After the successful authentication of initial credentials, the user needs to choose one of the OTP options as a second-factor authentication. Access to the protected resource is provided when the OTP received by the user is entered in the OTP login page.

Let's assume the Adaptive Authentication Service is enabled and configured for second factor authentication. When the user accesses a resource protected by Access Manager, a page is displayed that requests a user name and password. If these initial credentials are authenticated successfully, a Second Factor Authentication Preferred Method Page page is displayed and the user selects from one of the options. In this use case, the user selects one of the OTP options and receives a OTP through SMS/Email or generated and displayed by the OMA app. The user enters the OTP in the OTP login page.

Figure 35-2 shows the OTP login page.

Figure 35-2 One Time Password Login Page

Description of "Figure 35-2 One Time Password Login Page"

Once the OTP is successfully validated by Access Manager, the user is directed to the protected resource. On failure of any of the OTP options, an error message will be displayed, and the user will be returned to the same OTP page.

The following topics describe how the user may receive the OTP:

• About using OTP through Email or SMS

• About using OTP from Oracle Mobile Authenticator

The Access Manager sends an Access Request Notification to the notification server which is then pushed to the user’s configured device.

Let's assume the Adaptive Authentication Service is enabled and configured for second factor authentication. When the user accesses a resource protected by Access Manager, a page is displayed that requests a user name and password. If these initial credentials are authenticated successfully, a Second Factor Authentication Preferred Method page is displayed and the user selects from one of the options. In this use case, the user selects Access Request Notification from Oracle Mobile Authenticator.

Figure 35-3 shows the Second Factor Authentication Preferred Method Page with Access Request Notification that has been selected.

Figure 35-3 Access Request Notification Preferred Method Page

Description of "Figure 35-3 Access Request Notification Preferred Method Page"

When the user selects Access Request Notification from the Second Factor Authentication Preferred Method Page, Access Manager sends an Access Request Notification to either the Apple Push Notification Server or the Google Notification Server depending upon the user's configured device. The notification server then pushes a notification to the mobile device and the user will approve or deny it. Based on a successful response, the user will be directed to the protected resource. On failure, an error message will be displayed and the user will be returned to the same OTP page.

Figure 35-4 shows the Access Request Notification message that is displayed during this process.

Figure 35-4 Access Request Notification Wait Screen

Description of "Figure 35-4 Access Request Notification Wait Screen"

The user downloads the OMA app to the mobile device and configures it to receive the access request notification.

There are three parts to enabling the Secret Key API.

Access Manager provides the Adaptive Authentication Plug-in that you can use for two-factor authentication.

1. Log into the Oracle Access Management Console as System Administrator.
2. From the Application Security Launch Pad, click Authentication Plug-ins in the Plug-ins panel.
3. From the Authentication Plug-in tab, type Adaptive in the quick search box above the Plug-in Name column and hit Enter.

   The AdaptiveAuthenticationPlugin is displayed.

4. Change the properties displayed under Plug-in Details: AdaptiveAuthenticationPlugin as applicable to your environment.

   Table 35-1 describes the Adaptive Authentication Plugin properties.

   Table 35-1 Adaptive Authentication Plugin Properties

   Property	Description	Default Value	Required for Challenge Method
   IdentityStoreRef	Identity store name	Default_Store	All
   TotpSecretKeyAttribute	Name of the user attribute in which the secret key is stored.	Attribute description	OTP using OMA, Time based OTP
   TotpTimeWindow	The number of OTP codes generated by the mobile device that Access Manager will accept for validation. Since the mobile device generates a new OTP every 30 seconds, if the value is 3, Access Manager will accept the current and last three OTPs generated by the mobile device.	3	OTP using OMA, Time based OTP
   PushAPNsProdServer	If set to true, the APNS production server will be used to send notifications.	false	Access Request Notifications (iOS)
   PushProxyHost	Name of the proxy host if notifications are to sent to the server using a proxy.		Access Request Notifications
   PushProxyPort	Proxy port if notifications are to sent to the server using a proxy.	80	Access Request Notifications
   PushProxyProtocol	Proxy protocol	https://	Access Request Notifications
   UmsAvailable	When Adaptive Authentication Service requires UMS to send Email and SMS, set to true.	false	SMS, Email
   UmsClientUrl	URL of UMS web service		SMS, Email
   PhoneField	Attribute in the identity store where the user phone number is stored	mobile	SMS
   EmailField	Attribute in the identity store where the user email address is stored	mail	Email
   Totp_Enabled Email_Enabled Sms_Enabled Push_Enabled	Controls the options displayed in the UI. If enabled and user is not registered for Push, not setup for TOTP, or doesn't have email/phone populated in id store, those options won't be displayed. For example if user has not registered for TOTP and Push but has email populated then Email will be the only option shown.	true NOTE: Properties should be set to false only when the Administrator wants to disable a particular feature for all users.
   OTP REST Configuration Options
   ValidateAnyPin	If true, user can submit any pin that has been generated for that user, if it is still valid. Pin is valid if it has not been successfully used and has not expired. If false, user can submit only the pin that matches the correlationId being submitted in order to validate the pin.	false
   MaxAttempts	Maximum attempts for a user to validate the pin. If MaxAttempts is exceeded, user must be reset. Value of 0, means no limit.	0
   MaxPins	Maximum number of pins to store for a single user. If more pins are requested after the maximum is reached, the oldest pin is replaced.	5
   VerboseOutput	If true, the REST output includes detailed information about errors. If false, the REST output includes minimal information about errors.	true
   pinExpiry	Availability of One Time Pin (OTP). The unit of measurement is a millisecond. The pinExpiry field in the AdaptiveAuthenticationPlugin governs the expiry of the Email/SMS OTP codes.	300000	SMS, Email

   Note:

   In addition to the properties (related to OTP generation in Adaptive Autentication plugin) specified in Table 35-1, you can override settings in oam-config.xml by adding them to the ConfigParams section of the OAMMFAOTP definition.

   This also allows for app-specific configuration by adding app as a prefix to the property name. For example, "app1.ValidateAnyPin" sets and validates any pin setting specifically for app1 without affecting the configurations for other applications.

5. Click Save.
6. Update the same properties as applicable in the AdaptiveAuthenticationModule by clicking Authentication Modules under Plug-ins in the Access Manager Launch Pad.

   From the Authentication Modules tab, search for AdaptiveAuthenticationModule.

   Table 35-1 does not list all available Adaptive Authentication Service properties.

Use the WLST command line script to set the credentials for the Oracle User Messaging Service (UMS), the iOS certificate or the Android API key.

1. cd <MW_HOME>/oracle_common/common/bin
2. ./wlst.sh
3. connect()
4. Enter the WebLogic user name and password when prompted.
5. Press Enter to accept the default URL or modify the host and port as necessary and press Enter.
6. Run one or more of the following commands to set credentials for the UMS server, iOS or Android depending on your deployment.

   Note:

   Replace <UMS SERVER USER NAME>, <UMS SERVER PASSWORD>, <CERTIFICATE STORE PASSWORD> with values specific to your environment. Do not change the values for any parameters in these commands but those listed and marked as variables.

   • For OTP for email/SMS only:

     createCred(map="OAM_CONFIG", key="umsKey", user="<UMS SERVER USER NAME>", 
       password="<UMS SERVER PASSWORD>")
     

     For example:

     createCred(map="OAM_CONFIG", key="umsKey", user="weblogic", 
       password="password")
     

   • For Access Request (Push) Notifications on iOS only:

     createCred(map="OAM_CONFIG", key="pushApnsCertKey", user="apnskey", 
       password="<CERTIFICATE STORE PASSWORD>") 
     

     For example:

     createCred(map="OAM_CONFIG", key="pushApnsCertKey", user="apnskey", 
       password="password")
     

     See Creating a Java KeyStore for iOS Access Request (Push) Notifications when using iOS.

   • For Access Request (Push) Notifications on Android only, use the service account json as request body with the following curl command:

     curl --location --request PUT '<Admin Host>:<Admin Port>/oam/services/rest/notifications/android/api/v1/service-account-content' \
     --header 'Accept: text/plain' \
     --header 'Content-Type: application/json' \
     --header 'Authorization: Basic <Basic Authentication Header>' \
     --data-raw '{
       "type": "service_account",
       "project_id": "<Project Id>",
       "private_key_id": "<Private Key Id",
       "private_key": "<Private Key>",
       "client_email": "<Client Email>",
       "client_id": "<Client Id>",
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "<url>",
       "universe_domain": "googleapis.com"
     }'

7. Verify the keys by logging into Fusion Middleware Control, navigating to Domain > Security > Credentials, and checking the OAM_CONFIG map for the keys input using the commands.

When using Access Request Notifications on iOS, create a Java KeyStore (JKS) by using the cert file and key file.

openssl x509 -in aps_production.cer -inform DER -out aps_production.pem 
 -outform PEM

openssl pkcs12 -nocerts -in OMAKey.p12 -out OMAKey.pem

openssl pkcs12 -export -inkey OMAKey.pem -in aps_production.pem 
 -out iOS_prod.p12

keytool -import -keystore APNsCertificate.jks -file aps_production.cer 
 -alias PushCert

keytool -importkeystore -destkeystore APNsCertificate.jks 
 -deststoretype JKS -srcstoretype PKCS12 -srckeystore iOS_prod.p12

You can configure Access Manager when a user needs to have access to a protected resource with VPN software.

1. Log into the Oracle Access Management Console as System Administrator.
2. From the Application Security Launch Pad, click Application Domains in the Access Manager panel.

   The Application Domain tab is displayed.

3. Click Search to display all available Application Domains.
4. Click the Application Domain name that contains the resource being protected.

   The Application Domain opens in a new tab.

5. Click Authentication Policies in the Application Domain tab.
6. Click the name of the Authentication Policy that is being used to protect the particular resource for which two factor authentication is being configured.

   The appropriate Authentication Policy opens in a new tab.

7. Click Advanced Rules in the Authentication Policy tab.
8. Add a new rule by clicking the plus sign (+) under Post Authentication.

   The Add Rule dialog is displayed.

9. Enter a Rule Name and the following jython script.

   location.clientIP.startswith('10.')

   See Context Data for Advanced Rules.

10. Select the AdaptiveAuthenticationScheme Authentication Scheme from the If Condition is True drop-down list.

    This Authentication Scheme will be used when the defined condition is true.

11. Click Add and then Apply to complete the procedure.