Email OTP

The Email OTP Provider component is designed for user authentication with one-time passwords delivered to users by email.

A one-time password is a set of random characters (digits, special characters, and Latin letters). The password is generated on the Axidian Access server, then it is transmitted to the email delivery service, which forwards it to the user as an email message. Data is transmitted through the SMTP (Simple Mail Transfer Protocol) protocol.

Email OTP can be used for authentication in the following modules:

• ADFS Extension
• Enterprise SSO
• Identity Provider
• IIS Extension
• NPS RADIUS Extension
• RDP Windows Logon
• Windows Logon

Provider ID

{093F612B-727E-44E7-9C95-095F07CBB94B}

Prerequisites

To use Email OTP Provider, an email server is required. This server must be accessible from every Axidian Access server where Email OTP Provider is to be installed.

To use the authenticator, the user must have an email address specified in the mail attribute. Otherwise, the authenticator is not available for use.

Authenticator registration in the User Console is not required.

Install the provider

1. Run the installation file located at Axidian Access <version number>/Axidian Providers/Axidian Email OTP Provider/Server/<version number> and follow the steps of the installation wizard.
2. After the installation is complete, a system restart may be required. If the installation wizard prompts you to restart the system, confirm this action.
3. To remove or restore the product, open the Control panel menu and use the standard procedure for the supported operating systems.

Configure the email attribute

To change the default attribute, add the following parameters to the server configuration file C:\inetpub\wwwroot\am\core\Web.config:

• Add the userMapRules tag inside the adUserCatalogProvider tag.
• Add the adObjectMapRule tag inside the userMapRules tag with the following parameters:
  • attribute="Email" — specifies the parameter that is changed
  • adAttribute="otherMailbox" — specifies the Active Directory attribute that the value is taken from
• Add the objectTypeSettings tag.
• Add the objectSetting tag with the category="person" class="user" parameters.

Example

<adUserCatalogProvider id="userId" serverName="axidian.local" containerPath="DC=axidian,DC=local" userName="userAdmin" password="Q1q2E3e4">
                <userMapRules>
                        <adObjectMapRule attribute="Email" adAttribute="otherMailbox"/>
                    <objectTypeSettings>
                        <objectSetting category="person" class="user"></objectSetting>
                    </objectTypeSettings>
                </userMapRules>
        </adUserCatalogProvider>

SMTP server settings

To work with the SMTP server, configure the group policy.

Block the authenticator

To block the authenticator:

1. In the Management Console, go to Configuration → Authenticators and select the Email OTP authenticator from the list.
2. In the Authenticator blocking settings section, configure the following:
   • Allow or block the use of Email OTP in case of a series of failed authentication attempts.
   • In the Number of authentication attempts before blocking field, specify how many times the user can fail authentication before the authentication method is blocked.
   • In the Blocking counter reset field, specify how many minutes must pass after a failed authentication attempt before the counter is reset.
   • In the Timeout before the sign-in method is unblocked field, specify after how many minutes the blocked authentication method becomes available again.

One-time password settings

The settings are applied to the Axidian Access servers and allow you to define the length of the one-time password and the character groups it contains.

To configure the one-time password generation:

1. In the Management Console, go to Configuration → Authenticators and select the Email OTP authenticator from the list.
2. In the One-time password generation settings section, configure the following:
   • In the One-time password length field, specify how many characters the one-time password contains.
   • In the Digits setting, specify whether the one-time password contains digits.
   • In the Lowercase Latin letters setting, specify whether the one-time password contains lowercase Latin letters.
   • In the Uppercase Latin letters setting, specify whether the one-time password contains uppercase Latin letters.
   • In the Special characters setting, specify whether the one-time password contains special characters.

Spam protection

The spam protection mechanism is based on calculating the percentage of successful authentications relative to all sent messages over a specified time interval. The calculation process starts only if the number of sent messages exceeds the number that you have specified in the Evaluation Window setting.

When a spam attack is detected, further message sending is blocked for a specified period of time, and a "Potential spam attack detected" error occurs when attempting to log in.

Messages can be sent again either after the specified period expires or when a certain percentage of successful authentications is reached.

To configure spam protection, perform the following actions:

1. In Management Console, in the Configuration→Authenticators section, select an authenticator.
2. In the Spam Protection Settings section, configure the following settings:
   • Enable or disable spam protection.
   • In the Authentication attempts evaluation window field, specify the time period during which the percentage of successful login attempts is calculated.
   • In the Authentication attempts threshold window field, specify how many login attempts must be made during the time specified in the authentication attempts evaluation window.
   • In the Percentage of successful authentication attempts field, specify the minimum percentage of successful logins relative to all sent messages.

Example

The setting is enabled with the following values:

• Authentication attempts evaluation window — 600
• Authentication attempts threshold window — 20
• Percentage of successful authentication attempts — 85

Spam protection is activated if 21 login attempts occur (21 messages sent). The authenticator will be blocked for 600 seconds.

The authenticator will be unblocked in one of the following cases:

• the percentage of successful logins (user successfully entered the one-time password from the message) reaches 85;
• 600 seconds have passed since the blocking.

Information

Log server events:

• 2090: Potential spam attack detected. Message sending suspended.
• 1118: Message sending to users resumed.