CA Strong Authentication Administration Guide › Managing Global CA AuthMinder Configurations › Configuring Profiles and Policies › Configuring ArcotID OTP (OATH-Compliant) Settings › Configuring CA Auth ID OTP (OATH-Compliant) Issuance Profile

Configuring CA Auth ID OTP (OATH-Compliant) Issuance Profile

An CA Auth ID OTP-OATH profile can be used to specify the following attributes related to CA Auth ID OTPs that are complaint to OATH standards.

• Length: The length of the CA Auth ID OTP.
• Validity period: The period for which an CA Auth ID OTP is valid.

By configuring an CA Auth ID OTP-OATH profile and assigning it to one or more organizations, you can control the characteristics of CA Auth ID OTP credentials that are issued to users of those organizations. Use the CA MobileOTP Profiles page to create CA MobileOTP credential profiles.

Follow these steps:

1. Click the Services and Server Configurations tab on the main menu.
2. Verify that the CA Strong Authentication tab in the submenu is active.
3. Under the ArcotOTP-OATH section, click the Issuance link to display the ArcotOTP-OATH Profiles page.
4. Edit the fields in the Profile Configurations section, as required.

   Create

   If you choose to create a new profile, then:

   • Select the Create option.
   • Specify the Configuration Name of the new profile in the field that appears.

   Update

   If you choose to update an existing profile, then select the profile that you want to update from the Select Configuration list that appears.

   Copy Configuration

   Enable this option if you want to create the profile by copying the configurations from an existing profile.

   Note: You can also copy from configurations that belong to other organizations that you have scope on.

   Available Configurations

   Select the profile from which the configurations will be copied.

   Token Type

   Select the type of CA Auth ID OTP that must be created for the user. HOTP represents counter-based tokens and TOTP represents time-based tokens.

   Length

   Set the length of an CA Auth ID OTP.

   The minimum length of the CA Auth ID OTP can be 6 (which is also the default value) and the maximum length can be up to 8 characters.

   Time Step

   The time interval, in seconds, during which the OTP generated by the client is the same as the OTP generated by the server. A larger time step allows the two OTPs to match for a longer period. In other words, a larger time step can accommodate a longer delay in receipt of the OTP from the client.

   You can enter any value from 1 to 300. The default is 30.

   Note: This option is applicable only for OTP-based CA Auth ID OTPs.

   Logo URL

   Enter the URL that contains the logo, which will be displayed on your client device that uses CA Auth ID OTP for authenticating to CA AuthMinder-protected applications.

   Display Name

   Enter the name that is used to display the CA Auth ID OTP on the client device. You can either enter a fixed string or pass the following user variables as $$(<variable>)$$:

   • user name (userName)
   • organization name (orgName)
   • credential custom attributes
   • user custom attributes

   Validity Start Date

   Set the date from when the issued CA Auth ID OTP credential will be valid.

   The validity can start from either the date when this credential is created or you can specify a custom date.

   Validity End Date

   Set the date when the CA Auth ID OTP will expire.

   You can choose any of the following options to set the expiration date:

   • Specify the duration
   • Specify a custom date
   • Choose Never Expires option if you want the CA Auth ID OTP to not expire at all.

5. Expand the Advanced Configurations section by clicking the [+] sign.
6. In the Custom Attributes section, specify any extra information in the Name-Value pair format. For example, the organization information that can be used by plug-ins.
7. In the Custom Card Attributes section, specify the additional information that you want to add to the CA Auth ID OTP-OATH card. These custom attributes will be available as part of the card string.
8. Set the following in the User Validations section:
   • Select the User Active option if you want to verify the user status for the following operations involving the current credential:
     • Create credential
     • Re-issue credential
     • Reset credential
     • Reset validity of the credential
   • Select the User Attribute option if you want to verify whether the user attribute matches certain values. You can set the value for the following user attributes:
     • Date when the user was created
     • Date when the user details were modified
     • Email address
     • First name
     • Middle name
     • Last name
     • User status
     • Telephone number
     • Unique user identifier

     Note: User attribute check feature is available only if you are performing configurations at the organization-level.

9. In the Multiple Credential Options section, enter the description to identify the purpose for which the CA Auth ID OTP is used in the Usage Type field. For example, a user can have a temporary credential to perform a remote login to the network, the usage type for this credential can be temporary.
10. Click Save to create or update the ArcotID OTP profile.
11. Refresh all deployed CA Strong Authentication instances. See Refresh a Server Instance for instructions about how to perform this procedure.