Skip to main content

Storage SMS OTP

If you use Microsoft SQL as the Axidian Access data storage, you can use Storage SMS OTP Provider. This provider allows you to store, retrieve, and update the phone numbers of the Axidian Access users in the database. The phone numbers are stored in encrypted form.

Storage SMS OTP Provider can be used for authentication in the following modules:

Provider ID
{3F2C1156-B5AF-4643-BFCB-9816012F3F34}

Prerequisites​

To use Storage SMS OTP Provider, an SMS gateway is required. This gateway must be accessible from every Axidian Access server where Storage SMS OTP Provider is to be installed.

Install the provider​

  1. Run the installation file located at Axidian Access <version number>/Axidian Providers/Axidian Storage SMS OTP Provider/Server/<version number> and follow the steps of the installation wizard.

    Note

    If the provider is used in client scenarios with Windows Logon and ESSO Agent, install the provider on the client machines with the Axidian Access <version number>/Axidian Providers/Axidian Storage SMS OTP Provider/Client/<Version number>/SMSOTP.Provider.msi file.

  2. After the installation is complete, a system restart may be required. If the installation wizard prompts you to restart the system, confirm this action.

  3. To remove or restore the product, open the Control panel menu and use the standard procedure for the supported operating systems.

Register the provider​

We recommend that you register the provider through the lightweight version of the Phone Management Server API, which is designed specifically to work with Storage SMS OTP Provider. You can also use the main Axidian Access API.

Spam protection​

The spam protection mechanism is based on calculating the percentage of successful authentications relative to all sent messages over a specified time interval. The calculation process starts only if the number of sent messages exceeds the number that you have specified in the Evaluation Window setting.

When a spam attack is detected, further message sending is blocked for a specified period of time, and a "Potential spam attack detected" error occurs when attempting to log in.

Messages can be sent again either after the specified period expires or when a certain percentage of successful authentications is reached.

To configure spam protection, perform the following actions:

  1. In Management Console, in the Configuration→Authenticators section, select an authenticator.
  2. In the Spam Protection Settings section, configure the following settings:
    • Enable or disable spam protection.
    • In the Authentication attempts evaluation window field, specify the time period during which the percentage of successful login attempts is calculated.
    • In the Authentication attempts threshold window field, specify how many login attempts must be made during the time specified in the authentication attempts evaluation window.
    • In the Percentage of successful authentication attempts field, specify the minimum percentage of successful logins relative to all sent messages.
Example

The setting is enabled with the following values:

  • Authentication attempts evaluation window — 600
  • Authentication attempts threshold window — 20
  • Percentage of successful authentication attempts — 85

Spam protection is activated if 21 login attempts occur (21 messages sent). The authenticator will be blocked for 600 seconds.

The authenticator will be unblocked in one of the following cases:

  • the percentage of successful logins (user successfully entered the one-time password from the message) reaches 85;
  • 600 seconds have passed since the blocking.
Information

Log server events:

  • 2090: Potential spam attack detected. Message sending suspended.
  • 1118: Message sending to users resumed.
Additional settings

To configure the SMS delivery service, as well as the message and one-time password format, go to the group policies section.