Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is an OTP (One-Time Password)?
Short answer
An OTP (One-Time Password) is a verification code that is valid only once and for a short time; since it cannot be reused even if it is captured, it is used as a second factor. The code is either sent to the user over a channel (e-mail, SMS) or generated based on time in the authenticator application on the user's device (TOTP). In TR7 AGS, the Multi-Factor Authentication (MFA) profile has two sending methods: E-mail OTP sends the code to the user's e-mail address with TR7's e-mail settings, and HTTP OTP passes the code with an HTTP request to the organization's SMS gateway, e-mail service or another of its services. In both methods, the length of the code is set with OTP Length (4–10, default 6), the character type with OTP Type (default Numeric), the validity time with OTP Expiration (30 seconds – 60 minutes, default 5 minutes) and resending with Allow OTP Resend. Two-factor Authentication (2FA) in the TR7 management interface also sends a one-time code by e-mail or SMS.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Multi-Factor Authentication (MFA) | MFA Method = E-mail OTP or HTTP OTP | Second factor with a sent one-time code |
| Same form | OTP Length, OTP Type (Numeric / Alphanumeric), OTP Expiration, Allow OTP Resend (on by default), Resend Cooldown (default 30 seconds) | The format and duration of the code and the resend rules |
| Same form (E-mail OTP; in HTTP OTP, Channel = E-mail) | E-mail Source (Automatic / Choose) | The source of the e-mail address to which the code is sent |
| Same form (HTTP OTP) | Channel (SMS, E-mail, Custom), Phone Source (when Channel = SMS), HTTP URL | Passing the code with an HTTP request to an external SMS or HTTP service that delivers the OTP code; the AGS OTP code, AGS OTP message and AGS OTP recipient variables are used in the request |
| AGS-enabled vService → Dashboard | AGS OTP Sending (All Channels), AGS OTP Verification (All Channels) and the per-channel E-mail / SMS / Custom OTP charts | Monitoring the codes sent, resent, failed to send, and entered correctly and incorrectly per second |
| Settings → Device Management → Management Access | Two-factor Authentication (2FA), 2FA methods | The code sent by e-mail or SMS at management interface login |
Sent Code and Generated Code
| E-mail OTP / HTTP OTP | TOTP | |
|---|---|---|
| Where the code is created | Generated on TR7 and sent to the user | Generated in the user's authenticator application |
| Is a channel required | Yes (e-mail, SMS or an external HTTP service that delivers the OTP code) | No; after the first registration, no channel is required |
| Validity | The OTP expiration time | With TOTP period and TOTP window |
| Details | This page | What is TOTP? |
Common Misconceptions
- "OTP and TOTP are the same." TOTP is a type of OTP generated on the device based on time; E-mail OTP and HTTP OTP, on the other hand, are sent codes.
- "Keeping the code duration long makes it user-friendly." A long validity extends the time during which a captured code can be used; OTP Expiration is kept as long as is needed for the code to arrive.
- "HTTP OTP requires an Authentication Server record." HTTP OTP takes the address of the request from the profile's own HTTP URL field; it has no relation to the Authentication Servers records.
How it is done in the documentation
Related questions
