We began receiving the following error message after no change to server:

YubiKey OTP validation failed with message: NO_VALID_ANSWER
Sorry, authentication failed.

We verified that the server was able to communicate to the Yubikey authentication servers from here:

http://www.yubico.com/demo/one_factor.php

We did not update the server, Drupal, or any of the modules including Yubikey before the problem occurred. We tried modifying the API key and ID from SQL, and then tried updating the Yubikey module but nothing worked. We are locked out of the Drupal front end of the site because it requires even user1 to authenticate with Yubikey. We tried changing "yubikey_authscheme" from the variable table to S:12:"un_or_yk__pwd", but it didn't change the authentication requirements. None of the changes we have made to the variable table seem to change how you log into Yubikey (and possibly not even the API key and ID as we previously thought was changed).

Any help would be greatly appreciated as the entire site is at a halt right now.

Thanks in advance

Comments

toddejohnson’s picture

toddejohnson commented

To get user1 able to login remove the yubikey from the database for the user.

Have you actually run the demo from your server?

codym’s picture

codym commented

We don't have a user account for Rubix Consulting and are unable to run the demo on the server or otherwise as our Yubikeys aren't associated with any accounts. Am I missing something, or is there a different place to create an account? I didn't see any links to do so. If you mean the yubico demo at http://www.yubico.com/demo/one_factor.php, then yes, we already tried that from the server. We run FreeBSD and ran it through Lynx and it worked just fine.

We are able to get in with user1 now, thanks.

codym’s picture

codym commented

It appears to be tied to the timeout settings (and thus a communication issue). Changing the timeout for authentication from 10 seconds (default) to 60 seconds allows the users to eventually log in.

We are using authentication to the default Yubico authentication service. We aren't seeing any other latency issues however either with the site or the server itself. All other response and request times are as expected.

codym’s picture

codym commented

We tried the demo here http://demo.yubico.com/php-yubico/demo.php using the same API key, ID, OTP, and other settings straight from the server's browser and authentication completed immediately. From the URL part list, we even took the service URLs and explicitly defined those within the module. Again, authentication would complete, but would take a significant amount of time (at last clock-in it took 54 seconds to authenticate).

We backed up the authmap table, disabled Yubikey, uninstalled the module using Drupal's uninstaller, redownloaded the module, enabled the new Yubikey module again in Drupal, reconfigured a new API and ID, imported the authmap table, and still received the same results.

Disabling Yubikey and authenticating just with username and password works immediately, like normal.

Below are the explicitly defined service URLs we gathered from the above demo site:

api.yubico.com/wsapi/2.0/verify
api2.yubico.com/wsapi/2.0/verify
api3.yubico.com/wsapi/2.0/verify
api4.yubico.com/wsapi/2.0/verify
api5.yubico.com/wsapi/2.0/verify

codym’s picture

codym commented
Title: Authentication Failes - NO_VALID_ANSWER » Authentication Fails - NO_VALID_ANSWER
toddejohnson’s picture

toddejohnson commented

Using the demo somewhere else is diffrent from having it installed on the same site. You can read more about the demo from http://code.google.com/p/php-yubico/wiki/ReadMe.

It sounds like something is causing a slow down. If you try the demo from your server and have no problems then we can start researching where problems arrised. If this is an urgent matter please use my contact form and we can expedite the process.

I personally don't have a site currently that uses Yubico's servers. I need to get new yubikeys for a few sites.

toddejohnson’s picture

toddejohnson commented
Status: Active » Closed (cannot reproduce)