cancelAllTemporaryAllows resetUser getRulesData getActionCount

4-18 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager 5 Native API for OTP Challenge 5-1 5 Native API for OTP Challenge Oracle Adaptive Access Managers Native OTP API offers a way to add another factor to a traditional user namepassword authentication scheme. This chapter contains the following information: ■ OTP Integration Overview ■ OTP Registration and Challenge Experience ■ New User Registration ■ User OTP Challenge

5.1 OTP Integration Overview

Native OTP Challenge integration enables strong authentication for access to applications. The flow of interaction is as follows: When the User ID and password are successfully verified, if the application deems it to be necessary, a one time password is sent to the users mailbox or mobile phone. This one time password will be verified and only then will the user be authenticated to the application.

5.1.1 One Time Password OTP

One Time Password OTP is a random single use authentication credential. The OTP may be either numeric or alphanumeric and any length and the randomization algorithm is pluggable. The following are major benefits of using out-of-band OTP: ■ The one time password is delivered to the valid user through one of the configured channels. These can include SMS, IM, email or voice. ■ The user does not require any proprietary hardware or client software of any kind. Note: For information about administrative tasks you can perform for OTP such as resetting OTP profiles, unlocking users, viewing OTP case details, and viewing OTP performance data, see the Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager. Note: The application authenticates the OTP code given by the user through custom implementation. 5-2 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager

5.1.2 OAAM OTP Challenge Functionality

OAAM OTP challenge functionality allows the end user to register profile information for use as a communication channel subsequently to challenge the user if appropriate. The user is sent an email or SMS with a generated one time use password and presented with a challenge page in which he can enter the generated code. Oracle Adaptive Access Manager offers an OTP code generation API that can be used by native integration APIs.

5.1.3 Sample

A sample application, OAAM Sample, is available as a form of documentation to illustrate a native implementation of an Oracle Adaptive Access Manager integration. It includes registration and email challenge related flows that provide integrators with an example of how to use the OTP APIs for generating OTP code, incrementing the OTP challenge counter, and clearing the OTP challenge counter. OAAM Sample implements example flows using JSPs to both display pages generate code, and handle the user input of pages, backed by the BharosaHelper utility class to make calls into the OAAM APIs for tracking user details and challenge statistics.

5.2 OTP Registration and Challenge Experience

OAAM OTP challenge allows the end user to register profile information such as an email address or a mobile phone number or both for use as communication channel to challenge them. The user is sent an email or SMS with a generated one time use password and presented with a challenge page in which they can enter the generated code. The registration and challenge flows are presented in Section 5.3, New User Registration and Section 5.4, User OTP Challenge.

5.3 New User Registration

Registration is the enrollment process, the opening of a new account, or other event where information is obtained from the user. During the Registration process, the user is asked to register for questions, image, phrase and OTP email, phone, and so on if the deployment supports OTP. Once successfully registered, OTP can be used as a secondary authentication to challenge the user. The login process begins with entering standard user name and password credentials. During a session, if the user is OTP-challenged, a single-use password is delivered to the user through the configured delivery channel he selected. The user retrieves the one-time password, then enters it. In a new registration flow which include OTP: ■ User Name Entered on Login Page ■ Password Page is Presented and User Enters Password ■ User Enters Registration Flow Note: Oracle Adaptive Access Manager ships with oaam_native_lib. war which must be deployed to run OAAM Sample.