This message was deleted.

Did you check the aaadebug log? Verify that your bind user has enough rights to edit the userparameter attribute.

If the request is not seen coming through that would be your Nactor setup. What license level are you running? Are your policy labels bound correctly?

Thanks for the responses. @Leee Jeffries I have double checked all the config and it looks good. The LDAP policy with auth enabled is bound directly to the AAA vServer with a next Factor of the policy label. The policy label has both the 'manageotp' and 'verifyotp' policies bound with the manage policy having a higher priority. I have run some more traces again this morning and it shows the LDAP policy is extracting the userParameters attribute fine but, whereas on a working system I then see the modify attribute sent, on the failing one it simply sends an unbind request. I have tried against 2 separate domains now and the same issue.

That's very odd Chris. If its extracting the user parameters the account can read them, it may be permissions that it cannot write them. Have you delegated the permissions?

Managed to get it working. For some reason, enabling the encrypted OTP secret option caused it to fail. Not sure why as cert has been bound and not aware of anything else which needs to be done. Luckily customer is only using it short-term until Azure MFA is enabled. Thanks for the responses Leee / Daniel

No problems, great work.