Skip to main content

SMS OTP

The SMS OTP Provider component is designed for user authentication with one-time passwords delivered to users via SMS.

A one-time password is a set of random characters (digits, special characters, and Latin letters). The password is generated on the Axidian Access server, then it is transmitted to the SMS gateway available in the customer infrastructure, after which the one-time code is sent to the user phone number. Data is transmitted through the SMPP (Short Message Peer-to-Peer) protocol.

SMS OTP can be used for authentication in the following modules:

Provider ID
{EBB6F3FA-A400-45F4-853A-D517D89AC2A3}

Prerequisites​

To use SMS OTP Provider, an SMS gateway is required. This gateway must be accessible from every Axidian Access server where SMS OTP Provider is to be installed.

To use the provider, the user must have a phone number specified in the default telephoneNumber attribute or in another configured attribute. Otherwise, the provider is not available for use.

Authenticator registration in the User Console is not required.

Install the provider​

  1. Run the installation file located at Axidian Access <version number>/Axidian Providers/Axidian SMS OTP Provider/Server/<version number> and follow the steps of the installation wizard.
Important

If several Core Servers are used in your infrastructure, install the provider on all the servers of the infrastructure.

If the provider is used in client scenarios with Windows Logon and ESSO Agent, install the provider on the client machines with the Axidian Access <version number>/Axidian Providers/Axidian SMS OTP Provider/Server/<version number>/Client/<Version number>/SMSOTP.Provider.msi file.

  1. After the installation is complete, a system restart may be required. If the installation wizard prompts you to restart the system, confirm this action.

  2. To remove or restore the product, open the Control panel menu and use the standard procedure for the supported operating systems.

Configure the phone number attribute​

To change the default attribute, add the following parameters to the server configuration file C:\inetpub\wwwroot\am\core\Web.config:

  • The userMapRules tag inside the adUserCatalogProvider tag
  • The adObjectMapRule tag inside the userMapRules tag with the following parameters:
    • attribute="Phone" — specifies the parameter that is changed
    • adAttribute="mobile" — specifies the Active Directory attribute that the value is taken from
  • The objectTypeSettings tag
  • The objectSetting tag with the category="person" class="user" parameters
Example
<adUserCatalogProvider id="userId" serverName="axidian.local" containerPath="DC=axidian,DC=local" userName="userAdmin" password="Q1q2E3e4">
                <userMapRules>
                        <adObjectMapRule attribute="Phone" adAttribute="mobile"/>
                    <objectTypeSettings>
                        <objectSetting category="person" class="user"></objectSetting>
                    </objectTypeSettings>
                </userMapRules>
        </adUserCatalogProvider>

Spam protection​

The spam protection mechanism is based on calculating the percentage of successful authentications relative to all sent messages over a specified time interval. The calculation process starts only if the number of sent messages exceeds the number that you have specified in the Evaluation Window setting.

When a spam attack is detected, further message sending is blocked for a specified period of time, and a "Potential spam attack detected" error occurs when attempting to log in.

Messages can be sent again either after the specified period expires or when a certain percentage of successful authentications is reached.

To configure spam protection, perform the following actions:

  1. In Management Console, in the Configuration→Authenticators section, select an authenticator.
  2. In the Spam Protection Settings section, configure the following settings:
    • Enable or disable spam protection.
    • In the Authentication attempts evaluation window field, specify the time period during which the percentage of successful login attempts is calculated.
    • In the Authentication attempts threshold window field, specify how many login attempts must be made during the time specified in the authentication attempts evaluation window.
    • In the Percentage of successful authentication attempts field, specify the minimum percentage of successful logins relative to all sent messages.
Example

The setting is enabled with the following values:

  • Authentication attempts evaluation window — 600
  • Authentication attempts threshold window — 20
  • Percentage of successful authentication attempts — 85

Spam protection is activated if 21 login attempts occur (21 messages sent). The authenticator will be blocked for 600 seconds.

The authenticator will be unblocked in one of the following cases:

  • the percentage of successful logins (user successfully entered the one-time password from the message) reaches 85;
  • 600 seconds have passed since the blocking.
Information

Log server events:

  • 2090: Potential spam attack detected. Message sending suspended.
  • 1118: Message sending to users resumed.
Additional settings

To select and configure the connection type, define the message and phone number format settings, and configure the one-time password settings, go to the group policies section.