I'm designing a web application and using Microsoft's out of the box Identity and its default Two-Factor Authentication (with Asp.net core MVC and .NET 8). While setting up and testing the 2FA functionality, I noticed the Authenticator phone app only allows the use of one Authenticator account to one 2FA setup.

Here is how I tested: I opened the same application in two different sessions Visual Studio sessions locally, each connected to two different but identical database schemas. I created a user using the same email address for each, which Microsoft also uses for its User ID by default. While setting up 2FA by scanning the QR code in the first session, it defaults to the email address being used for the account name, and authenticates appropriately. While doing the same in the second session, it tells me it will overwrite the existing account. If I select okay, it alerts me that the activation failed, but offers me to enter the account name and secret key manually. In doing so, I noticed I can enter anything in the account name field, and it will use that and create a new account name.

As a side note, I guess I assumed the Authenticator could use one account across multiple unique applications as people use the same username/emails across different domains. But since this is not the case, then I'd imagine this would be confusing for everyday users if/when they run into this; when this 2FA version is offered across different web applications designed with .NET. Unless I'm missing something within the Authenticator and it is possible?

Here is the format string used: private const string AuthenticatorUriFormat = "otpauth://totp/{0}:{1}?secret={2}&issuer={0}&digits=6";

By default the framework uses email as the first argument. I am thinking about just setting that to my web application's domain name instead or even a combo of the email prepended with the application domain name. This way the QR code will translate and tell the Authenticator application to create a new account using a more unique name to avoid a collision.

Am I thinking about this correctly, or should I be taking another approach?

Thank you.

  • 1
    It seems like you want a different issuer string. Otpauth URLs can indeed combine issuer+account into the account name field, similar to what you suggest, and the shown string format is already doing that! Whatever you do, stick to the actual conventions of this URL scheme, and do not invent your own incompatible dialect. E.g. see the otpauth description here: github.com/google/google-authenticator/wiki/Key-Uri-Format
    – amon
    Commented Feb 21 at 11:12
  • @amon perfect! Just what I was looking for. That reference to the description helped clear things up for me. Now that I understand the parameters better I can play around with it more when I get home, and be confident I'm not creating any future issues. Thanks!
    – eaglei22
    Commented Feb 21 at 16:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.