I am attempting to get MFA to work with VFP. I have the QR code working fine and am able to get DUO to recognize the QR code and generate a pin for me. When I submit the pin and the secret code to the validate url, it returns FALSE every time.

Pairing code

lcApp = "MC"
lcUserName = "John_Smith"				&& Could be user full name for instance.
lcUserID = "0000000001"				&& Unique ID

PUBLIC gcApp, gcUserId, gcPassword, gcUserName, gcSecretCode
gcApp = lcApp
gcUserId = lcUserId
gcPassword = md5uniq("VFPMFA")
gcUsername = lcUserName
gcSecretCode = gcPassword + lcUserID

lcParingUrl = "https://www.authenticatorApi.com/pair.aspx" + "?AppName="+lcApp+"&AppInfo=My Application for_" + lcUserName + "&SecretCode=" + gcSecretCode

The gcPassword is a random value which works fine, for this run it is "VFPMFA_79P0FGRUO0000000001"

After the user enters the pin, I send the following. Assuming the '123456' is the code coming from DUO: "https://www.authenticatorApi.com/Validate.aspx?Pin=123456&SecretCode=VFPMFA_79P0FPCFB0000000001"

Is there something Im missing?

I notice that lcParingUrl contains spaces which is not allowed in a URL. Try this

lcParingUrl = StrTrans(lcParingUrl, ' ', '%20')