The password to encrypt the shared secret of each users OATH OTP token.

Configure which persister is used to store token information.

Active Directory Connector Cipher Credential Persister Database Credential Persister Dummy Credential Persister LDAP Connector LDAP Credential Persister Property Credential Persister Static Credential Persister

This property defines if we use time based one time passwords (TOTP), or HMAC based one time passwords (HOTP). HOTP uses an incrementing counter; each OTP is generated on the client by an explicit request, as pressing a button, which will increment the counter on client side. TOTP uses time slots instead of counters.

More formal:
hotp := truncate(secureHash(sharedSecret, counter))
totp := truncate(secureHash(sharedSecret, time_slot))

We implement HOTP as defined in RFC 4226 and for TOTP we follow the draft standard http://www.ietf.org/id/draft-mraihi-totp-timebased-06.txt).

The default is TOTP.

OATH OTP Event-based Challenge Handler OATH OTP Time-based Challenge Handler

Defines the label pattern for the OTP generator. The label identifies which account a key is associated with. It consists of an account name, optionally prefixed by an issuer. The issuer prefix helps prevent collisions between accounts from different providers.

Recommended format: ${issuer}: ${accountName} (e.g. resolving to, My Company: alice@example.com).

The pattern allows referencing variables using the following notation ${} The following variables are supported:

• ${issuer}: Resolved from 'Issuer Context Data Property' falling back to the value defined by the 'Default Issuer' property in case the referenced context data is missing.
• ${accountName}: Resolved from 'Account Name Context Data Property' falling back to the user's 'username' (from the medusa_user table) in case the referenced context data is missing.
• Any context data property name (e.g., ${email}). Compared to the ${issuer} and ${accountName} variables, these do not have a fallback. So in order for something to be displayed, make sure the referenced context data contains a value. Additionally, make sure the context data property is provided by the configured credential persister.

Assumptions for the following examples:

• Default Issuer Property: My Company
• Account Name Context Data Property: email
• Username (fallback for missing accountName): f39286da-23a0-473d-986b-319741df785d (UUIDv4)

Examples:

• Pattern: ${issuer}: ${accountName} (default)
  • With existing e-mail -> My Company: alice@example.com
  • With missing e-mail -> My Company: f39286da-23a0-473d-986b-319741df785d

Note: Colons (':') are reserved characters in OATH URI labels for separating the issuer from the account name. To avoid issues with authenticator apps, Airlock IAM will automatically remove any colons from the issuer and accountName them during label generation.
In the above example, assume the email would be alice:1@example.com, then the generated label would be My Company: alice1@example.com.

${issuer}: ${accountName}

The name of a context data property used to resolve the ${issuer} variable in the 'Label Pattern'. Resolves the variable from the user's attributes (e.g., company).

Fallback: If this property is not defined or the referenced context data value is blank, 'Default Issuer' is used.

Note: Make sure the context data property is provided by the configured credential persister.

company

instance_id

Static fallback value for the ${issuer} variable in the 'Label Pattern'. Used if 'Issuer Context Data Property' is missing or resolves to a blank value.

Airlock

If enabled, the issuer is included as a separate URI parameter in the QR code URL.

This is recommended for better compatibility with modern OTP generator apps.

true

The name of a context data property used to resolve the ${accountName} variable in the 'Label Pattern'. Resolves the variable from the user's attributes (e.g., email).

Fallback: If this property is not defined or the referenced context data value is blank, the user's 'username' (from the medusa_user table) is used.

Note: Make sure the context data property is provided by the configured credential persister.

contractNumber

email

Defines the length (number of decimal digits) of the one time password.

6

If enabled, OATH OTP may be selected as active authentication method in the admin tool.

true

If enabled, OATH OTP may be selected as the next (migration) authentication method.

true

Set to false to hide the button in the Adminapp.
Using this button, the administrator can reset the time offset (for time-based OATH OTP) or increase the counter-value (event-based OATH OTP) in order to manually re-synchronize the token with the server.

true

Set to false to hide the activation letter attributes, e.g. generation date.

true

Set to false to hide the QR code (2d-barcode) in the Adminapp.
The QR code allows admins to transfer the token key more easily to a compatible mobile app. This also eases "cloning" the OTP generator!

true

Set to true to show the secret in HEX-code (hexa-decimal representation of the token key) in the Adminapp.
The HEX representation allows admins to transfer the token key to a mobile app. This also allows "cloning" the OTP generator!

false

Set to false to hide the secret in Base 32 in the Adminapp used by some mobile apps. The Base 32 representation allows admins to transfer the token key to a mobile app. This also allows "cloning" the OTP generator!

true