One Time Password OTP

5-2 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager

5.1.2 OAAM OTP Challenge Functionality

OAAM OTP challenge functionality allows the end user to register profile information for use as a communication channel subsequently to challenge the user if appropriate. The user is sent an email or SMS with a generated one time use password and presented with a challenge page in which he can enter the generated code. Oracle Adaptive Access Manager offers an OTP code generation API that can be used by native integration APIs.

5.1.3 Sample

A sample application, OAAM Sample, is available as a form of documentation to illustrate a native implementation of an Oracle Adaptive Access Manager integration. It includes registration and email challenge related flows that provide integrators with an example of how to use the OTP APIs for generating OTP code, incrementing the OTP challenge counter, and clearing the OTP challenge counter. OAAM Sample implements example flows using JSPs to both display pages generate code, and handle the user input of pages, backed by the BharosaHelper utility class to make calls into the OAAM APIs for tracking user details and challenge statistics.

5.2 OTP Registration and Challenge Experience

OAAM OTP challenge allows the end user to register profile information such as an email address or a mobile phone number or both for use as communication channel to challenge them. The user is sent an email or SMS with a generated one time use password and presented with a challenge page in which they can enter the generated code. The registration and challenge flows are presented in Section 5.3, New User Registration and Section 5.4, User OTP Challenge.

5.3 New User Registration

Registration is the enrollment process, the opening of a new account, or other event where information is obtained from the user. During the Registration process, the user is asked to register for questions, image, phrase and OTP email, phone, and so on if the deployment supports OTP. Once successfully registered, OTP can be used as a secondary authentication to challenge the user. The login process begins with entering standard user name and password credentials. During a session, if the user is OTP-challenged, a single-use password is delivered to the user through the configured delivery channel he selected. The user retrieves the one-time password, then enters it. In a new registration flow which include OTP: ■ User Name Entered on Login Page ■ Password Page is Presented and User Enters Password ■ User Enters Registration Flow Note: Oracle Adaptive Access Manager ships with oaam_native_lib. war which must be deployed to run OAAM Sample. Native API for OTP Challenge 5-3 ■ User Continues into Application

5.3.1 User Name Entered on Login Page

The user is presented with a page in which he is asked to submit his user name. The user name login ID is accepted from the first page and stored in the HTTP session. The user name page is followed by a transient page for capturing the flash and secure cookies and for fingerprinting the device. For information on the JSPs, BharosaHelper utility class, and OAAM APIs used in this flow, refer to the following sections: ■ User Name Page S1 ■ Device Fingerprint Flow F1 ■ Run Pre-Authentication Rules R1

5.3.2 Password Page is Presented and User Enters Password

The password page is displayed. The user fills in the password and clicks the Enter button on the device. Oracle Adaptive Access Manager verifies the users password. For information on the JSPs, BharosaHelper utility class, and OAAM APIs used in this flow, refer to the following sections: ■ Run Virtual Authentication Device Rules R2 ■ Decode Virtual Authentication Device Input P4 ■ Validate User and Password CP1 ■ Run Post-Authentication Rules R3 ■ Check Registration for User C2 ■ Run Registration Required Rules R4 ■ Enter Registration Flow P6

5.3.3 User Enters Registration Flow

The user will continue through the registration process.

5.3.3.1 User selects an authentication pad background image

The user selects an anti-phishing image and phrase.

5.3.3.2 User registers challenge questions

The user selects challenge questions and enters the answers to those questions.

5.3.3.3 User Opts In to OTP

He agrees to register his profile for OTP challenge

5.3.3.4 User registers profile information

The user enters his profile information in profile registration page. The users contact information, such as mobile phone number and email address, is registered.