Skip to main content

Software OTP

Authentication parameter settings​

Before configuring the group policy, add the Axidian Access policy templates to the list of administrative templates. The policy template files are included in the provider distribution and are located in the Misc folder.

Note

Configuring the policies is required to increase the security level. However, Software OTP Provider works properly with the default policy values as well.

  • One-time password length — the policy defines the number of digits in the one-time password. You can set the value 6 or 8. If the policy is not defined, the value 6 is used by default.

    Important

    When using Software OTP Provider in scenarios with the Enterprise Single Sign-On and Windows Logon modules, only a six-digit password is currently supported.

  • One-time password validity period — the policy defines the minimum validity period of the one-time password at registration. The period is set as an integer from 3 to 18, where 3 corresponds to a time interval of 30 seconds (+/- 15 seconds). If the policy is not defined, the value 6 is used by default.

  • Minimum PIN length — the policy allows you to set the minimum number of characters the PIN must consist of. The allowed range is from 4 to 25 characters.

  • Name format — the policy allows you to set a user parameter as the name of the OTP account that is transmitted in the QR code. Possible parameters:

    • CanonicalName
    • CN
    • DistiguishedName
    • FullName
    • Mail
    • PrincipalName
    • SamCompatibleName
Note

The policy is applied to the servers with Management Console installed. If the policy has not been applied, the username is used as the OTP account name.

Encryption algorithm settings​

In Axidian Access 8.2 and higher, you can set the encryption algorithm for Software OTP Provider. If the encryption algorithm is not set, the value SHA1 is used by default. You can perform the configuration either in Group Policy Editor or in Windows Registry Editor.

  1. Open Registry Editor on the machine where Management Console and User Console are deployed.

  2. Open the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\BSPs section and select or create the GoogleOTP section.

  3. Create the SecretLength parameter of the DWORD type and specify one of the following values in the decimal system:

    • 20 — for the SHA1 algorithm
    • 32 — for the SHA256 algorithm
    • 64 — for the SHA512 algorithm