Users cannot login with OTP

UTM does not prompt separately for the OTP code.   The user is supposed to add it to the end of his password.

For new users, User Portal allows one-time login (without OTP) to view the QR code.  Once established, the portal requires password and pin concatenated.

When a user gets a new phone, the preferred behavior is to use the OTP code from the old phone to log into User Portal and display the QR code for the new phone.   But of course, this never happens.  Instead, the one-time login can be re-enabled using WebAdmin... Authentication Services... OTP.   Find the user in the list, and click the reset icon, which is an arrow running around in a circle.   If the user is in your presence, you can click the info button ("i") on the right margin to display his OTP code from within WebAdmin.

For WAF, I customized the login page to do a three-field login, which makes like easier for our users.  UTM does not permit customizing the User Portal login

Thanks for the answer Douglas,

However we got a wrong diagnostic.

Futher investigation learns us the problem is with one users phone.

We use the sophos autheniticator and the sophos soft token.

This new user logged in at the userportal and scanned the QR code of his token.

After that He was unable to login with OTP from his phone.

Without OTP he was able to login with only his password.

We scanned his softtoken on another phone with the sophos authenticator installed and could succesfully logon with OTP

We give the user a new token without any success.

We scanned a token of an user whice logn for a long time.

On the phone of the new user we are unable to logon.

It look likes the sophos authenticator or the phone of the new user is not working fine.

This phone is a Huawei Y7.

Somebody a clue?

Tokens depend on correct time of day, to keep the server and phone synchronized.   

• Does the phone show the correct time?  Phones are normally set to synchronize time with the cellular network, but I think this can be overridden in settings.   I have not tried this, but I would expect that if you put multiple phones  side-by-side, the code rollover should change simultaneously on all of them (if they all have the correct time).
  
  
• Does the server have the correct time of day, and is the time server successfully synchronizing with an external clock source?

There are also parameter in OTP setup to allow for clock skew, particular "Maximum passcode offset".

Tokens depend on correct time of day, to keep the server and phone synchronized.   

• Does the phone show the correct time?  Phones are normally set to synchronize time with the cellular network, but I think this can be overridden in settings.   I have not tried this, but I would expect that if you put multiple phones  side-by-side, the code rollover should change simultaneously on all of them (if they all have the correct time).
  
  
• Does the server have the correct time of day, and is the time server successfully synchronizing with an external clock source?

There are also parameter in OTP setup to allow for clock skew, particular "Maximum passcode offset".