Previous Topic Next Topic

Custom TOTP authenticator

Using this method, admins can configure any TOTP authenticator for identity verification. ADSelfService Plus supports two types of TOTP tokens for authentication:

• Software TOTP token: Mobile or desktop applications that generate a time-based OTP based on the secret key provided by ADSelfService Plus during enrollment. These tokens can either be enrolled by the user through self enrollment or by the admin through bulk enrollment.
• Hardware TOTP token: Hardware devices that generate a time-based OTP based on the secret key burned into the hardware device. A seed file consisting of secret keys for the respective hardware devices will be provided by hardware vendors. These tokens can be enrolled only by the admin through bulk enrollment.

Steps to configure custom TOTP authenticators

1. Navigate to Configuration > Self-Service > Multi-factor Authentication > Authenticators Setup.
2. From the Choose the Policy drop-down, select a policy.

Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy.

3. Click Custom TOTP Authenticator section.
4. Enter the Authenticator Name, Passcode Length, Passcode Expiration Time, Passcode Hashing Algorithm, Account Name Format and upload the Authenticator Logo.
5. Choose either Software Token or Hardware Token based on the type of token you wish to configure.

Note: If the Authenticator Logo is not uploaded, a default logo will be used.

6. Click Save.

Step to enroll for custom TOTP authenticators

1. Software tokens can be enrolled either by the user through self-enrollment or by admins through bulk enrollment (importing data via a CSV file or by fetching data from an external database).
2. You can enroll for hardware tokens using two methods:
• By importing data via a CSV file
• By fetching data from an external database

Note: In case of using programmable tokens which allow the user to generate a secret key without admin intervention, it is recommended to configure custom TOTP authenticator as a software token.

To modify the configuration:

1. Navigate to Configuration > Self-Service > Multi-factor Authentication > Authenticators Setup.
2. Click Custom TOTP Authenticator section.
3. Click Modify and change the information provided wherever necessary.
4. If the configuration has to be removed, click Remove Configuration.
5. Click Save.

Previous Topic Next Topic