GlobalProtect prompts for OTP twice during login

[Orxan Ibrahimov]

Hello RCDevs Support,

We are experiencing an issue with our RCDevs OTP authentication integrated with Palo Alto GlobalProtect.

Issue description:
A user launches the GlobalProtect client and enters their username and password. The client then prompts for an OTP, and the user enters the correct OTP.

However, instead of completing the authentication process, the client immediately displays another OTP prompt. The user is required to enter a second OTP to continue.

There is no error message or authentication failure displayed after the first OTP is entered. The second OTP prompt simply appears without any indication of what caused it.

We would like to understand:

• Under what circumstances would RCDevs issue a second OTP challenge without displaying an error?
• Could this behavior be related to Challenge/Response authentication, RADIUS retries, timeouts, or any specific RCDevs configuration?
• Which RCDevs log files or debug logs should we collect to identify the root cause?

[Benoît Jager (RCDevs)]

Hello,

OpenOTP should not request a second challenge, can you provide /opt/webadm/logs/webadm.log file, this will give us information on what happens. 

You can download it here:

https://ext.rcdevs.com/share/s/xPp8sk2dB7iYWJC