Symptoms

When using "OTP Verify" agent with Per Request Policies, OTP Source and Max Logon Attempts session variables cannot be configured using the UI.

Impact

If the configured logon page where users enter their OTP is configured to capture this token with anything different from a "password" session variable name, OTP Verify will fail.

Conditions

Using "OTP Verify" agent with Per Request Policy

Workaround

Manually edit bigip.conf from: apm policy agent otp-verify /Common/otpsub_act_otp_verify_subsession_ag { } To this new config: apm policy agent otp-verify /Common/otpsub_act_otp_verify_subsession_ag { otp-source "%{subsession.logon.last.otp}" } Where opt-source variable name matches what was set on the logon page.

Fix Information

None

Behavior Change