Enter your security code: message when Policy Server is integrated with VIP Access

Products

• SITEMINDER

Issue/Introduction

Integrating VIP Access with SiteMinder, once the user gets the Authentication Scheme, when the Security Code is used, the user can't login and the login prompt appears again.

"Allow Security Validation" is enabled in VIP Access Manager.

The Policy Server reports the message:

"Enter your security code:"

Cause

The Policy Server reports "Enter your security code:"

smtracedefault.log:

[08/18/2021][11:53:53][11:53:53.599][][][][][][4676][6372][][][][][][][][][][Sm_Auth_Message.cpp:1794][CSm_Auth_Message::AuthenticateUser][<server>][][/app.html][][0][4][][<environment>][][<user>][uid=<user>,ou=example,o=com][][][][][][][][][][][][][Evaluating OnAuthChallenge policy...][][][][][][][][][]
[08/18/2021][11:53:53][11:53:53.600][][][][][][4676][6372][][Login][][][][][][][][Sm_Auth_Message.cpp:5405][CSm_Auth_Message::FormatAttribute][<server>][][][][][][<environment>][][<user>][uid=<user>,ou=example,o=com][][][][][][][][][][Enter your security code:][][][Send response attribute 216, data size is 25][][][][][][][][][]
[08/18/2021][11:53:53][11:53:53.600][][][][][][4676][6372][s383/r499][][][][][][][][][Sm_Auth_Message.cpp:4902][CSm_Auth_Message::SendReply][<server>][][][][Enter your security code:][][<environment>][][<user>][uid=<user>,ou=example,o=com][][][][][][][][][][][][][** Status: Authentication Challenged. ][][][][][][][][][]

From the VIP logs it seems that the password is sent to the Radius Server, but this one doesn't Grant the user access, and return a timeout instead:

server.log :

INFO "2021-08-18 11:53:49.782 GMT+0530" 0.0.0.0 <server>:1812 0 0 "text=Trying to fetch attribute from User Store No:- 1 whose storeName is <storename> " Thread-12676 tokenbinding.cpp
INFO "2021-08-18 11:53:52.136 GMT+0530" 0.0.0.0 <server>:1812 0 0 "text=VSAuthOTPFirstFactorLDAPImpl.authenticateExt() -- User successfully validated against <storename> no. = 1" Thread-12676 VSAuthOTPFirstFactorImpl.c
INFO "2021-08-18 11:53:52.136 GMT+0530" 0.0.0.0 <server>:1812 0 0 "text=[INFO_REQUEST:<user>] requestId: 9_9_0_w_10_91_6_7_302979868" Thread-12676 VSWebServiceClientImpl.cpp
INFO "2021-08-18 11:53:52.442 GMT+0530" 0.0.0.0 <server>:1812 0 0 "text=Prompt user [<user>] for OTP." Thread-12676 VSAuthOTPStandardControllerImpl.cpp  
AUDIT "2021-08-18 11:53:53.598 GMT+0530" 10.0.0.1 <server>:1812 0 1912 "text=Access CHALLENGED 0x0: Success,reason=0" Thread-12676 VSValidationEngine.c

And after 1 minute, the request timed out:

WARNING "2021-08-18 11:54:52.753 GMT+0530" 0.0.0.0 <server>:1812 0 0 "text=_handleChallengeRequestsWorker() -- RADIUS Access-Challenge request [<user>:<value>] has timed-out." Thread-12316 VSAuthManageChapRequests.cpp

Resolution

According to documentation the Password field should look like:

passwordcode

This is the "Password–Security Code (ULO)", where "password" is the password and "code" is the code.

This is the way to set the password when the authentication popup appears (1).

Additional Information

1. Testing the RADIUS Server Template authentication scheme for ULO mode