DOCSEARCHbyAlgolia
Submit Docs

multiOTP Credential Provider

repository·master·Indexed 43 days ago

https://github.com/multiotp/multiotpcredentialprovider

A Windows V2 Credential Provider implementation that adds strong two-factor authentication (OTP) to local and RDP Windows logons. It supports standalone local modes and centralized server-based modes with offline cache support. Version 5.1.0.2.2 provides options for mandatory OTP for remote desktop or both local and remote sessions, with enterprise deployment support via MSI and MST Transform files.

Tokens
1.9K
Snippets
3
Records
7
Agent score
7%

What's inside multiOTP Credential Provider

  1. Choose an Authentication Mode

    master

    During manual installation, you must select one of the following authentication modes:

    • OTP authentication mandatory for remote desktop only: Users only need an OTP when logging in via Remote Desktop (mstsc). Local logins use only the Windows password.
    • OTP authentication mandatory for local logon and remote desktop: Users must provide an OTP for both local and remote (mstsc) logins.
    • OTP and std auth. for local and remote (to check OTP validation): Users can choose to login with or without an OTP for both local and remote sessions.

  2. Deploy via MSI and MST Transform

    master

    For enterprise deployment, use the MSI installer with a Transform (.mst) file created via Orca to pre-configure settings.

    Deployment Steps

    1. Ensure the appropriate Microsoft Visual C++ Redistributable (2015-2022) is installed on target machines.
    2. Copy the MSI and MST files to a network share accessible by all computers.
    3. Configure GPO 1: Set Computer Settings > Administrative Templates > System > Logon > Always wait for the network at computer startup and logon to Enabled.
    4. Configure GPO 2: Set Computer Configuration > Policies > Administrative Templates > System > Group Policy > Enable the Specify startup policy processing wait time to 120 seconds.
    5. Deploy MSI: Use a GPO to deploy the MSI along with its MST file.
    6. Force Update: Run gpupdate /force /boot on target computers using administrator privileges.

  4. Install multiOTP Credential Provider

    master

    The installation method depends on whether you want a standalone local setup or a centralized server-based setup.

    Local Only Installation

    Use this if you want the multiOTP engine to run locally on the machine.

    1. Install the multiOTP Credential Provider (which includes the multiOTP engine).
    2. Follow the setup wizard prompts.

    Centralized Installation (with cache support)

    Use this to connect multiple clients to a central multiOTP server.

    1. Install a multiOTP server (commercial or open source).
    2. Install the multiOTP Credential Provider on each client machine.
    3. During the setup wizard, provide the URL of your multiOTP server(s).

    Manual Installation

    Launch the installer from the installer directory and configure parameters. Administrator access is required.

  5. Reference MSI/Registry Configuration Properties

    master

    The following properties can be set via MSI Transform files or directly in the registry key HKEY_CLASSES_ROOT\CLSID\{FCEFDFAB-B0A1-4C4D-8B2B-4FF4E0A3D978}. Registry entries take priority over multiotp.ini file entries.

    ### Connection & Server
MULTIOTP_URL: FQDN of the multiOTP server (e.g., https://192.168.1.188)
MULTIOTP_SECRET: Secret shared with the multiOTP server
MULTIOTP_TIMEOUT: Seconds to wait for multiOTP server response (Default: 5)

### Authentication Behavior
MULTIOTP_TWO_STEP_HIDE_OTP: 1 to force OTP request in a second step
MULTIOTP_TWO_STEP_SEND_PASSWORD: 1 to enable requesting OTP via SMS or e-mail
MULTIOTP_WITHOUT2FA: 1 to disable 2FA prompt for multiTOP without2FA users
MULTIOTP_UPNFORMAT: 1 to use UPN format (kevin@test.com) instead of username (kevin)
MULTIOTP_EXCLUDED_ACCOUNT: Account to exclude from 2FA (e.g., contoso\backdoor)
MULTIOTP_TIMEOUTUNLOCK: Timeout in minutes before asking 2FA again on unlock (0 = always)

### UI Customization
MULTIOTP_LOGINTEXT: Text displayed underneath the logo
MULTIOTP_BITMAP_PATH: Path to 128x128 pixel BMP image
MULTIOTP_OTP_TEXT: Text displayed in the OTP field
MULTIOTP_USERNAME_TEXT: Text displayed in the Username field
MULTIOTP_PASSWORD_TEXT: Text displayed in the Password field
MULTIOTP_OTP_HINT_TEXT: Text displayed when prompted for OTP in second step
MULTIOTP_OTP_FAIL_TEXT: Text displayed on invalid OTP (use %s for error message)
MULTIOTP_DISPLAYLASTUSER: 1 to enable autocomplete with last username
MULTIOTP_DISPLAYUSERLOCKED: 1 to show locked/delayed message before OTP

### Logon/Unlock Modes (cpus_logon, cpus_unlock, cpus_credui)
Format: [0|1|2|3][e|d]
0: Relevant for remote (RDP) and local
1: Relevant for remote only
2: Relevant for local only
3: Relevant for remote and local, but Credential Provider is disabled
e: Only multiOTP Credential Provider is available (others hidden)
d: All other credential providers are available

  6. View multiOTP Credential Provider version and metadata

    master

    The multiOTPCredentialProvider.dll binary contains embedded version and product metadata. This information is useful for verifying the installed version and identifying the provider's purpose.

    Product Metadata:

    • Product Name: multiOTPCredentialProvider
    • Product Version: 5.1.0.2.2
    • File Description: multiotp Credential Provider for Windows logon
    • Internal Name: multiOTPCredentialProvider.dll
    • Company Name: SysCo systems de communication sa
    PRODUCTVERSION 5,1,0,2,2
FILEVERSION 5,1,0,2,2
VALUE "ProductName", "multiOTPCredentialProvider"
VALUE "ProductVersion", "5.1.0.2.2"
VALUE "FileDescription", "multiotp Credential Provider for Windows logon"

  7. Identify CredentialProviderFilter version and metadata

    master

    The multiOTPCredentialProviderFilter.dll contains embedded version information and product metadata. This can be used to verify the installed version of the CredentialProviderFilter for the multiOTP CredentialProvider on Windows logon systems.

    Product Metadata:

    • Product Name: multiOTPCredentialProvider
    • File Description: CredentialProviderFilter for the multiOTP CredentialProvider for Windows logon
    • Internal Name: multiOTPCredentialProviderFilter.dll
    • Original Filename: multiOTPCredentialProviderFilter.dll
    • Company Name: SysCo systemes de communication sa
    FileVersion: 5.10.2.2
ProductVersion: 5.10.2.2