I've taken a look, and when "/auth/otp/secret" is called the logged-in user's id is used to create the otp uri.

The loggedUser String is generated using in AeroGearCredentialImpl

Changing this to use the loginName works, but is probably not the correct thing to do here as the method says that it returns the id.

index 40bd6a4..d3836a4 100644
--- a/src/main/java/org/jboss/aerogear/security/picketlink/idm/AeroGearCredentialImpl.java
+++ b/src/main/java/org/jboss/aerogear/security/picketlink/idm/AeroGearCredentialImpl.java
@@ -46,7 +46,7 @@ public class AeroGearCredentialImpl implements AeroGearCredential {
     public String getId() {
         String id = null;
         if (identity.isLoggedIn()) {
-            id = identity.getUser().getId();
+            id = identity.getUser().getLoginName();
         }
         return id;
     }

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira