Symantec VIP Access time-based software credentials generate invalid OTP after daylight savings

Products

• VIP Service

Issue/Introduction

Daylight savings time changes cause time-based OATH credentials to fail. 

Cause

Time-based credentials use an internal clock that determines when to generate a new security code. For hard-tokens, this clock is built into the device. For soft-tokens (VIP Access), this is the system clock of the host it is installed onto. When an operating system time is incorrect, the security code generated by the VIP Access soft-token will also be 'out of sync' with the VIP Cloud and results in an 'invalid OTP' error during authentication. Repeated security code failures will lock the credential and/or user account in VIP Manager.  

Note to end-users: contact your internal helpdesk if login attempts with your VIP credential are failing and they can help resetting the account if needed.

Resolution

In order for VIP Access soft token to remain in sync with the VIP cloud, the phone, laptop, tablet or other devices the VIP software is installed should automatically adjust to time shifts due to daylight savings changes, crossing into another time-zone, low BIOS battery, etc. The time-zone must also be correct. 

Alternatively, the system time can be manually adjusted by the end-user when a time-shift occurs.  

(If you are an end-user on a corporate-owned device, please reach out to your helpdesk before making any changes)