SMS OTP sent to outdated mobile number in Symantec Identity Security Platform

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

You experience an issue where a One-Time Password (OTP) is sent to an outdated mobile number instead of the user's updated number stored in the LDAP directory. This occurs because credential synchronization is skipped in specific authentication flows, causing the system to rely on cached or stale mobile data.

Environment

Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub) 4.0.3

Resolution

Targeted to be fixed in release 4.0.5 and higher. 

To address this issue, a new application meta data flag is introduced: urn:iam:app:oauthIdentityTokenAllowAutoInlineEnrollment.

When you set this attribute to true, the system allows the issuance of an Identity Token (IT) such that the acceptance of the token triggers an auto-enrollment of user credentials. This ensures that any changes to the user's phone number in the LDAP store are correctly synchronized during step-up authentication.

Workaround (if applicable prior to 4.0.5): If you cannot upgrade immediately, you can invalidate existing user sessions to force the system to fetch fresh user data from the LDAP store. You do this by calling the following API endpoint after the mobile number is updated in the LDAP directory:

DELETE https://{host}/{tenant}/admin/v1/UsersSessionsAndRefreshTokens/{userId}

• Authorization: Bearer {adminAccessToken}
• Important: You must use the user's internal ID. If you use a login name, you must provide the correct ?identitysourcename={identitySourceName} parameter, otherwise, the call returns a success status (204) but fails to invalidate the session.