smswso2-identity-servertwo-factor-authentication

Why am i receiving OTP messages but being redirected to a 405 page in WSO2 IS?


I am trying to acheive two-factor authentication. The first login step should prompt the user to enter: username & password then SMS OTP for the second step.

The problem is that after configuring the SMS OTP, i am shown a 405 error after clicking the 'send OTP button'

[![405 Error after clicking send OTP button.](https://i.sstatic.net/6LAiK.png)](https://i.sstatic.net/6LAiK.png)

This is the link of the page with the 405 error https://localhost:9443/smsotpauthenticationendpoint/smsotp.jsp?client_id=fJsj8UV4QEH5yWkuLjevFruYGyMa&commonAuthCallerPath=%2Foauth2%2Fauthorize&forceAuth=false&passiveAuth=false&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fpickup-dispatch%2Foauth2client&response_type=code&scope=openid+internal_application_mgt_view&tenantDomain=carbon.super&sessionDataKey=cc73a6e6-168d-40ce-8003-c0c2a26afa16&relyingParty=fJsj8UV4QEH5yWkuLjevFruYGyMa&type=oidc&sp=pickup-dispatch&isSaaSApp=false&multiOptionURI=%2Fauthenticationendpoint%2Foauth2_login.do%3Fauthenticators%3DEmailOTP%253AGmail%2BOTP%253BSMSOTP%253ASMS%2BOTP%253Btotp%253ALOCAL%26response_type%3Dcode%26type%3Doidc%26tenantDomain%3Dcarbon.super%26client_id%3DfJsj8UV4QEH5yWkuLjevFruYGyMa%26relyingParty%3DfJsj8UV4QEH5yWkuLjevFruYGyMa%26passiveAuth%3Dfalse%26isSaaSApp%3Dfalse%26commonAuthCallerPath%3D%252Foauth2%252Fauthorize%26scope%3Dopenid%2Binternal_application_mgt_view%26forceAuth%3Dfalse%26sessionDataKey%3Dcc73a6e6-168d-40ce-8003-c0c2a26afa16%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A8080%252Fpickup-dispatch%252Foauth2client%26sp%3Dpickup-dispatch&authenticators=SMSOTP

I modified the deployment file by adding the following.

### SMS CONFIGURATION ###
[authentication.authenticator.sms_otp] 
name ="SMSOTP"
enable=true

[authentication.authenticator.sms_otp.parameters]
SMSOTPAuthenticationEndpointURL= "/smsotpauthenticationendpoint/smsotp.jsp"
SMSOTPAuthenticationEndpointErrorPage= "/smsotpauthenticationendpoint/smsotpError.jsp"
MobileNumberRegPage = "/smsotpauthenticationendpoint/mobile.jsp"
RetryEnable = true
ResendEnable = true
BackupCode = true
SMSOTPEnableByUserClaim = true
usecase = "local"
secondaryUserstore = "primary"
SMSOTPMandatory = true
SendOtpToFederatedMobile = false
federatedMobileAttributeKey = "mobile"
CaptureAndUpdateMobileNumber = true
SendOTPDirectlyToMobile = false
redirectToMultiOptionPageOnFailure = false
TokenExpiryTime = 12

My SMS provider is using a GET Request and in all the documentation SMS providers use POST. Could that be the issue?

this is my Identity provider configuration for SMS SMS Configuration for SMS identity provider


Solution

  • I also could reproduce the issue in IS-6.1.0 pack when the deployment.toml configs were added as mentioned. Remove all these configs from the deployment.toml file and try the flow. The flow will work properly.

    ### SMS CONFIGURATION ###
    [authentication.authenticator.sms_otp] 
    name ="SMSOTP"
    enable=true
    
    [authentication.authenticator.sms_otp.parameters]
    SMSOTPAuthenticationEndpointURL= "/smsotpauthenticationendpoint/smsotp.jsp"
    SMSOTPAuthenticationEndpointErrorPage= "/smsotpauthenticationendpoint/smsotpError.jsp"
    MobileNumberRegPage = "/smsotpauthenticationendpoint/mobile.jsp"
    RetryEnable = true
    ResendEnable = true
    BackupCode = true
    SMSOTPEnableByUserClaim = true
    usecase = "local"
    secondaryUserstore = "primary"
    SMSOTPMandatory = true
    SendOtpToFederatedMobile = false
    federatedMobileAttributeKey = "mobile"
    CaptureAndUpdateMobileNumber = true
    SendOTPDirectlyToMobile = false
    redirectToMultiOptionPageOnFailure = false
    TokenExpiryTime = 12