isTrustedDeviceEnabled Flag Not Returned in Authentication Responses in Symantec IDSP AuthHub 4.0

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

When executing a multi-factor authentication (MFA) flow using Symantec Identity Security Platform (IDSP) / VIP Authentication Hub version 4.0, the API response for the last authentication factor (such as SMS or Email OTP) fails to return the expected attribute additional.isTrustedDeviceEnabled=true.

This occurs despite a correct end-to-end Trusted Device environment configuration, where:

• isTrustedDeviceEnabled is set to true within the Tenant Configuration.

• The Authentication Policy is configured with mfaFrequency: OnceForTrustedDevice.

• The client device fingerprint/signature is submitted, and a valid deviceId is successfully returned.

Environment

 

• Product: Symantec Identity Security Platform (IDSP) / VIP Authentication Hub

• Version Affected: 4.0.x (Prior to 4.0.2)

 

Cause

This behavior is due to a software regression introduced during the implementation of Granular Authentication Method References (AMR) for OTP.

When SMS or Email OTP obligations are evaluated as second-factor requirements (Level 2 authentication) in IDSP 4.0, the backend processing logic inadvertently breaks the evaluation sequence for trusted devices. This prevents the platform from outputting the isTrustedDeviceEnabled attribute in the final multi-factor response payloads.

Resolution

There are two available options to resolve this issue depending on your deployment capabilities:

Option 1: Temporary Workaround (Disable Granular AMR)

If you cannot immediately update your cluster, you can bypass this regression by turning off the granular AMR feature for OTP within your tenant settings.

1. Access your tenant configuration management endpoints or the Admin Console.

2. Locate the parameter: useGranularAMRForOTP

3. Change its value to false (Disabled).

4. Retest your multi-factor authentication flow. The isTrustedDeviceEnabled field should now correctly appear in the response payload before the last authentication factor.

Option 2: Permanent Fix (Upgrade to 4.0.2)

Engineering has officially resolved this regression in the Symantec Identity Security Platform version 4.0.2 release.

Upgrading your environment to version 4.0.2 fully restores the native Trusted Device flow logic without requiring you to turn off granular AMR functionalities.

Recommended Upgrade Paths:

• From IDSP v3.3.x: Upgrade sequentially via 3.3.x ➔ 3.4.x ➔ 4.0.2

• From IDSP v3.4.x / 4.0.x: You may proceed directly with an upgrade to version 4.0.2.