OTP Token Generators¶
The OTP Token Generators module declares the one-time password generators offered to users when they authenticate. Each entry picks an OTP Type — the delivery channel and the provider — and fills in the connection settings of the matching service.
This page is aimed at an administrator preparing the OTP infrastructure of the tenant. For a token to actually be used at sign-in, it must then be associated with an identity provider.
OTP token list¶
The module opens on a paginated grid of the declared tokens.
| Column | Description |
|---|---|
| Name | Token name, preceded by the OTP icon. |
| Type | OTP type picked at creation. |
| Description | Free description entered at creation. |
Actions in the toolbar:
| Action | Description |
|---|---|
| + (Add) | Opens the Add OTP token window. |
| Edit | Opens the Edit OTP token window for the selected token, also on a double-click. Enabled on a single selection. |
| × (Delete) | Deletes the selected tokens after confirmation. Multiple selection is supported. |
| Search | Filters on a substring. |
| Pagination | 15, 25 or 50 rows per page. |
The 21 available OTP types¶
The OTP Type list, whose hint reads Choose an OTP manager, offers 21 entries. Their label states the channel then the provider: SMTP means an SMS handed to the operator by email, HTTP or HTTPS an SMS handed over by web call.
| OTP Type | Channel | Settings section |
|---|---|---|
| OTP - email | Mail subject | |
| TOTP (Google authenticator, FreeOTP, ...) | Authenticator application | see the TOTP tab |
| OTP - Radius | Radius server | see the Radius tab |
| OTP - SMS (SMTP: OVH) | SMS by email | see the SMS by email tab |
| OTP - SMS (SMTP: Orange) | SMS by email | no specific field |
| OTP - SMS (SMTP: SFR) | SMS by email | see the SMS by email tab |
| OTP - SMS (SMTP: esendex) | SMS by email | see the SMS by email tab |
| OTP - SMS (SMTP: LeSMS) | SMS by email | see the SMS by email tab |
| OTP - SMS (SMTP: smsenvoi) | SMS by email | see the SMS by email tab |
| OTP - SMS (SMTP: Clever SMS) | SMS by email | see the SMS by email tab |
| OTP - SMS (HTTP: OVH) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTPS: Orange) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTPS: Orange Light CEO) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTPS: SFR) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTPS: esendex) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTP(s): smsenvoi) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTP: SmsBox) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTP: LeSMS) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTPS: CallR) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTP: envoyerSMS) | SMS by web call | see the SMS by web call tab |
| OTP - SMS (HTTPS: MiPih) | SMS by web call | see the SMS by web call tab |
The type determines which sections appear
Picking a type recomposes the form: the provider's own section appears and the others go away. Three rules govern the rest:
- the generic block (section Generic block) appears for every type except TOTP and Radius;
- the Authentication through a site block (section Routing through a site) appears for the web call types and for Radius;
- the email delivery block (section Email delivery) appears for the email types and for TOTP.
Add an OTP token¶
Common fields¶
| Field | Description |
|---|---|
| OTP Type | Mandatory. See section The 21 available OTP types. Cannot be changed once saved. |
| Name | Mandatory, 50 characters at most. Allowed characters: unaccented letters, digits, é, è, à, ô, â, parentheses, space, -, /, . and _. |
| Description | Free text. |
Generic block¶
Displayed for every type except TOTP and Radius, which produce their code differently.
| Field | Description |
|---|---|
| OTP usable characters | Alphabet used to draw the code. abcdefghijklmnopqrstuvwxyz by default, 5 characters minimum. |
| OTP Length | Number of characters of the code. Minimum 4, default 8. |
| Validity period of a token (seconds) | Minimum 15, default 900. |
| Number of sent authentication tokens | Read-only counter. The Reset button sets it back to zero on the server side. |
| Message before the OTP | Text preceding the code in the message. Your password is: by default. The field exists twice with the same label: one for the email types, one for all the others; only the one matching the chosen type is displayed. |
Routing through a site¶
| Field | Description |
|---|---|
| Authentication through a site | Ticked by default. Makes the calls to the provider leave from a given site. |
| (site list) | Mandatory if the checkbox is ticked. |
Email delivery¶
| Field | Description |
|---|---|
| SMTP sender | Sender address, checked as an email address. This field does not appear for the OTP - SMS (SMTP: smsenvoi) type. |
| SMTP server | Mandatory. Server declared in the SMTP servers module. |
For TOTP, these two fields start out inactive
With the TOTP type, SMTP sender and SMTP server stay disabled until the Send generated keys by e-mail option is ticked. Filling them is therefore not a prerequisite: it is that option which unlocks them.
Type-specific settings¶
| Field | Description |
|---|---|
| Expiration Time | Validity period of a code, in seconds. 30 by default. |
| Number of digits | Length of the code. The list only offers the value 6. |
| Key size (bits) | 64, 32 or 16. 32 by default. |
| Read the secret key in a user attribute (LDAP domain) | The secret key is read from an attribute of the account instead of being generated. Unlocks the next field. |
| User attribute containing the secret key | Name of the attribute. secretKey by default. |
| Display a QR Code on the user portal | The user enrols their application by photographing a QR code. |
| Send generated keys by e-mail | The key is sent by email. Unlocks the next two fields as well as section Email delivery. |
| Message before the OTP | Text of the key delivery message. |
| Mail subject | Subject of that message. |
One exclusion, not three
Ticking Display a QR Code on the user portal or Send generated keys by e-mail unticks and disables reading from a user attribute — a key cannot both be imposed by the directory and generated by the platform. The QR code and the email delivery, however, can be kept together: they are two ways of handing over the same generated key.
This type is the one that replaces the former SecurID token: the console now displays it as OTP - Radius.
| Field | Description |
|---|---|
| Server | Mandatory. Main Radius server. |
| Secondary server | Backup server. Optional. |
| Port | Mandatory. 1812 by default. |
| Timeout (seconds) | Mandatory. How long to wait for an answer. 10 by default. |
| Retries number | Mandatory. 2 by default. |
| Shared secret | Mandatory. Secret shared with the Radius server. |
| Push mode | The user confirms the sign-in from their application instead of typing a code. |
| NAS IP address | Mandatory, in strict IPv4 format. Address declared on the Radius server side. |
| Type | Own fields |
|---|---|
| OTP - SMS (SMTP: OVH) | SMS Account, SMS ID, Password, SMS sender (prefixed +33), SMS Class (0 to 3, 1 by default). |
| OTP - SMS (SMTP: Orange) | No own field: only the generic and email delivery blocks apply. |
| OTP - SMS (SMTP: SFR) | Destination email address, Service ID, Space ID, Broadcast name, Script ID, Call schedule ID, Maximum number of simultaneous contacts, Priority, Customized ID, Multimedia type. |
| OTP - SMS (SMTP: esendex) | Account ID, Account Password, Account Reference. |
| OTP - SMS (SMTP: LeSMS) | Password. |
| OTP - SMS (SMTP: smsenvoi) | Account ID, API Key, SMS Type (LOWCOST, STANDARD by default, PREMIUM, CONCATENE), Sender name (PREMIUM), Get a response (ticked by default). |
| OTP - SMS (SMTP: Clever SMS) | Start TLS, Put the number in the recipient of the email, Client ID, Modify the domain in the email recipient. ⓘ The last two exclude each other: ticking the number in the recipient unlocks the domain and disables the client ID. |
| Type | Own fields |
|---|---|
| OTP - SMS (HTTP: OVH) | Service Name, ID, Application Key, Application secret key, Consumption Key, Priority (Very low, Low, Normal by default, High), No stop clause (ticked by default), OVH Account Sender, Phone Prefix (33 by default). |
| OTP - SMS (HTTPS: Orange) | ID client, ID, Account Password. |
| OTP - SMS (HTTPS: Orange Light CEO) | Authentication Token, From, Label of diffusion, Allow the usage of special characters. |
| OTP - SMS (HTTPS: SFR) | Service ID, Service Password, Space ID. |
| OTP - SMS (HTTPS: esendex) | Account Reference, ID, Password. |
| OTP - SMS (HTTP(s): smsenvoi) | Account ID, API Key, SMS Type (LOWCOST, STANDARD by default, PREMIUM, CONCATENE), Sender name (PREMIUM), White label (optional), Use SSL (ticked by default). |
| OTP - SMS (HTTP: SmsBox) | ID, Password. |
| OTP - SMS (HTTP: LeSMS) | ID, Password. |
| OTP - SMS (HTTPS: CallR) | ID, Password, Flash Message, Sender. |
| OTP - SMS (HTTP: envoyerSMS) | API Key. |
| OTP - SMS (HTTPS: MiPih) | Establishment ID, Application code, Function code. |
Click Validate to save.
Edit an OTP token¶
Select a token and click the Properties icon, or double-click the row. The Edit OTP token window offers the same fields, the OTP Type becoming read-only: changing channel means creating another token.
Delete an OTP token¶
Select one or more tokens and click the × button. A confirmation is requested. Multiple selection is supported.
Check the domains before deleting
Deleting a token does not detach the identity providers that use it. Check the matching configurations first.