DUO Authenticator returns a different number than Google and Microsoft for CloudStack's TOTP.
- 主要语言
- Java
- 星标
- 3.1k
- 派生
- 1.4k
- 平均合并
- 6 天 19 小时
- 30 天内合并 PR
- 32
描述
### problem
The title mentions DUO Authenticator because I want to stay consistent with the issue I already reported in DUO Security’s GitHub.
The problem occurs when setting up TOTP 2FA for a user in CloudStack. The QR code and seed work correctly in Google Authenticator, Microsoft Authenticator, and my password manager. However, DUO Authenticator generates the wrong rolling PIN (it looks out of sync).
Since the same QR code/seed works in four other apps, I believe this is a bug in DUO Authenticator. Still, since DUO is widely used as an enterprise-grade app, I wonder if CloudStack might be missing some information DUO needs when generating the TOTP.
Below are some sample TOTPs for a test user.
Revealing the Seed : LGV3KCWF3AFZKYB4MWSZBH3R6YWBINJI
QRCode content: otpauth://totp/Company:username?secret=LGV3KCWF3AFZKYB4MWSZBH3R6YWBINJI&issuer=Company
Revealing the Seed : 3JLPXCKBHYR3CHE73T7FNGBS5CDMQRBG
QRCode content: otpauth://totp/Company:username?secret=3JLPXCKBHYR3CHE73T7FNGBS5CDMQRBG&issuer=Company
### versions
ACS 4.20.1
### The steps to reproduce the bug
Setup TOTP on DUO and another app and compare the rolling PIN.
### What to do about it?
Maybe there are optional parameters that can be provided to the Authenticator app while scanning the QRCode that would inform some missing parameters that it fails to assume.
贡献指南
调研方向
首先,使用提供的 otpauth QR 码内容和列出的 ACS 4.20.1 版本重现不匹配问题,并将 DUO 与其他身份验证器进行比较。然后跟踪 CloudStack 的 TOTP 设置和 QR 码生成过程,以确定是否缺少必需参数,或者不兼容问题是否出在 DUO。确定责任方,并记录或测试已确认的行为,即视为完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- java
- 领域
- authentication
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 冷清
- 描述清晰度
- 需要澄清
- 新手友好度
- 35/100