I have a problem where I am getting failed authentication using a One Time Password. I need the AnyConnect window to display username, password, and "Enter MFA Passcode". The user will enter their username, password and a six digit PIN from their MFA application. When I don't have any Server Group entered into Secondary Authentication Server Group, the AnyConnect client will only show a username and password field. The user will enter their information and get a push to accept MFA on their mobile device. That works as expected. The problem is that we need to be able to use the OTP option. The only way I know how to get the Enter MFA Passcode field to appear is to enter something in the Server Group field. This will then display the Enter MFA Passcode option for the user. The experience with this option is that the user enters their username, password and passcode. The are then prompted on their phone for a push to accept MFA. They accept and but the AnyConnect client does not sign in and returns back to prompting for credentials.
I've read some forum posts saying that RADIUS might not support the OTP. Has anyone experienced something like this?
