6.1 Enrollment can't be performed

Description

User is unable to scan a QR code.

Issues

  1. Smart phone is not able to scan a QR code.

  2. When I scan the QR code, following are the messages displayed:

    • Android app: Please ask your admin if the error will be repeated: Device add error

    • iOS app: JSONEmptyField, message: The field AddDeviceResult is an empty string

    • Windows Phone app: Can't load the authenticator: Salt is null or empty

  3. During enrollment on the android app, an error message java.security.cert.CertPathValidatorException: Trust anchor for certification path not found is displayed.

Causes

  1. The app supports only Advanced Authentication compliant QR codes. The other QR codes can't be scanned with the Advanced Authentication smartphone app.

  2. Incorrect configuration.

  3. The self signed certificate that you have uploaded on the Server Options does not contain all intermediate certificates or the certificate is not in following order:

    -----BEGIN PRIVATE KEY----- 
(Your Private Key: your_domain_name.key) 
-----END PRIVATE KEY----- 
-----BEGIN CERTIFICATE----- 
(Your Primary SSL certificate: your_domain_name.crt) 
-----END CERTIFICATE----- 
-----BEGIN CERTIFICATE----- 
(Your Intermediate certificate: intermediate.crt) 
-----END CERTIFICATE----- 
-----BEGIN CERTIFICATE----- 
(Your Root certificate: TrustedRoot.crt) 
-----END CERTIFICATE-----

Solution

  1. Ensure that you are trying to scan a QR code.

    1. In Advanced Authentication Self-Service Portal for Smartphone or TOTP method. In case of TOTP method usage probably the Google Authenticator format of QR code is enabled. Contact your system administrator for more information.

    2. In Advanced Authentication Web Enrollment Wizard for Smartphone or OATH OTP method (when TOTP mode is selected).

    3. Using Smartphone or OATH OTP method within a first logon on workstation or later in Authenticators Management. A QR code which is shown in OATH - Enroll window may be too small (depending on screen resolution). It's recommended to perform the enrollment through the Advanced Authentication Web Enrollment Wizard, because it displays the larger QR codes and the Web Enrollment Wizard improves the user's experience in OATH OTP authenticator enrollment.

  2. Administrator must verify correctness of Smartphone method configuration. This may be related to a conflict on IP address/port.

  3. Upload a valid certificate on the Server Options tab.

Recommendations:

  1. While scanning the QR code, make sure you are following below approach:

    1. Ensure that the mouse cursor does not overlap with the QR code.

    2. If you are enrolling the authenticator in browser try to zoom in the page with the QR code to 125-150%. It may be required for screens with high resolution.

    3. Try to enroll on another monitor (brightness, contrast, glossy surface may affect).

    4. Check on the smartphone that the QR code is in focus. Some Android devices has no auto focus feature and may have problems with scanning the QR codes.

    5. Try to use another smartphone.

  2. Contact your system administrator.

  3. To test the certificate, you can open the Advanced Authentication Server URL in the Android smartphone browser. If you are still using an invalid certificate, a warning will display that the connection is not trusted.