User Opts In to OTP

5-4 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager

5.3.3.5 User Agrees to Terms and Conditions

User agrees to the terms and conditions presented on the registration page.

5.3.4 User Continues into Application

The user continues on to the application.

5.4 User OTP Challenge

An OTP challenge is when the user is asked to provide the OTP as a form of authentication for risk situations based upon configured policies. The user must enter the correct OTP in to the Web interface to proceed with the operation. In the challenge flow which includes OTP: ■ User Name Entered on Login Page ■ Password Page is Presented and User Enters Password ■ OAAM Rules Determine User Should Be Challenged via OTP ■ User Continues Into the Application

5.4.1 User Name Entered on Login Page

The user is presented with a page in which he is asked to submit his user name. The user name login ID is accepted from the first page and stored in the HTTP session. The user name page is followed by a transient page for capturing the flash and secure cookies and for fingerprinting the device. For information on the JSPs, BharosaHelper utility class, and OAAM APIs used in this flow, refer to the following sections: ■ User Name Page S1 ■ Device Fingerprint Flow F1 ■ Run Pre-Authentication Rules R1

5.4.2 Password Page is Presented and User Enters Password

The password page is displayed. The user fills in the password and clicks the Enter button on the device. Oracle Adaptive Access Manager verifies the users password. For information on the JSPs, BharosaHelper utility class, and OAAM APIs used in this flow, refer to the following sections: ■ Run Virtual Authentication Device Rules R2 ■ Decode Virtual Authentication Device Input P4 ■ Validate User and Password CP1

5.4.3 OAAM Rules Determine User Should Be Challenged via OTP

The custom policies returns Challenge as an action, and the Challenge checkpoint determines that OTP is the type of challenge to be used. For information on the JSPs, BharosaHelper utility class, and OAAM APIs used in this flow, refer to the following sections: