Tutorial: Use TOTP Hardware Tokens for MFA (RFC 6238) in Access Server (YubiKey)⁠

TOTP MFA isn't enabled by default. You can enable it globally, per group, or per user. Refer to the steps for your preferred method:

• Tutorial: Turn On TOTP Multi-Factor Authentication

• Tutorial: How to Manage TOTP MFA from the Command Line

1. Sign in to the Client Web UI.

2. When prompted, note the QR code and enrollment code.

3. Open the Yubico Authenticator.

4. Insert or connect your hardware token so it's detected.

5. Click Add account.

6. Scan the QR code or enter the enrollment code manually.

7. Confirm the account details, then click Save.

8. Enter the six-digit code shown in the authenticator.

9. Click Confirm Code.

   • The hardware token is enrolled as a TOTP authenticator.

   • The user account now requires a one-time password during login.

1. Download or use an existing connection profile.

2. Import it into OpenVPN Connect.

3. Start a connection.

4. When prompted, enter the six-digit code from the Yubico Authenticator.

   • ✅ Pass: Connection succeeds and displays connection statistics.

   • ❌ Fail: Authentication fails → verify MFA is enabled, and the token is enrolled correctly.

If you lose access to your hardware token, you'll need an administrator to reset your MFA enrollment.