Configuring the Challenge Question Answer Validation

9 Setting Up OTP Anywhere 9-1 9 Setting Up OTP Anywhere OTP Anywhere is a secondary risk-based challenge solution consisting of a server generated one time password delivered to an end user via a configured out of band channel. Supported OTP delivery channels include short message service SMS, email, instant messaging and voice. OTP Anywhere can be used to compliment KBA challenge or instead of KBA. As well both OTP Anywhere and KBA can be used alongside practically any other authentication type required in a deployment. Oracle Adaptive Access Manager also provides a challenge processor framework. This framework can be used to implement custom risk-based challenge solutions combining third party authentication products or services with OAAM real-time risk evaluations. This chapter focuses on setting up Oracle Adaptive Access Manager to use OTP for secondary, risk-based user challenges. Out of the box, OAAM provides User Messaging Service UMS as the delivery method. For other custom methods, refer to the Developing Custom Challenge Types chapter of the Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager.

9.1 Introduction and Concepts

This section introduces you to the concept of One Time Password OTP and how it is used in Oracle Adaptive Access Manager.

9.1.1 What is a One Time Password

A one-time password is a randomly generated, single-use authentication credential. OTP is a form of secondary authentication that is used in addition to standard user name and password credentials to strengthen the existing authentication and authorization process, thereby providing additional security for users. When the user is OTP-challenged, a one-time password is generated and delivered to the user through one of the configured channels. The user must retrieve the one-time password and enter it when prompted, before the one-time password expires. The one-time password may be either numeric or alphanumeric and any configured length and the randomization algorithm is pluggable. The following are major benefits of using out-of-band OTP: ■ The one time password is delivered to the valid user through one of the configured channels. These can include SMS, IM, email or voice. ■ The user does not require any proprietary hardware or client software of any kind. 9-2 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

9.1.2 About Out-of-Band OTP Delivery

Oracle Adaptive Access Manager 11g contains one time password authentication capabilities that support delivery of the OTP via the following four out-of-band channels: ■ email ■ SMS ■ voice messaging ■ instant messaging By default, only cell phone registration is displayed on the OTP Registration page. 9.1.3 How Does OTP Work? During the Registration process in OAAM, the user is asked to register for questions, image, phrase and OTP email, phone, and so on if the deployment supports OTP. Once successfully registered, OTP can be used as a secondary authentication to challenge the user. The administrator can enable the OTP if the deployment supports OTP. The login process begins with entering standard user name and password credentials. During a session, for example, when the user is making a large transaction, if the user is OTP-challenged, the password is delivered to the user through the configured delivery channel. The user retrieves the one-time password, then enters it. If the correct answer is provided, the user is directed to continue with the operation. If the user answers incorrectly, he is allowed other attempts until he either answers correctly or is locked out of his account after a certain number of failures. By default, the user is allowed three attempts to provide the correct answer.

9.1.4 OTP Failure Counters

The failure counter is incremented when the user supplies an incorrect answer during an OTP-challenge. OTP failures are counted across sessions. Whether the user is locked out after a number of successive OTP failures or needs to try providing the OTP again depends on the failure counter value, the maximum number for OTP challenges set by the administrator. When the failure counter exceeds this value, the user is OTP Locked with no further opportunity for another attempt to answer. If the user is OTP-locked, he can call the Customer Service Representative to become unlocked. When the correct OTP is provided by the user, the failure counter is reset to 0 and the user is allowed to proceed with the operation.

9.2 Challenge Type

The challenge type is the delivery channel used to send an OTP to the user. For example, policies can challenge using OTP via the challenge type email, SMS, IM, or Voice.