TokenOTP

Over the past few weeks I had to deal with a problem in a Citrix installation with multi-factor authentication (based on the native Citrix ADC token).

This configuration had been working until a couple of months ago when, after a firmware upgrade of the Citrix ADC appliances, something “broke”. Specifically, it is no longer possible to access the OTP token configuration through the /manageotp page.

Searching online, I found (unofficial) information about a change in behavior meant to protect users’ security (accessing the token configuration from outside can compromise the tokens’ validity).

So I had to come up with an alternative solution that would let the customer configure tokens for their users without necessarily having to give them a VPN (to access the /manageotp page from inside the corporate network). I searched online and found the “OTP Editor” tool (https://www.andreasnick.com/102-otpedit.html), developed by Andreas Nick.
However, since I had to customize the tool to meet some of the customer’s requests, I thought I’d take inspiration from “OTP Editor” to build an alternative tool, one whose behavior I could customize each time based on my customers’ requests. So I spent a few hours writing my own tool, which I named “TokenOTP”:

This tool relies on native calls to Google to generate the secrets from which the QR code is then generated.

Before starting the tool, you need to fill in the 3 parameters in the config.xml file: Param, QRCodeTempFolder and UserGroup

<?xml version="1.0" encoding="utf-8" ?> 
<configuration> 
    <startup useLegacyV2RuntimeActivationPolicy="true"> 
        <supportedRuntime version="v4.0" />    
	    <supportedRuntime version="v2.0" />
    </startup> 
	<appSettings>
		<add key="Param" value="userParameters"/>
		<add key="QRCodeTempFolder" value="\QRcodes"/>
		<add key="UserGroup" value="Domain Users"/>
	</appSettings>
</configuration>

Once the tool is started, you can list all users (members of the group specified in the XML file), optionally filtering them to show only those who already have one or more OTPs, or only those without an OTP.

For each user in the list, you can right-click to access the functions to add a new OTP, view the configured OTPs or remove them.

When viewing a previously configured OTP, you can click the “OTP Code” button to generate an OTP token and see how many seconds are left to use it. This code is the same one that would be generated, for example, by a mobile app configured with the QR code shown alongside.

This code could be used, for example, to verify a user’s real identity during a phone request to the Service Desk; for instance, when a user calls the Service Desk to request a password reset, the operator could ask them to read out a token, to verify that the person making the request really is that user and not a malicious one.

In the next versions I’ll also add sending emails to users, including the QR code (a feature I haven’t finished implementing yet), plus a few other features I have in mind. Stay tuned. Of course, I’m open to suggestions 🙂

Here is the download link: