Status Codes

General-purpose error due to invalid user name or password, when a more specific status is unavailable.

If the Use Generic Authentication Status Codes policy setting is active, this status is always returned, even if more specific status information is available.

The following status codes will be mapped:

• 1007
• 1009
• 1010
• 1011
• 1012
• 1023
• 1025
• 1033
• 1045

The real status code and message will still be visible in the audit and trace messages.

A response to challenge has been given, but the expiration time for the challenge has expired. The default expiration time is one minute, however this can be configured in the configuration file VASCO/Challenge-Cache/Max-Age setting (in seconds).

This status code occurs specifically when an OTP is rejected because it has already been used. It may also occur when the OTP has not been used but is older than the most recently used OTP.

This can sometimes happen when an authentication request is re-sent automatically.

An authentication request was rejected because no user account was found and the policy requires local authentication.

The verification of an OTP failed. Note that this can also happen if a score-based authenticator application returns success (valid OTP) with a score warning. More specific details may be found in the Authentication Server Framework error code and message.

A user attempted to log in with the static password, but the grace period had already expired. The authenticator must be used to log in.

If the authenticator has not been used yet, the administrator will have to allow more time by modifying the Grace Period End date in their authenticator record.

A user attempted Self-Assignment, but the requested authenticator could not be found within the search scope or was already assigned to someone else.

This may occur because of a mistyped serial number. Otherwise, the search scope may be incorrect, or the authenticator may not be in the correct location to be made available to the user. For more information, refer to the OAS Authentication SDK Product Guide, Section "DIGIPASS Records Location".

A user attempted a Virtual Mobile Authenticator login, but did not enter a password in the second stage of the login.

General-purpose error of Local Authentication when a more specific status code is not available. Additional information should provide more specific details.

Back-end authentication (e.g. Windows) failed. A specific error code and message will accompany this record.

The following are violations of the password strength rules:

• Password length is incorrect.
• Password does not contain a sufficient number of unique characters.
• The same password has already been used (too) recently.
• The password does not comply with any other of the password policy requirements.

The user attempted to log in but the static password has expired.

A user attempted Self-Assignment, but it is not permitted by the policy.

The effective Local Authentication setting is  Digipass Only and the user tried to log in with a static password.

Note that the effective  setting is the effective setting of the policy, unless the user account overrides the policy.

This status code can only occur in the authenticator plug-in for Microsoft Internet Authentication Service. For Windows 2000 a product limitation inhibits the support of the Challenge/Response mode. This will occur if the user has attempted to request a challenge.

A request was made to update a user's stored password, but password autolearn is disabled, so the update is not permitted. Password autolearn must be enabled for the password update request to be processed.

An administration command has been received, but the session has stopped or is unrecognized. This can occur due to an idle timeout, a maximum session length timeout or a restart of OAS Authentication SDK.

During a Self-Assignment attempt, the serial number provided by the user was not found in the data store. This mainly occurs when the serial number is entered incorrectly. It can also occur because the authenticator record is not in the user's domain or organizational unit.

A reactivation attempt was refused for one of the following reasons:

• The authenticator has already been activated from the maximum number of allowed locations. This limit is controlled by the configuration setting Max Locations of the provisioning scenario.
• The maximum number of allowed activation attempts has already been reached. This limit is controlled by the Provisioning Scenario configuration setting Max Attempts.
• The minimum time interval required between activation attempts has not yet been reached since the last activation attempt. This limit is controlled by the configuration setting Min Interval of the provisioning scenario.

If no Local Authentication or Back-End Authentication is done during an activation request, a static password is required from the user account. The password is used to encrypt the activation code.

Generation of an activation code for provisioning failed.

The verification of a signature failed. Note that this can also happen if a score-based authenticator application returns success (valid OTP) with a score warning.

For an authentication request, a host code was required to be returned. The authenticator application for which the OTP was validated was not capable of generating a host code.

For a signature validation request, a confirmation code was required to be returned. The authenticator application for which the signature was validated was not capable of generating a confirmation code.

The .dpx file that was used to import the authenticator application controls whether the host or confirmation code can be generated.

The back-end server group is missing a back-end protocol ID.

[NEW IAS 3.6: #39413]

[NEW IAS 3.6: #39413]

[NEW IAS 3.6: #39413]

This status code is returned in those cases:

• The authenticator is already bound to a device.
• The device cannot be bound.
• The activation data cannot be generated.

In addition, an audit message W-016004 is recorded.

A response to a challenge was given, but no challenge could be found. The most likely reason for this to occur is that the challenge is too old and has been removed from the challenge cache. It can also occur if no challenge key was supplied with which to look up the challenge.

OAS Authentication SDK decided not to handle an authentication request due to the Windows Group Check failing. This can occur when the effective Windows Group Check option is Pass requests for users not in listed groups back to host system.

Note that the effective setting is the effective setting of the policy, unless the user account overrides the policy.