# Google Authenticator iRule Verification **URL:** \ **Category:** Technical Forums\ **Tags:** design, irules, big-ip-access-policy-manager-apm, security, devops, application-delivery, google-authenticator\ **Created:** [October 27, 2014, 3:16pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461 "2014-10-27T15:16:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![clesan201305\_11](https://avatars.discourse-cdn.com/v4/letter/c/b9bd4f/32.png) [@clesan201305\_11](https://community.f5.com/u/clesan201305_11)\ **Post date:** [October 27, 2014, 3:16pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/1 "2014-10-27T15:16:34Z")
Hi, I’ve been following this article: [https://devcentral.f5.com/articles/two-factor-authentication-with-google-authenticator-and-apm](https://devcentral.f5.com/articles/two-factor-authentication-with-google-authenticator-and-apm) To implement two-factor authentication with APM. After creating an access policy, data group and all the likes, I find that the APM is expecting a different code than the authenticator shows. I found out by printing the variables that I enter as a code, and the variables that the APM expects as a code, into the logs. The whole process itself works. The iRule is triggered, the username is found in the datagroup, and the calculations are made. It’s just expecting a different code. For example, my code will say “781023”, and the BIGIP will be expecting code “826015”. I tested this with multiple different accounts and the same results all around. I’m wondering if Google just changed its algorithm a few years ago and the article became outdated, or if something in recent F5 versions has changed that changes the calculation algorithm. Has anyone done a recent implementation with this iRule without any issues? I quadruple-checked everything and added log entries to every part of the iRule. I know it’s being triggered correctly, but it’s just coming up with a different expected code than Google is. In that article, there are 2 comments by people with the same issue on 11.5, so at least I’m not alone 🙂 ---
**Author:** ![Binh\_Luong\_1782](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@Binh\_Luong\_1782](https://community.f5.com/u/Binh_Luong_1782)\ **Post date:** [March 3, 2015, 8:50pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/2 "2015-03-03T20:50:53Z")
We have the same issue since we upgraded to 11.6 from 11.3. Each time we load the config we see: “/Common/Google\_SoftToken\_Generator\_V3:33: warning: [use curly braces to avoid double substitution]” Maybe that’s the reason the code calculation is different. We couldn’t figure it out how to fix the code. So we just move Google Authenticator to another F5 box which is still on 11.3. I hope someone can look into the GA code and make it work for 11.6 otherwise we have to stop using it. My two cents. ---
**Author:** ![Arie](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Arie](https://community.f5.com/u/Arie)\ **Post date:** [March 4, 2015, 12:58am UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/3 "2015-03-04T00:58:51Z")
The error could be caused by the slight difference between the way 11.3 and 11.6 parse Tcl. In my experience it’s usually due to the use of the ```tcl expr ``` command. Here’s how I fixed one of the offending lines: Before: ```tcl HTTP::respond 301 Location "http://www.domain.org/blog/$DstPath/[expr ([string length [HTTP::query]]>0)?"?[HTTP::query]":""]" ``` After (note the added curly braces): ```tcl HTTP::respond 301 Location "http://www.domain.org/blog/$DstPath/[expr {([string length [HTTP::query]]>0)?"?[HTTP::query]":""}]" ``` ---
**Author:** ![Arie](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Arie](https://community.f5.com/u/Arie)\ **Post date:** [March 4, 2015, 1:03am UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/4 "2015-03-04T01:03:33Z")
Here’s another example: Before: ```tcl set cookie_expire_date [clock format [expr [clock seconds] + $cookie_expire] -format "%a, %d-%b-%Y %H:%M:%S GMT" -gmt true] ``` After: ```tcl set cookie_expire_date [clock format [expr {[clock seconds] + $cookie_expire}] -format "%a, %d-%b-%Y %H:%M:%S GMT" -gmt true] ``` ---
**Author:** ![Binh\_Luong\_1782](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@Binh\_Luong\_1782](https://community.f5.com/u/Binh_Luong_1782)\ **Post date:** [March 4, 2015, 1:44am UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/5 "2015-03-04T01:44:14Z")
Thanks Arie, I will give it a go and see if that will fix the issue. Cheers. ---
**Author:** ![Arie](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Arie](https://community.f5.com/u/Arie)\ **Post date:** [March 6, 2015, 7:36pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/6 "2015-03-06T19:36:53Z")
Any luck? ---
**Author:** ![Binh\_Luong\_1782](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@Binh\_Luong\_1782](https://community.f5.com/u/Binh_Luong_1782)\ **Post date:** [March 6, 2015, 9:30pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/7 "2015-03-06T21:30:38Z")
Hi Arie, No luck. I fixed all the expr with curly braces. But the F5 is expecting a different code than my Google code on the iPhone. Binh ---
**Author:** ![Arie](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Arie](https://community.f5.com/u/Arie)\ **Post date:** [March 6, 2015, 10:14pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/8 "2015-03-06T22:14:51Z")
Are you still seeing the errors when you verify the config? ---
**Author:** ![Binh\_Luong\_1782](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@Binh\_Luong\_1782](https://community.f5.com/u/Binh_Luong_1782)\ **Post date:** [March 6, 2015, 10:42pm UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/9 "2015-03-06T22:42:28Z")
Nope, no more errors using the curly braces. But the Google code is still wrong. As I don’t know the logic of the calculations, so not sure if the curly braces are correct are not. ---
**Author:** ![Sam\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Sam\_Hall](https://community.f5.com/u/Sam_Hall)\ **Post date:** [March 31, 2017, 6:20am UTC](https://community.f5.com/t/google-authenticator-irule-verification/18461/10 "2017-03-31T06:20:30Z")
I know this thread is old, but I just went through the same process trying to get the otp iRule working as normal without warnings. The problematic expr statements contain string concatenation used to generate hex values for bitwise operations. It wont work as expected if you simply wrap that in curly brackets, so I just break it up a little. For example this becomes this… ```tcl set o [expr 0x$k ^ 0x5C] set i [expr 0x$k ^ 0x36] ``` ```tcl set kh 0x$k set o [expr {$kh ^ 0x5C}] set i [expr {$kh ^ 0x36}] ```