Status codes

The OneSpan Authentication Server rejected an authentication request due to the Windows Group Check failing. This can occur when the effective Windows Group Check option is Authenticate listed groups, reject others.

Note that the effective setting is the effective setting of the policy, unless the user account overrides the policy.

The user account is locked. This is normally due to consecutive login failures, as determined by the policy setting User Lock Threshold. Alternatively, the administrator can actively lock the account.

To unlock the user account, an administrator has to uncheck the Locked check box on the user record.

A user attempted to request a backup Virtual Mobile Authenticator OTP, but they were not permitted. This would normally occur when either:

• The effective backup Virtual Mobile Authenticator enabledsetting is Yes – Time Limited, and the backup Virtual Mobile Authenticator Enabled Until date is the current date or before.
• The backup Virtual Mobile Authenticator Uses Remaining counterhas reached 0.

In both cases, administrator intervention is required to permit the user to continue to use backup Virtual Mobile Authenticator. The Enabled Until or Uses Remaining limits need to be increased to permit this.

Note that the effective setting is the effective setting of the policy, unless the authenticator record overrides the policy.

An authentication request was rejected because the applicable policy had invalid settings or failed to load. This should not occur, but is possible due to the delay in Active Directory replication for example. The two main ways in which a policy can become invalid are:

One or more choice list settings are Default in the policy, and its parent policy if it has one.

A circular chain of Policies has been created, for example: Policy A inherits from Policy B; Policy B inherits from Policy C; Policy C inherits from Policy A.

The policy must be fixed for authentication to be permitted using that policy.

An authentication request could not be processed successfully because Back-End Authentication using Windows was required, but the user's password was hashed. It is not possible to verify hashed passwords with Windows. This can occur when a CHAP-based protocol is used – this includes CHAP, MS-CHAP, MS-CHAP2, EAP-MD5 and other more complex protocols that utilize a one-way hash of the password entered by the user.

Note that the effective back-end authentication setting is the effective setting of the policy, unless the user account overrides the policy.

This can occur when OneSpan Authentication Server forwards a request to a RADIUS Server and the RADIUS Server responds with an Access-Challenge. An Access-Challenge can only be handled when OneSpan Authentication Server forwards the password unmodified to the RADIUS Server. If OneSpan Authentication Server verifies an OTP and forwards the static password to the RADIUS Server, it is not possible to handle an Access-Challenge from the RADIUS Server.

It can also occur if you use RADIUS Back-End Authentication for a Microsoft IIS Module. In that case, Access-Challenge is not supported from the RADIUS Server.

This status code occurs specifically when a signature is rejected because it has already been used. It may also occur when the signature has not been used but is older than the most recently used signature.

This behavior depends on the effective Online Signature Level Policy setting.

In addition, an audit message W-009002 is recorded.

The following are violations of the password strength rules:

• Password length is incorrect.
• Password does not contain a sufficient number of unique characters.
• The same password has already been used (too) recently.
• The password does not comply with any other of the password policy requirements.

OneSpan Authentication Server decided not to handle an authentication request because the effective Local Authentication and Back-End Authentication settings were both None.

Note that the effective settings are the effective settings of the policy, unless the user account overrides the policy.