One-Time Password Authentication Administration Guide

Types of Passcodes

To use OTP authentication, you have to configure how the one-time password (passcode) is generated and provided to your users. You can configure authentication with the following types of passcodes:

Passcode generated by an authenticator mobile application

This configuration is possible if users can install an authenticator application on their mobile devices. For more information, see Configuring Authentication with a Passcode Generated by an Authenticator App
Random passcode sent by SMS, e-mail, or another channel

This configuration is for users who cannot install an authenticator mobile application. The passcode can be sent to the users by SMS or e-mail. For more information about this configuration, see Configuring Authentication with a Random Passcode Sent by SMS, E-Mail, or Another Channel.
External passcode generated by a third-party passcode provider

This configuration is for passcodes from a third-party provider (for example, RSA SecureID passcodes) that need to be validated before the user is authenticated. For authentication with these passcodes, developers have to implement a policy script written in JavaScript. For more information about this configuration, see Configuring External Passcode Validation.

Operations in SAP NetWeaver Administrator

You access SAP NetWeaver Administrator at http://<host>:<port>/nwa and can use it for the following operations:

Operation	Reference
Setting OTP-related login modules	Configuring TOTPLoginModule and RBALoginModule
Specifying OTP roles, groups, or users	Assigning Principals to UME Roles or Groups
Configuring passcode provisioning for users with unsupported mobile devices	Configuring Authentication with a Random Passcode Sent by SMS, E-Mail, or Another Channel
Configuring the use of external passcodes	Configuring External Passcode Validation
Setting an OTP-related logon application	Configuring an OTP-Related Logon Application
Getting OTP logs and traces	Collecting Traces with the Security Troubleshooting Wizard
Configuring logon to supported systems	Configuring Logon to Supported Systems

Operations in One-Time Password Administration UI

You access the One-Time Password Administration UI at http://<host>:<port>/ssoadmin/otp and can use it for the following:

Operation	Reference
Configuring specifics for single-factor authentication	Configuring Single-Factor Authentication
Configuring specifics for two-factor authentication	Configuring Two-Factor Authentication
Disabling user accounts	Managing User Accounts
Setting a policy for locking of user accounts	Additional Settings
Unlocking user accounts	Managing User Accounts
Setting the validity of user accounts	Managing User Accounts
Advanced user search	Managing User Accounts
Setting passcode length	Additional Settings
Setting passcode digest algorithm	Additional Settings
Configuring passcode provisioning for users with unsupported mobile devices	Configuring Authentication with a Random Passcode Sent by SMS, E-Mail, or Another Channel
Configuring the use of external passcodes	Configuring External Passcode Validation
Customizing the Mobile Device Setup UI	Additional Settings
Setting an expiration warning period for all user accounts	Additional Settings

Required Role Assignments

Users can only access OTP tools if they have been assigned the corresponding roles. Provided you have permission to access SAP NetWeaver Administrator, you can assign OTP roles to the corresponding user management engine (UME) groups, roles, or users. For more information, see Assigning Principals to UME Roles or Groups.

You should assign the following OTP roles to the UME groups or users that use OTP authentication:

OTP_ADMINISTRATOR
This role is assigned to administrators to use One-Time Password Administration UI.
OTP_USER
This role is assigned to users to set up their authenticator apps for OTP authentication.
OTP_ONLINE_USER
This role is assigned to users for online account setup, which requires a confirmation code.

If you decide not to use the OTP roles mentioned above, you need to assign the following actions to the UME roles that you will use for OTP authentication:

OTP_ADMINISTRATION
This is an action for administrators using One-Time Password Administration UI.
OTP_ACTIVATION
This is an action for users setting up their authenticator apps.
OTP_ONLINE_ACTIVATION
This is an action for authenticator users for online account setup.