topic Re: EnableBlankRadiusAuth and OTP prompt in SASE and Remote Access

EnableBlankRadiusAuth and OTP prompt

kamilazat — Wed, 19 Mar 2025 08:45:16 GMT

Hello everyone.

We're testing a scheme where a Windows user would only enter username and then authenticate with a mail OTP from radius server. This is the first time we're going through something like this and I'm a bit confused. So let me try to describe what we did so far and maybe you can direct me to the right direction.

First I set up Multiple Login Options:

1.png

And then I configure Authentication factor for RADIUS. Here I clear the checkbox "Ask user for password" so that the user would only provide his username and then is only asked for the OTP he receives via email:

2.png

Now, in Endpoint Security on the user PC, user enters his username and clicks connect:

3.png

The password prompt is greyed out (as in the image above) or completely nonexistent (below):

4.png

At this point gateway sends the Access-Request only when anything is entered. We tried entering the OTP code received by email and random characters. In all cases the connection gets reset.

I found this post, and tried sk167118 but when EnableBlankRadiusAuth is set to 1, we don't even see the "Response" prompt. When we set the RADIUS server's policy to use OTP from the mobile app, everything works fine, the problem seems to be with email. And there are no issues with the connectivity between the gateway and the RADIUS server.

Edit: I should've mentioned that EnableBlankRadiusAuth is still set to 1, but probably needs to be set back to 0. I'm not sure exactly what this does, though.

I'm sure there's some confusion at some point but we couldn't pinpoint where it is so far.

All help and ideas will be appreciated, as always 🙂

Cheers!

Re: EnableBlankRadiusAuth and OTP prompt

G_W_Albrecht — Wed, 19 Mar 2025 09:12:59 GMT

Open SR# with CP TAC to get this resolved asap !

Re: EnableBlankRadiusAuth and OTP prompt

kamilazat — Wed, 19 Mar 2025 10:19:35 GMT

@G_W_Albrecht Thanks for the recommendation. That will happen anyway if I can't find any answers 🙂

But before doing that, I still want to ask. Would you think it's the RADIUS server if everything works with mobile OTP but fails with mail OTP? Or is it possible for CP to have issues somewhere?

Re: EnableBlankRadiusAuth and OTP prompt

G_W_Albrecht — Wed, 19 Mar 2025 10:27:53 GMT

I have no idea at all ! Maybe an issue with the email server...

Re: EnableBlankRadiusAuth and OTP prompt

PhoneBoy — Wed, 19 Mar 2025 14:51:02 GMT

As far as I know, the only supported way to use RADIUS for MFA is to use a single prompt (user password + OTP on the same line).

Re: EnableBlankRadiusAuth and OTP prompt

CheckPointerXL — Sat, 05 Apr 2025 20:52:42 GMT

No sense, but.... did u try to enter password into response field?

Re: EnableBlankRadiusAuth and OTP prompt

kamilazat — Mon, 07 Apr 2025 08:00:39 GMT

Yes, the problem is the challenge is being sent 'after' we enter anything in the response field.

We're already in the process with TAC. Let's see what'll come out of it.

Re: EnableBlankRadiusAuth and OTP prompt

PhoneBoy — Mon, 07 Apr 2025 15:19:17 GMT

We don't support challenge/response with RADIUS, which is what I assume the TAC will tell you.
You have to enter the password followed by the OTP code in the first dialog.

Re: EnableBlankRadiusAuth and OTP prompt

kamilazat — Tue, 08 Apr 2025 10:06:35 GMT

I see. Do you know if there's a specific reason for that?

Re: EnableBlankRadiusAuth and OTP prompt

PhoneBoy — Tue, 08 Apr 2025 12:47:22 GMT

No idea, but it’s been this way for as long as I can remember.