorithm.
For example, Google Authenticator only supports SHA-1. May be Okta
Verify also doesn't know about other token algorithms? Since you haven't
stated which one you are using, it is a bit of shooting in the darkness.
According to
https://github.com/oktadeveloper/okta-ardu-token-example
which uses
https://github.com/lucadentella/TOTP-Arduino, Okta Verify
should work with SHA-1 algorithm (default in FreeIPA).
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland